| |
| |||||||
Log-Analyse und Auswertung: Auch ich habe mich mit dem Verschluesselungstroaner infiziert.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.05.2012, 12:59
| #1 |
| |  Auch ich habe mich mit dem Verschluesselungstroaner infiziert. Nach dem ich die Boot CD erstellt hatte lies ich den scan laufen und hier nun meine Log dateien. Einen Extras.Text gab es nicht!OTL Logfile: Code:
ATTFilter OTL logfile created on: 5/4/2012 1:41:37 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,023.00 Mb Total Physical Memory | 821.00 Mb Available Physical Memory | 80.00% Memory free
907.00 Mb Paging File | 851.00 Mb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 24.41 Gb Total Space | 11.41 Gb Free Space | 46.76% Space Free | Partition Type: NTFS
Drive D: | 124.63 Gb Total Space | 17.46 Gb Free Space | 14.01% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand] -- -- (de_serv)
SRV - File not found [Auto] -- -- (AviraUpgradeService)
SRV - [2012/04/26 02:51:14 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2008/11/11 03:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2001/02/23 04:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (VcommMgr)
DRV - File not found [Kernel | On_Demand] -- -- (VComm)
DRV - File not found [Kernel | On_Demand] -- -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (InCDRm)
DRV - File not found [Kernel | System] -- -- (InCDPass)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - File not found [Kernel | Boot] -- -- (BTHidMgr)
DRV - File not found [Kernel | On_Demand] -- -- (BTHidEnum)
DRV - File not found [Kernel | On_Demand] -- -- (Btcsrusb)
DRV - File not found [Kernel | On_Demand] -- -- (BT)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletSCOAudio)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletAudio)
DRV - [2010/01/17 11:54:32 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008/08/26 03:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/08/21 00:52:41 | 003,299,840 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/07/29 21:53:52 | 000,017,920 | ---- | M] (SAMSUNG Electronics Co.,Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SSUSBDownload.sys -- (SSUSBDownload)
DRV - [2008/05/02 04:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007/12/06 04:51:00 | 000,285,952 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2007/05/02 10:32:34 | 000,135,680 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsa.sys -- (nmwcdsa)
DRV - [2007/05/02 10:31:54 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsacm.sys -- (nmwcdsacm)
DRV - [2007/05/02 10:31:54 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsacj.sys -- (nmwcdsacj)
DRV - [2007/05/02 10:31:54 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsac.sys -- (nmwcdsac)
DRV - [2007/04/16 16:46:00 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2007/01/28 06:23:22 | 000,271,360 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2007/01/28 06:23:21 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2006/09/18 09:59:08 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27unic.sys -- (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)
DRV - [2006/09/18 09:59:02 | 000,086,560 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27obex.sys -- (SE27obex)
DRV - [2006/09/18 09:59:00 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27nd5.sys -- (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)
DRV - [2006/09/18 09:58:58 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006/09/18 09:58:54 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006/09/18 09:58:52 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006/09/18 09:58:48 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2006/01/29 11:20:11 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto] -- C:\WINDOWS\system32\SVKP.sys -- (SVKP)
DRV - [2005/09/18 12:02:52 | 000,005,632 | ---- | M] () [Kernel | On_Demand] -- D:\Anwendungen\Peerguardian\PeerGuardian2\pgfilter.sys -- (pgfilter)
DRV - [2005/02/21 19:00:00 | 000,015,104 | R--- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\avmunet.sys -- (AVMUNET)
DRV - [2004/08/03 16:41:46 | 000,095,424 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)
DRV - [2004/08/03 16:41:46 | 000,013,240 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)
DRV - [2004/08/03 16:41:42 | 000,129,535 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slnt7554.sys -- (Slnt7554)
DRV - [2004/08/03 16:41:40 | 000,180,360 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax)
DRV - [2004/08/03 16:41:40 | 000,126,686 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2004/08/03 16:41:40 | 000,013,776 | ---- | M] (Smart Link) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\RecAgent.sys -- (RecAgent)
DRV - [2004/08/03 16:41:38 | 001,309,184 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)
DRV - [2004/04/15 07:52:32 | 000,204,032 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RT2500.sys -- (RT2500)
DRV - [2004/03/19 08:02:08 | 000,613,244 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/02/23 23:08:52 | 000,400,384 | R--- | M] (Sensaura) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2003/10/30 23:22:38 | 000,077,312 | R--- | M] (VIA Technologies inc,.ltd) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\viasraid.sys -- (viasraid)
DRV - [2003/08/05 22:43:04 | 000,159,744 | R--- | M] (Promise Technology, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Fasttx2k.sys -- (fasttx2k)
DRV - [2003/07/01 22:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2002/09/09 13:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,Prev Search Page = hxxp://www.google.com
