White Screen - Verbindung wird hergestellt

bloeci · 24.03.2012, 22:49

Hallo zusammen, ein bekannter ist wohl auch einem Virus zum Opfer gefallen. Es handelt sich um das Phänomen, dass unmittelbar nach dem Hochfahren ein weißer Bildschirm mit dem Hinweis "Warten Sie während die Verbindung hergestellt wird" und ebenso in Englisch angezeigt wird.

Ich habe das eine oder andere hier gelesen und bereits das LOG aus OTLPE erstellt.

Vielleicht könnt Ihr mir auch helfen? Vielen Dank schon mal!

Code:

ATTFilter

OTL logfile created on: 3/25/2012 1:42:02 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows 2000 Service Pack 4 (Version = 5.0.2195) - Type = SYSTEM
Internet Explorer (Version = 6.0.2800.1106)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
503.00 Mb Total Physical Memory | 343.00 Mb Available Physical Memory | 68.00% Memory free
455.00 Mb Paging File | 345.00 Mb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Programme
Drive C: | 18.64 Gb Total Space | 9.27 Gb Free Space | 49.73% Space Free | Partition Type: NTFS
Drive D: | 7.45 Gb Total Space | 7.45 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive E: | 37.27 Gb Total Space | 34.50 Gb Free Space | 92.57% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Unavailable] --  -- (IAS)
SRV - [2011/04/22 08:21:10 | 000,092,592 | ---- | M] (TomTom) [Auto] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2010/01/25 05:02:20 | 000,067,360 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Programme\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
SRV - [2009/07/21 08:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2005/06/03 02:37:10 | 000,123,152 | ---- | M] (Microsoft Corporation) [Auto] -- C:\WINNT\system32\mstask.exe -- (Schedule)
SRV - [2005/04/03 19:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/03/30 11:46:56 | 000,411,920 | ---- | M] (Eastman Kodak Company) [On_Demand] -- C:\WINNT\system32\drivers\KodakCCS.exe -- (KodakCCS)
SRV - [2003/06/19 15:05:04 | 000,196,706 | ---- | M] (Microsoft Corporation) [Auto] -- C:\WINNT\system32\wbem\WinMgmt.exe -- (WinMgmt)
SRV - [2003/06/19 15:05:04 | 000,147,728 | ---- | M] (VERITAS Software Corp.) [On_Demand] -- C:\WINNT\System32\dmadmin.exe -- (dmadmin)
SRV - [2003/06/19 15:05:04 | 000,096,016 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\WINNT\system32\FAXSVC.EXE -- (Fax)
SRV - [2003/06/19 15:05:04 | 000,068,368 | ---- | M] (Microsoft Corporation) [Auto] -- C:\WINNT\system32\regsvc.exe -- (RemoteRegistry)
SRV - [2003/06/19 15:05:04 | 000,062,224 | ---- | M] (Microsoft Corporation) [Auto] -- C:\WINNT\system32\stisvc.exe -- (StiSvc)
SRV - [2003/06/19 15:05:04 | 000,022,800 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\WINNT\system32\utilman.exe -- (UtilMan)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | System] --  -- (tga)
DRV - File not found [Kernel | System] --  -- (sglfb)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2009/05/11 04:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINNT\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/30 04:32:15 | 000,097,512 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINNT\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/03/24 10:07:19 | 000,065,240 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINNT\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/02/13 06:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2006/01/11 19:00:00 | 000,152,336 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\e100bnt5.sys -- (E100B) Intel(R)
DRV - [2005/06/16 09:41:02 | 000,037,150 | ---- | M] (Eastman Kodak Company) [Kernel | System] -- C:\WINNT\system32\drivers\DcCam.sys -- (DcCam)
DRV - [2005/03/31 03:00:08 | 000,152,081 | ---- | M] (Eastman Kodak Company) [Kernel | System] -- C:\WINNT\system32\drivers\ExportIt.sys -- (Exportit)
DRV - [2005/03/31 02:47:56 | 000,070,262 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\DcPtp.sys -- (DcPTP)
DRV - [2005/03/31 02:47:50 | 000,008,022 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\DcLps.sys -- (DcLps)
DRV - [2005/03/31 02:47:48 | 000,038,673 | ---- | M] (Eastman Kodak Company) [Kernel | Auto] -- C:\WINNT\system32\drivers\DCFS2k.sys -- (DCFS2K)
DRV - [2005/03/31 02:47:42 | 000,061,564 | ---- | M] (Eastman Kodak Company) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\DcFpoint.sys -- (DcFpoint)
DRV - [2003/06/19 15:05:04 | 000,369,104 | ---- | M] (VERITAS Software Corp.) [Kernel | Disabled] -- C:\WINNT\system32\drivers\dmboot.sys -- (dmboot)
DRV - [2003/06/19 15:05:04 | 000,137,936 | ---- | M] (VERITAS Software Corp.) [Kernel | Boot] -- C:\WINNT\system32\drivers\dmio.sys -- (dmio)
DRV - [2003/06/19 15:05:04 | 000,060,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\parallel.sys -- (Parallel)
DRV - [2003/06/19 15:05:04 | 000,049,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\usbhub20.sys -- (usbhub20)
DRV - [2003/06/19 15:05:04 | 000,032,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\uhcd.sys -- (uhcd)
DRV - [2003/06/19 15:05:04 | 000,027,440 | ---- | M] (Microsoft Corporation) [File_System | Disabled] -- C:\WINNT\System32\drivers\efs.sys -- (EFS)
DRV - [2003/06/19 15:05:04 | 000,007,728 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- C:\WINNT\System32\drivers\diskperf.sys -- (Diskperf)
DRV - [2003/06/19 15:05:04 | 000,007,312 | ---- | M] (VERITAS Software Corp.) [Kernel | Boot] -- C:\WINNT\system32\drivers\dmload.sys -- (dmload)
DRV - [2001/05/08 07:00:00 | 000,021,712 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\rca.sys -- (RCA) Microsoft Streaming Network-RCA (Raw Channel Access)
DRV - [2001/05/08 07:00:00 | 000,009,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINNT\system32\drivers\netdtect.sys -- (NetDetect)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\System32\blank.htm
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.de/
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Förster_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKU\Förster_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Förster_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/webhp?rls=ig"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.60
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINNT\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.27\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/02/20 09:41:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.27\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/02/20 04:39:19 | 000,000,000 | ---D | M]
 