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\Steffi_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Steffi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/04/26 02:51:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/04/05 16:32:46 | 000,000,000 | ---D | M]
[2012/04/26 02:51:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/03/20 12:25:05 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/04/26 02:51:14 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012/04/04 16:03:50 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012/03/20 12:24:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/03/20 12:24:39 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012/03/20 12:24:39 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012/03/20 12:24:39 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/03/20 12:24:39 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/03/20 12:24:39 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/10/25 15:05:07 | 000,000,928 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TempLeer] C:\WINDOWS\System32\Cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [YarcGUI] File not found
O4 - HKU\Steffi_ON_C..\Run: [C46AAF3D] C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Steffi\Startmenü\Programme\Autostart\dnetc.lnk = D:\Anwendungen\dnet\dnetc.exe (Distributed Computing Technologies, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Steffi\Startmenü\Programme\Autostart\PeerGuardian.lnk = D:\Anwendungen\Peerguardian\PeerGuardian2\pg2.exe (Methlabs)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 6
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoExpandedNewMenu = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = [binary data]
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261563041203 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (pushow9.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe) - C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2005/07/08 07:59:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/05/04 05:43:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\TEMP
[2012/05/02 14:56:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Gpqn
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\winrm
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\WindowsPowerShell
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2012/04/27 15:29:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$
[2012/04/26 02:51:18 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012/04/26 02:51:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2012/04/04 16:04:37 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2012/04/04 16:04:03 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012/04/04 16:04:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012/04/04 16:04:03 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012/04/04 16:04:03 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012/04/04 16:03:44 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2007/10/02 05:40:49 | 000,092,064 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmmdm.sys
[2007/10/02 05:40:49 | 000,079,328 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmserd.sys
[2007/10/02 05:40:49 | 000,066,656 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmbus.sys
[2007/10/02 05:40:49 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Steffi\usbsermptxp.sys
[2007/10/02 05:40:49 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Steffi\usbsermpt.sys
[2007/10/02 05:40:49 | 000,009,232 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmmdfl.sys
[2007/10/02 05:40:49 | 000,006,208 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmcmnt.sys
[2007/10/02 05:40:49 | 000,005,936 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmwhnt.sys
[2007/10/02 05:40:49 | 000,004,048 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmcr.sys
[2005/08/17 07:28:59 | 000,076,472 | ---- | C] (InstallShield Software Corporation) -- C:\Programme\setup.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Eigene Dateien\*.tmp files -> D:\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/05/04 05:43:58 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/04 05:43:36 | 000,044,964 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2012/05/04 05:43:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/02 15:05:22 | 000,162,304 | ---- | M] () -- C:\locked-UNWISE.EXE.kfqh
[2012/05/02 15:04:50 | 000,015,428 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\locked-RefEdit.exd.nsap
[2012/05/02 15:04:36 | 001,522,968 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Desktop\locked-TeamViewer_Setup_de.exe.xqzz
[2012/05/02 15:04:36 | 000,000,080 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Desktop\locked-Zeige Stadt.URL.irly
[2012/05/02 15:04:35 | 000,000,109 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\locked-default.pls.qwlv
[2012/05/02 15:02:55 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.qflp
[2012/05/02 14:57:37 | 3178,889,216 | ---- | M] () -- D:\Eigene Dateien\locked-diashow.mpg.tjrl
[2012/05/02 14:57:35 | 000,000,168 | ---- | M] () -- D:\Eigene Dateien\locked-BereinigungsScript.cmd.xjyr
[2012/05/02 14:57:12 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.vfdz
[2012/05/02 14:56:01 | 000,105,472 | -H-- | M] () -- C:\WINDOWS\System32\E7A11F41C46AAF3D36AA.exe
[2012/04/30 11:29:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/04/30 11:29:30 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012/04/30 11:28:00 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/04/30 11:26:42 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/04/27 15:32:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/27 15:29:56 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Zubehör