[2010/02/11 10:27:27 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions
[2010/02/11 10:33:21 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\6jw4e8nz.default\extensions
[2010/02/11 10:33:17 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\6jw4e8nz.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2012/03/04 13:46:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010/08/21 11:24:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/07/06 14:56:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/05/03 22:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2010/12/11 07:03:47 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010/12/11 07:03:48 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2010/12/11 07:03:48 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/12/11 07:03:49 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2010/12/11 07:03:49 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001/05/08 07:00:00 | 000,000,820 | ---- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKU\Förster_ON_C\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [VX2bt1oYNKCLnkO] C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe (Cutting Edge Software Inc.)
O4 - HKU\.DEFAULT..\Run: [internat.exe] C:\WINNT\System32\internat.exe (Microsoft Corporation)
O4 - HKU\Administrator_ON_C..\Run: [internat.exe] C:\WINNT\System32\internat.exe (Microsoft Corporation)
O4 - HKU\Förster_ON_C..\Run: [EPSON SX410 Series] C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_FATIFCE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\Förster_ON_C..\Run: [internat.exe] C:\WINNT\System32\internat.exe (Microsoft Corporation)
O4 - HKU\Förster_ON_C..\Run: [TomTomHOME.exe] C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\Förster_ON_C..\Run: [VX2bt1oYNKCLnkO] C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe (Cutting Edge Software Inc.)
O4 - HKLM..\RunOnceEx: []  File not found
O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Kodak EasyShare Software.lnk = C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Förster\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\Förster_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\Förster_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Förster_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Förster_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Programme\Bonjour\ExplorerPlugin.dll (Apple Computer, Inc.)
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\Web\RELATED.HTM ()
O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\Web\RELATED.HTM ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINNT\system32\RNR20.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINNT\system32\msafd.dll (Microsoft Corporation)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265804275531 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?40219.2404513889 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: DirectAnimation Java Classes file://C:\WINNT\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINNT\Java\classes\xmldso.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINNT\system32\msdxm.ocx (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - HKLM Winlogon: UserInit - (C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\System32\userinit.exe) -  File not found
O20 - HKU\Förster_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - HKU\Förster_ON_C Winlogon: UserInit - (C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe) - C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe (Cutting Edge Software Inc.)
O20 - HKU\Förster_ON_C Winlogon: UserInit - (C:\WINDOWS\System32\userinit.exe) -  File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINNT\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\wzcnotif: DllName - wzcdlg.dll - C:\WINNT\System32\wzcdlg.dll (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: E:\Bilder\2008-06-07\100_0261.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/09 16:00:52 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer-Klassen für Java
ActiveX: {0fde1f56-0d59-4fd7-9624-e3df6b419d0e} - Internet Explorer ReadMe
ActiveX: {0fde1f56-0d59-4fd7-9624-e3df6b419d0f} - IEEX
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - VML (Vector Graphics Rendering)
ActiveX: {1b0357b8-e3fb-4918-915c-a8eb232c273e} - KB973354
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing-Paket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {4fbff6eb-7540-4f56-a35e-50ff06f9d941} - KB978207
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - Microsoft Data Access Components KB870669
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {5ueDxYLo-I543-1otK-kGTs-C9Y55G4HYphK} - 
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {685e3910-1f77-49b9-9434-50bcd95c51ab} - KB905495
ActiveX: {6A5110B5-E14B-4268-A065-EF89FF33C325} - regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {86f63941-db5d-4de3-818f-f81f90afb602} - KB978542
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\System32\ie4uinit.exe
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} - %SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl
ActiveX: {A00BF2EB-56EE-4fde-B5EA-6A8FA425B2A5} - W2KAppComp
ActiveX: {b6609c7e-4ad5-4b8b-9da5-9edbc50f7592} - KB958869
ActiveX: {bfb9c191-4d2f-49bd-aa21-4308475e1cc7} - KB980182
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {f51becec-f7b3-4401-a2f3-88387ad7722b} - KB982381
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Windows Media Player
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - "C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - "C:\WINNT\system32\shmgrate.exe" OCInstallUserConfigOE
 
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Nwsapagent -  File not found
 
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 2
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/03/05 09:41:18 | 000,304,640 | ---- | C] (Cutting Edge Software Inc.) -- C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe
[4 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/03/12 14:07:28 | 000,016,384 | ---- | M] () -- C:\WINNT\System32\Perflib_Perfdata_240.dat
[2012/03/12 14:00:52 | 000,016,384 | ---- | M] () -- C:\WINNT\System32\Perflib_Perfdata_364.dat
[2012/03/06 04:24:39 | 000,016,384 | ---- | M] () -- C:\WINNT\System32\Perflib_Perfdata_370.dat
[2012/03/06 04:12:42 | 000,016,384 | ---- | M] () -- C:\WINNT\System32\Perflib_Perfdata_23c.dat
[2012/03/05 10:08:37 | 000,016,384 | ---- | M] () -- C:\WINNT\System32\Perflib_Perfdata_238.dat
[2012/03/05 09:41:13 | 000,304,640 | ---- | M] (Cutting Edge Software Inc.) -- C:\Dokumente und Einstellungen\Förster\Application Data\h6s5ruij653.exe
[2012/03/05 09:15:21 | 003,804,160 | R--- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mbb
[2012/03/05 09:15:21 | 001,775,616 | R--- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mb
[2012/03/05 09:02:08 | 000,016,384 | ---- | M] () -- C:\WINNT\System32\Perflib_Perfdata_234.dat
[2012/03/01 06:29:55 | 000,054,156 | -H-- | M] () -- C:\WINNT\QTFont.qfn
[4 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/03/12 14:07:28 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_240.dat
[2012/03/12 14:00:52 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_364.dat
[2012/03/06 04:24:39 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_370.dat
[2012/03/06 04:12:42 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_23c.dat
[2012/03/05 10:08:37 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_238.dat
[2012/03/05 09:02:08 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_234.dat
[2011/05/27 06:32:49 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_4bc.dat
[2010/08/21 11:24:26 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_268.dat
[2010/08/21 07:03:41 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_5cc.dat
[2010/08/14 13:17:53 | 000,111,932 | ---- | C] () -- C:\WINNT\System32\EPPICPrinterDB.dat
[2010/08/14 13:17:53 | 000,021,390 | ---- | C] () -- C:\WINNT\System32\EPPICPattern5.dat
[2010/08/14 13:17:53 | 000,011,811 | ---- | C] () -- C:\WINNT\System32\EPPICPattern4.dat
[2010/08/14 13:17:53 | 000,004,943 | ---- | C] () -- C:\WINNT\System32\EPPICPattern6.dat
[2010/08/14 13:17:53 | 000,001,146 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_DU.dat
[2010/08/14 13:17:53 | 000,001,139 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_PT.dat
[2010/08/14 13:17:53 | 000,001,139 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_BP.dat
[2010/08/14 13:17:53 | 000,001,136 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_ES.dat
[2010/08/14 13:17:53 | 000,001,129 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_FR.dat
[2010/08/14 13:17:53 | 000,001,129 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_CF.dat
[2010/08/14 13:17:53 | 000,001,120 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_IT.dat
[2010/08/14 13:17:53 | 000,001,107 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_GE.dat
[2010/08/14 13:17:53 | 000,001,104 | ---- | C] () -- C:\WINNT\System32\EPPICPresetData_EN.dat
[2010/08/14 13:17:53 | 000,000,097 | ---- | C] () -- C:\WINNT\System32\PICSDK.ini