[2012/04/26 12:38:10 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh325
[2012/04/26 12:37:48 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh324
[2012/04/23 07:23:23 | 000,842,601 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\mdbu.bin
[2012/04/13 02:55:28 | 000,459,194 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/04/13 02:55:28 | 000,441,552 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/13 02:55:28 | 000,084,708 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/04/13 02:55:28 | 000,071,488 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/04/04 16:03:50 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012/04/04 16:03:50 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012/04/04 16:03:50 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012/04/04 16:03:50 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012/04/04 16:03:49 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Eigene Dateien\*.tmp files -> D:\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/05/02 14:56:01 | 000,105,472 | -H-- | C] () -- C:\WINDOWS\System32\E7A11F41C46AAF3D36AA.exe
[2012/04/27 15:29:04 | 000,225,262 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msimain.sdb
[2011/08/15 18:38:18 | 000,112,072 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010/10/18 09:31:53 | 000,842,601 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\mdbu.bin
[2010/03/12 10:02:02 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010/01/17 06:25:24 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2010/01/17 06:24:28 | 000,007,119 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2010/01/10 17:51:02 | 000,015,428 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\locked-RefEdit.exd.nsap
[2010/01/10 12:25:59 | 000,000,071 | ---- | C] () -- C:\WINDOWS\Ripper.ini
[2010/01/10 07:28:15 | 000,000,406 | ---- | C] () -- C:\WINDOWS\Generator.ini
[2009/12/23 09:02:52 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\MKCoInstaller.dll
[2009/11/25 09:15:43 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/10/11 03:20:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2008/10/11 03:17:08 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2008/10/11 03:12:26 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2008/08/20 21:37:54 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2008/08/20 21:37:54 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2008/08/20 21:37:54 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2008/08/05 17:14:13 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ATIBRTMON.EXE
[2008/07/17 08:23:36 | 000,174,818 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2008/06/03 17:20:33 | 000,000,047 | ---- | C] () -- C:\WINDOWS\System32\imon1.dat
[2007/10/24 04:33:10 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\SI.bin
[2007/10/02 05:40:49 | 000,009,913 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_MDM.INF
[2007/10/02 05:40:49 | 000,009,232 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_MOT_BRIT.INF
[2007/10/02 05:40:49 | 000,007,201 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USBMOT2000.INF
[2007/10/02 05:40:49 | 000,006,989 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_BUS.INF
[2007/10/02 05:40:49 | 000,006,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USBMOT2000XP.INF
[2007/10/02 05:40:49 | 000,005,960 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_MOT_A1000.INF
[2007/10/02 05:40:49 | 000,005,880 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_CMCS_2000.INF
[2007/10/02 05:40:49 | 000,004,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_SDM.INF
[2007/09/01 08:18:15 | 000,000,005 | -HS- | C] () -- C:\WINDOWS\System32\ebeacac0_s.dll
[2007/08/21 10:00:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2007/08/03 16:07:08 | 000,000,109 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\locked-default.pls.qwlv
[2007/01/28 06:23:21 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2007/01/28 06:23:21 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2006/09/28 09:55:34 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PhysXLoader.dll
[2006/09/26 09:01:40 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2006/08/25 03:10:35 | 000,000,065 | ---- | C] () -- C:\WINDOWS\gvcasinos.ini
[2006/06/04 04:18:36 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2006/05/26 11:28:49 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2006/05/26 11:28:48 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2006/05/26 11:28:48 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2006/03/20 06:05:53 | 000,000,167 | ---- | C] () -- C:\WINDOWS\game.ini
[2006/01/29 11:13:02 | 000,065,536 | ---- | C] () -- C:\WINDOWS\IFinst27.exe
[2005/10/07 16:42:33 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2005/10/07 16:42:33 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2005/10/07 16:42:33 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2005/10/07 16:30:23 | 000,000,257 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2005/08/05 08:26:04 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/07/17 03:52:18 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\hpgt21.dll
[2005/07/17 03:41:17 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3w.DLL
[2005/07/11 17:07:53 | 000,831,600 | ---- | C] () -- C:\WINDOWS\System32\Ctaa1.dat
[2005/07/11 17:07:53 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\cddvdint.dll