[2010/08/14 13:17:52 | 000,031,053 | ---- | C] () -- C:\WINNT\System32\EPPICPattern131.dat
[2010/08/14 13:17:52 | 000,027,417 | ---- | C] () -- C:\WINNT\System32\EPPICPattern121.dat
[2010/08/14 13:17:52 | 000,026,154 | ---- | C] () -- C:\WINNT\System32\EPPICPattern1.dat
[2010/08/14 13:17:52 | 000,024,903 | ---- | C] () -- C:\WINNT\System32\EPPICPattern3.dat
[2010/08/14 13:17:52 | 000,020,148 | ---- | C] () -- C:\WINNT\System32\EPPICPattern2.dat
[2010/07/17 05:44:00 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_3ac.dat
[2010/05/06 07:40:49 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_3b4.dat
[2010/05/04 08:19:38 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_3b0.dat
[2010/04/26 07:43:46 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_3bc.dat
[2010/04/20 05:29:10 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_104.dat
[2010/04/17 07:22:37 | 000,000,000 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_27c.dat
[2010/03/18 03:50:17 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_1ec.dat
[2010/03/15 05:37:18 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_2b0.dat
[2010/03/06 17:25:39 | 000,001,763 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2010/02/23 09:48:44 | 000,016,384 | ---- | C] () -- C:\WINNT\System32\Perflib_Perfdata_394.dat
[2010/02/11 10:27:22 | 000,000,000 | ---- | C] () -- C:\WINNT\nsreg.dat
[2010/02/09 15:58:15 | 000,022,080 | -H-- | C] () -- C:\Programme\folder.htt
[2010/02/09 15:56:52 | 000,015,076 | ---- | C] () -- C:\WINNT\System32\emptyregdb.dat
[2010/02/09 14:41:20 | 000,303,354 | ---- | C] () -- C:\WINNT\System32\PerfStringBackup_001.INI
[2010/02/09 14:41:16 | 000,004,073 | ---- | C] () -- C:\WINNT\ODBCINST.INI
[2010/02/09 14:40:05 | 000,100,640 | ---- | C] () -- C:\WINNT\System32\FNTCACHE.DAT
[2001/05/08 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINNT\System32\mlang.dat
[2001/05/08 07:00:00 | 000,300,378 | ---- | C] () -- C:\WINNT\System32\perfh009.dat
[2001/05/08 07:00:00 | 000,289,156 | ---- | C] () -- C:\WINNT\System32\perfh007.dat
[2001/05/08 07:00:00 | 000,272,492 | ---- | C] () -- C:\WINNT\System32\perfi009.dat
[2001/05/08 07:00:00 | 000,252,934 | ---- | C] () -- C:\WINNT\System32\perfi007.dat
[2001/05/08 07:00:00 | 000,217,359 | ---- | C] () -- C:\WINNT\System32\dssec.dat
[2001/05/08 07:00:00 | 000,176,400 | ---- | C] () -- C:\WINNT\System32\qcut.dll
[2001/05/08 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINNT\System32\mib.bin
[2001/05/08 07:00:00 | 000,046,232 | ---- | C] () -- C:\WINNT\System32\perfc007.dat
[2001/05/08 07:00:00 | 000,038,036 | ---- | C] () -- C:\WINNT\System32\perfc009.dat
[2001/05/08 07:00:00 | 000,034,108 | ---- | C] () -- C:\WINNT\System32\perfd007.dat
[2001/05/08 07:00:00 | 000,034,064 | ---- | C] () -- C:\WINNT\System32\efsadu.dll
[2001/05/08 07:00:00 | 000,028,270 | ---- | C] () -- C:\WINNT\System32\perfd009.dat
[2001/05/08 07:00:00 | 000,014,413 | ---- | C] () -- C:\WINNT\System32\iasperf.ini
[2001/05/08 07:00:00 | 000,003,056 | ---- | C] () -- C:\WINNT\System32\faxperf.ini
[2001/05/08 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINNT\System32\noise.dat
[2001/05/08 07:00:00 | 000,000,023 | ---- | C] () -- C:\WINNT\welcome.ini
[2000/09/08 12:53:50 | 000,073,839 | ---- | C] () -- C:\WINNT\System32\KodakOneTouch.dll
[1999/09/25 06:36:24 | 000,088,816 | ---- | C] () -- C:\WINNT\System32\drivers\lvcam.sys
[1999/09/25 06:36:22 | 000,017,424 | ---- | C] () -- C:\WINNT\System32\drivers\lvsound.sys
 
========== LOP Check ==========
 
[2011/01/04 12:33:37 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Förster\Anwendungsdaten\.#
[2010/08/14 15:00:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Förster\Anwendungsdaten\EPSON
[2010/02/12 03:20:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Förster\Anwendungsdaten\OpenOffice.org
[2011/07/06 14:47:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Förster\Anwendungsdaten\TomTom
[2010/02/11 12:08:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\OpenOffice.org
[2011/07/06 15:59:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Förster\Application Data\EPSON
[2011/08/10 04:45:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Förster\Application Data\OpenOffice.org
[2011/07/18 10:49:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Förster\Application Data\TomTom
[2010/08/14 13:27:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2011/07/18 10:54:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom
[2010/08/14 13:23:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011/10/21 05:18:10 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2011/09/24 07:04:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2010/03/06 17:07:16 | 000,000,000 | ---D | M] -- C:\KPCMS
[2011/10/21 04:25:43 | 000,000,000 | R--D | M] -- C:\Programme
[2010/02/11 12:14:36 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012/03/24 23:17:04 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/03/12 14:02:51 | 000,000,000 | ---D | M] -- C:\WINNT
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2010/02/10 09:52:32 | 010,091,200 | ---- | M] () .cab file -- C:\WINNT\Driver Cache\i386\sp4.cab:AGP440.sys
[2010/02/10 09:52:32 | 010,091,200 | ---- | M] () .cab file -- C:\WINNT\ServicePackFiles\i386\sp4.cab:AGP440.sys
[2003/06/19 15:05:04 | 000,021,008 | ---- | M] (Microsoft Corporation) MD5=CDDB71A90077C93BEA5C72507F0B1394 -- C:\WINNT\ServicePackFiles\i386\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2010/02/10 09:52:32 | 010,091,200 | ---- | M] () .cab file -- C:\WINNT\Driver Cache\i386\sp4.cab:atapi.sys
[2010/02/10 09:52:32 | 010,091,200 | ---- | M] () .cab file -- C:\WINNT\ServicePackFiles\i386\sp4.cab:atapi.sys
[2003/06/19 15:05:04 | 000,086,672 | ---- | M] (Microsoft Corporation) MD5=8C718AA8C77041B3285D55A0CE980867 -- C:\WINNT\ServicePackFiles\i386\atapi.sys
[2003/06/19 15:05:04 | 000,086,672 | ---- | M] (Microsoft Corporation) MD5=8C718AA8C77041B3285D55A0CE980867 -- C:\WINNT\system32\drivers\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2005/06/03 03:44:44 | 000,049,424 | ---- | M] (Microsoft Corporation) MD5=ABA7CF4DEA4975E37692DFA1DBCE1B79 -- C:\WINNT\system32\dllcache\EVENTLOG.DLL
[2005/06/03 03:44:44 | 000,049,424 | ---- | M] (Microsoft Corporation) MD5=ABA7CF4DEA4975E37692DFA1DBCE1B79 -- C:\WINNT\system32\EVENTLOG.DLL
[2003/06/19 15:05:04 | 000,047,888 | ---- | M] (Microsoft Corporation) MD5=F5DB4550941A365A49C400BC3C0090DE -- C:\WINNT\$NtUpdateRollupPackUninstall$\eventlog.dll
[2003/06/19 15:05:04 | 000,047,888 | ---- | M] (Microsoft Corporation) MD5=F5DB4550941A365A49C400BC3C0090DE -- C:\WINNT\ServicePackFiles\i386\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2003/06/19 15:05:04 | 000,245,008 | ---- | M] (Microsoft Corporation) MD5=9A067872F0A9DC15E93DBEFC9E1453A7 -- C:\WINNT\explorer.exe