[2005/07/11 16:48:55 | 000,098,304 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/07/11 16:48:55 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/07/08 12:33:11 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/08 10:02:32 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005/07/08 09:38:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/07/08 09:38:45 | 000,107,132 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2005/07/08 09:37:05 | 000,005,222 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/07/08 08:41:57 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/07/08 08:39:06 | 000,176,264 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/07/08 08:26:02 | 000,155,648 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005/07/08 08:23:31 | 000,005,179 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2005/07/08 08:23:28 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/07/08 08:01:47 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/07/08 07:54:15 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 08:00:00 | 000,459,194 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/10 08:00:00 | 000,441,552 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/10 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 08:00:00 | 000,084,708 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/10 08:00:00 | 000,071,488 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/10 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[1997/06/14 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
========== LOP Check ==========
[2011/09/23 07:35:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PC Suite
[2010/11/06 03:50:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Amazon
[2006/11/13 12:11:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Ankh
[2010/02/19 07:21:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\AquaSoft
[2012/05/02 15:02:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\BearShare
[2012/05/02 15:02:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\FRITZ!
[2008/10/03 15:42:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\GMX
[2012/05/02 14:56:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Gpqn
[2006/02/10 09:44:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\ICQLite
[2010/01/10 07:27:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\IN-MEDIAKG
[2005/07/11 17:08:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\InterVideo
[2005/11/16 21:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Leadertech
[2010/01/17 06:26:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\MAGIX
[2010/09/17 08:36:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\PC Suite
[2011/11/14 04:56:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\RavensburgerTipToi
[2010/10/27 08:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Samsung
[2007/07/19 04:39:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\T-Online
[2012/05/02 15:04:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\TeamViewer
[2007/06/25 15:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Teleca
[2007/11/26 08:16:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\WEB.DE
[2007/06/25 13:42:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth
[2008/10/28 09:25:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
[2008/12/03 14:48:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010/09/17 08:29:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2010/01/17 06:25:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010/09/17 08:32:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011/11/14 04:56:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RavensburgerTipToi
[2007/07/19 04:38:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2008/10/12 03:29:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010/12/17 09:02:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2012/05/02 15:02:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{250C2EDD-210F-4A78-93B6-91C0DBFA8255}
[2012/05/02 15:02:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{6738AD63-3870-4128-AF40-6CA60DF765A7}
========== Purity Check ==========
< End of report >
habe die extra datei gefundenOTL EXTRAS Logfile: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 5/4/2012 3:00:24 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,023.00 Mb Total Physical Memory | 748.00 Mb Available Physical Memory | 73.00% Memory free
907.00 Mb Paging File | 784.00 Mb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 24.41 Gb Total Space | 11.41 Gb Free Space | 46.75% Space Free | Partition Type: NTFS
Drive D: | 124.63 Gb Total Space | 17.46 Gb Free Space | 14.01% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] --
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [CEWE FOTOSCHAU] -- "C:\Programme\OnlineFotoservice\OnlineFotoservice\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OnlineFotoservice] -- "C:\Programme\OnlineFotoservice\OnlineFotoservice\OnlineFotoservice.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"5985:TCP" = 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"80:TCP" = 80:TCP:*:Disabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend)
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\MSN Messenger\msnmsgr.exe" = C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\MSN Messenger\msnmsgr.exe" = C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0
"D:\Anwendungen\BearShare.exe" = D:\Anwendungen\BearShare.exe:*:Enabled:BearShare
"D:\Eigene Dateien\Spiele\mn_mirc\mirc.exe" = D:\Eigene Dateien\Spiele\mn_mirc\mirc.exe:*:Enabled:mIRC
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\BearShare\BearShare.exe" = C:\Programme\BearShare\BearShare.exe:*:Disabled:BearShare -- (Free Peers, Inc.)
"C:\Eigene Dateien\BearShare.exe" = C:\Eigene Dateien\BearShare.exe:*:Enabled:BearShare
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6
"C:\Dokumente und Einstellungen\Steffi\temp\TeamViewer3\TeamViewer.exe" = C:\Dokumente und Einstellungen\Steffi\temp\TeamViewer3\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ
"D:\Anwendungen\Bearshare\BearShare.exe" = D:\Anwendungen\Bearshare\BearShare.exe:*:Enabled:BearShare
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{097118DC-822D-4E24-AAF0-42D53BFE912D}" = AquaSoft DiaShow-Manager 7
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1B399A41-C1D0-40A2-9E4F-095868EFAF01}" = InterVideo WinDVD 5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4781569D-5404-1F26-4B2B-6DF444441031}" = Nero 7 Premium
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{7104189A-C592-4A56-AC9E-7C0CA135DA3C}" = AGEIA PhysX v6.10.25
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{9497EBAA-87AD-41E6-8ED6-E1E52995A76C}" = VIA Integrated Setup Wizard
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9FFC4C2D-374D-482B-AA58-67282CE23695}" = AquaSoft DiaShow 7 Premium
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{DE75EF65-0785-4E17-A56D-7D6C361A82D3}" = XP2Tune Utilities 2006
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{FA237125-51FF-408C-8BB8-30C2B3DFFF9C}" = Windows Resource Kit Tools
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"3.0M SD DSC" = 3.0M SD DSC
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"advertismen" = advertismen
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"AquaSoft DiaShow 7 Premium" = AquaSoft DiaShow 7 Premium
"AquaSoft DiaShow-Manager 7" = AquaSoft DiaShow-Manager 7
"AsusUpdate" = AsusUpdate
"ATI Display Driver" = ATI Display Driver
"BearShare" = BearShare
"CTDVDAudio Plugin" = Creative DVD Audio Plugin for Audigy Series
"Digital Image Recovery_is1" = Digital Image Recovery 1.47
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{9497EBAA-87AD-41E6-8ED6-E1E52995A76C}" = VIA Integrated Setup Wizard
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OnlineFotoservice" = OnlineFotoservice
"PeerGuardian_is1" = PeerGuardian 2.0
"Pharaoh" = Pharao
"Ravensburger tiptoi" = Ravensburger tiptoi
"Sound'Em 1.0" = Sound'Em 1.0
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
< End of report >
--- --- --- habe die extra datei gefundenOTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 5/4/2012 3:00:24 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,023.00 Mb Total Physical Memory | 748.00 Mb Available Physical Memory | 73.00% Memory free
907.00 Mb Paging File | 784.00 Mb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 24.41 Gb Total Space | 11.41 Gb Free Space | 46.75% Space Free | Partition Type: NTFS
Drive D: | 124.63 Gb Total Space | 17.46 Gb Free Space | 14.01% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] --
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [CEWE FOTOSCHAU] -- "C:\Programme\OnlineFotoservice\OnlineFotoservice\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OnlineFotoservice] -- "C:\Programme\OnlineFotoservice\OnlineFotoservice\OnlineFotoservice.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"5985:TCP" = 5985:TCP:*:Disabled:Windows-Remoteverwaltung
"80:TCP" = 80:TCP:*:Disabled:Windows-Remoteverwaltung - Kompatibilitätsmodus (HTTP eingehend)
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\MSN Messenger\msnmsgr.exe" = C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\MSN Messenger\msnmsgr.exe" = C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0
"D:\Anwendungen\BearShare.exe" = D:\Anwendungen\BearShare.exe:*:Enabled:BearShare
"D:\Eigene Dateien\Spiele\mn_mirc\mirc.exe" = D:\Eigene Dateien\Spiele\mn_mirc\mirc.exe:*:Enabled:mIRC
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\BearShare\BearShare.exe" = C:\Programme\BearShare\BearShare.exe:*:Disabled:BearShare -- (Free Peers, Inc.)