[2003/06/19 15:05:04 | 000,245,008 | ---- | M] (Microsoft Corporation) MD5=9A067872F0A9DC15E93DBEFC9E1453A7 -- C:\WINNT\ServicePackFiles\i386\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2005/06/02 15:14:44 | 000,366,864 | ---- | M] (Microsoft Corporation) MD5=0A9042FA3A787432124C700B53638786 -- C:\WINNT\$NtUninstallKB954600_WM41$\netlogon.dll
[2005/06/03 03:44:44 | 000,366,864 | ---- | M] (Microsoft Corporation) MD5=0A9042FA3A787432124C700B53638786 -- C:\WINNT\$NtUninstallKB957097$\netlogon.dll
[2005/06/02 06:14:44 | 000,366,864 | ---- | M] (Microsoft Corporation) MD5=0A9042FA3A787432124C700B53638786 -- C:\WINNT\$NtUninstallKB960803$\netlogon.dll
[2005/06/02 15:14:44 | 000,366,864 | ---- | M] (Microsoft Corporation) MD5=0A9042FA3A787432124C700B53638786 -- C:\WINNT\$NtUninstallKB960859$\netlogon.dll
[2005/06/03 03:44:44 | 000,366,864 | ---- | M] (Microsoft Corporation) MD5=0A9042FA3A787432124C700B53638786 -- C:\WINNT\system32\dllcache\NETLOGON.DLL
[2005/06/02 15:14:44 | 000,366,864 | ---- | M] (Microsoft Corporation) MD5=0A9042FA3A787432124C700B53638786 -- C:\WINNT\system32\NETLOGON.DLL
[2003/06/19 15:05:04 | 000,371,984 | ---- | M] (Microsoft Corporation) MD5=AFFDAF795FF9B3A8AAA5A36E95FB11E6 -- C:\WINNT\$NtUpdateRollupPackUninstall$\netlogon.dll
[2003/06/19 15:05:04 | 000,371,984 | ---- | M] (Microsoft Corporation) MD5=AFFDAF795FF9B3A8AAA5A36E95FB11E6 -- C:\WINNT\ServicePackFiles\i386\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2003/06/19 15:05:04 | 000,119,056 | ---- | M] (Microsoft Corporation) MD5=F596F47F60D63D79BD91E91919988481 -- C:\WINNT\$NtUpdateRollupPackUninstall$\scecli.dll
[2003/06/19 15:05:04 | 000,119,056 | ---- | M] (Microsoft Corporation) MD5=F596F47F60D63D79BD91E91919988481 -- C:\WINNT\ServicePackFiles\i386\scecli.dll
[2005/06/03 03:44:44 | 000,119,056 | ---- | M] (Microsoft Corporation) MD5=F7B05B1A74D0F1C23D4D14C77F50A819 -- C:\WINNT\system32\dllcache\scecli.dll
[2005/06/03 03:44:44 | 000,119,056 | ---- | M] (Microsoft Corporation) MD5=F7B05B1A74D0F1C23D4D14C77F50A819 -- C:\WINNT\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007/03/06 07:17:36 | 000,381,712 | ---- | M] (Microsoft Corporation) MD5=3AE4FAC4D8FC34F75D7CFFB20CF1EC55 -- C:\WINNT\system32\dllcache\USER32.DLL
[2007/03/06 07:17:36 | 000,381,712 | ---- | M] (Microsoft Corporation) MD5=3AE4FAC4D8FC34F75D7CFFB20CF1EC55 -- C:\WINNT\system32\USER32.DLL
[2003/06/19 15:05:04 | 000,403,728 | ---- | M] (Microsoft Corporation) MD5=DC81AC1067AD32F39D3B673CA8345C46 -- C:\WINNT\$NtUninstallKB925902$\user32.dll
[2003/06/19 15:05:04 | 000,403,728 | ---- | M] (Microsoft Corporation) MD5=DC81AC1067AD32F39D3B673CA8345C46 -- C:\WINNT\ServicePackFiles\i386\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2003/06/19 15:05:04 | 000,017,680 | ---- | M] (Microsoft Corporation) MD5=11A1AA9DF8C44386F72018D06F2E0E71 -- C:\WINNT\ServicePackFiles\i386\userinit.exe
[2003/06/19 15:05:04 | 000,017,680 | ---- | M] (Microsoft Corporation) MD5=11A1AA9DF8C44386F72018D06F2E0E71 -- C:\WINNT\system32\USERINIT.EXE
 