"C:\Eigene Dateien\BearShare.exe" = C:\Eigene Dateien\BearShare.exe:*:Enabled:BearShare
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6
"C:\Dokumente und Einstellungen\Steffi\temp\TeamViewer3\TeamViewer.exe" = C:\Dokumente und Einstellungen\Steffi\temp\TeamViewer3\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ
"D:\Anwendungen\Bearshare\BearShare.exe" = D:\Anwendungen\Bearshare\BearShare.exe:*:Enabled:BearShare
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{097118DC-822D-4E24-AAF0-42D53BFE912D}" = AquaSoft DiaShow-Manager 7
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1B399A41-C1D0-40A2-9E4F-095868EFAF01}" = InterVideo WinDVD 5
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4781569D-5404-1F26-4B2B-6DF444441031}" = Nero 7 Premium
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{7104189A-C592-4A56-AC9E-7C0CA135DA3C}" = AGEIA PhysX v6.10.25
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8F722FA9-B994-4C9B-B292-FD32D6206EDF}" = ASUS WLAN Card Utilities/Driver
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{9497EBAA-87AD-41E6-8ED6-E1E52995A76C}" = VIA Integrated Setup Wizard
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9FFC4C2D-374D-482B-AA58-67282CE23695}" = AquaSoft DiaShow 7 Premium
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{DE75EF65-0785-4E17-A56D-7D6C361A82D3}" = XP2Tune Utilities 2006
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{FA237125-51FF-408C-8BB8-30C2B3DFFF9C}" = Windows Resource Kit Tools
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs
"3.0M SD DSC" = 3.0M SD DSC
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"advertismen" = advertismen
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"AquaSoft DiaShow 7 Premium" = AquaSoft DiaShow 7 Premium
"AquaSoft DiaShow-Manager 7" = AquaSoft DiaShow-Manager 7
"AsusUpdate" = AsusUpdate
"ATI Display Driver" = ATI Display Driver
"BearShare" = BearShare
"CTDVDAudio Plugin" = Creative DVD Audio Plugin for Audigy Series
"Digital Image Recovery_is1" = Digital Image Recovery 1.47
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{9497EBAA-87AD-41E6-8ED6-E1E52995A76C}" = VIA Integrated Setup Wizard
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"mIRC" = mIRC
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OnlineFotoservice" = OnlineFotoservice
"PeerGuardian_is1" = PeerGuardian 2.0
"Pharaoh" = Pharao
"Ravensburger tiptoi" = Ravensburger tiptoi
"Sound'Em 1.0" = Sound'Em 1.0
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
< End of report >
|
|
04.05.2012, 13:18
| #2 |
| /// Malware-holic   | Auch ich habe mich mit dem Verschluesselungstroaner infiziert. hi
__________________auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein: Code:
ATTFilter :OTL
O4 - HKU\Steffi_ON_C..\Run: [C46AAF3D] C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe) - C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
dieses speicherst du auf nem usb stick als fix.txt nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist. • Klicke nun bitte auf den Fix Button. es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick. wenn dies nicht funktioniert, bitte den fix manuell eintragen. dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen, log posten bitte.