< MD5 for: WINLOGON.EXE  >
[2003/06/19 15:05:04 | 000,184,592 | ---- | M] (Microsoft Corporation) MD5=3EF30E020F67292F5698C8EAFDBB27EC -- C:\WINNT\$NtUpdateRollupPackUninstall$\winlogon.exe
[2003/06/19 15:05:04 | 000,184,592 | ---- | M] (Microsoft Corporation) MD5=3EF30E020F67292F5698C8EAFDBB27EC -- C:\WINNT\ServicePackFiles\i386\winlogon.exe
[2005/06/03 02:37:50 | 000,190,224 | ---- | M] (Microsoft Corporation) MD5=56E6FE4DED78FFD01679D467746A16F3 -- C:\WINNT\system32\dllcache\WINLOGON.EXE
[2005/06/03 02:37:50 | 000,190,224 | ---- | M] (Microsoft Corporation) MD5=56E6FE4DED78FFD01679D467746A16F3 -- C:\WINNT\system32\WINLOGON.EXE
 
< MD5 for: WS2IFSL.SYS  >
[2001/05/08 07:00:00 | 000,012,016 | ---- | M] (Microsoft Corporation) MD5=C8A15978B9C09023A3E096CB9B6689C5 -- C:\WINNT\system32\dllcache\ws2ifsl.sys
[2001/05/08 07:00:00 | 000,012,016 | ---- | M] (Microsoft Corporation) MD5=C8A15978B9C09023A3E096CB9B6689C5 -- C:\WINNT\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010/02/09 15:38:57 | 000,081,920 | ---- | M] () -- C:\WINNT\System32\config\default.sav
[2010/02/09 15:38:57 | 000,544,768 | ---- | M] () -- C:\WINNT\System32\config\software.sav
[2010/02/09 15:38:57 | 000,360,448 | ---- | M] () -- C:\WINNT\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2005/06/03 03:44:54 | 000,222,480 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINNT\system32\mstask.dll
[2008/04/15 19:13:18 | 002,387,216 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINNT\system32\SHELL32.DLL
[1 C:\WINNT\system32\*.tmp files -> C:\WINNT\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 7268 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1957.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 7180 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1952.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 6828 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1953.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 6632 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1959.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 6620 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1956.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 6408 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1958.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 5760 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1954.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 5380 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1955.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 4480 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1304.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 4388 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1303.jpg:Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 4208 bytes -> C:\Dokumente und Einstellungen\Förster\Eigene Dateien\100_1302.jpg:Q30lsldxJoudresxAaaqpcawXc
< End of report >

White Screen - Verbindung wird hergestellt

Log-Analyse und Auswertung: White Screen - Verbindung wird hergestellt

White Screen - Verbindung wird hergestellt

Ähnliche Themen: White Screen - Verbindung wird hergestellt