__________________ |
|
04.05.2012, 22:16
| #3 |
| | Auch ich habe mich mit dem Verschluesselungstroaner infiziert. NAchdem ich den Text als fix.txt eingefuegt habe kann ich nicht den runfix button druecken. was ist nun zu tun
__________________Nur zur Info: Ich habe die englische Version vom OTL. Ich habe jetzt das ganze mehrfach versucht und es passiert nach dem einfügen des fix.txt Textes rein garnichts. Allein das Kreuz zum beenden ist funktionsfähig. |
|
05.05.2012, 15:02
| #4 |
| /// Malware-holic | Auch ich habe mich mit dem Verschluesselungstroaner infiziert. fix per hand eintragen, dann gehts
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
05.05.2012, 16:55
| #5 |
| | Auch ich habe mich mit dem Verschluesselungstroaner infiziert. Danke, das system läuft wieder. ich kann nur leider die txt datei nicht finden. zeigt er die immer an? |
|
06.05.2012, 19:18
| #6 |
| | Auch ich habe mich mit dem Verschluesselungstroaner infiziert. OTL Logfile: Code:
ATTFilter OTL logfile created on: 5/5/2012 7:24:42 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,023.00 Mb Total Physical Memory | 791.00 Mb Available Physical Memory | 77.00% Memory free
907.00 Mb Paging File | 832.00 Mb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 24.41 Gb Total Space | 11.42 Gb Free Space | 46.77% Space Free | Partition Type: NTFS
Drive D: | 124.63 Gb Total Space | 17.46 Gb Free Space | 14.01% Space Free | Partition Type: NTFS
Drive E: | 1.80 Gb Total Space | 1.79 Gb Free Space | 99.44% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand] -- -- (de_serv)
SRV - File not found [Auto] -- -- (AviraUpgradeService)
SRV - [2012/04/26 02:51:14 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2008/11/11 03:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2001/02/23 04:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (VcommMgr)
DRV - File not found [Kernel | On_Demand] -- -- (VComm)
DRV - File not found [Kernel | On_Demand] -- -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (InCDRm)
DRV - File not found [Kernel | System] -- -- (InCDPass)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - File not found [Kernel | Boot] -- -- (BTHidMgr)
DRV - File not found [Kernel | On_Demand] -- -- (BTHidEnum)
DRV - File not found [Kernel | On_Demand] -- -- (Btcsrusb)
DRV - File not found [Kernel | On_Demand] -- -- (BT)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletSCOAudio)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletAudio)
DRV - [2010/01/17 11:54:32 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008/08/26 03:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/08/21 00:52:41 | 003,299,840 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/07/29 21:53:52 | 000,017,920 | ---- | M] (SAMSUNG Electronics Co.,Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SSUSBDownload.sys -- (SSUSBDownload)
DRV - [2008/05/02 04:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007/12/06 04:51:00 | 000,285,952 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2007/05/02 10:32:34 | 000,135,680 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsa.sys -- (nmwcdsa)
DRV - [2007/05/02 10:31:54 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsacm.sys -- (nmwcdsacm)
DRV - [2007/05/02 10:31:54 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsacj.sys -- (nmwcdsacj)
DRV - [2007/05/02 10:31:54 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsac.sys -- (nmwcdsac)
DRV - [2007/04/16 16:46:00 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2007/01/28 06:23:22 | 000,271,360 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2007/01/28 06:23:21 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2006/09/18 09:59:08 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27unic.sys -- (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)
DRV - [2006/09/18 09:59:02 | 000,086,560 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27obex.sys -- (SE27obex)
DRV - [2006/09/18 09:59:00 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27nd5.sys -- (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)
DRV - [2006/09/18 09:58:58 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006/09/18 09:58:54 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006/09/18 09:58:52 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006/09/18 09:58:48 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2006/01/29 11:20:11 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto] -- C:\WINDOWS\system32\SVKP.sys -- (SVKP)
DRV - [2005/09/18 12:02:52 | 000,005,632 | ---- | M] () [Kernel | On_Demand] -- D:\Anwendungen\Peerguardian\PeerGuardian2\pgfilter.sys -- (pgfilter)
DRV - [2005/02/21 19:00:00 | 000,015,104 | R--- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\avmunet.sys -- (AVMUNET)
DRV - [2004/08/03 16:41:46 | 000,095,424 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)
DRV - [2004/08/03 16:41:46 | 000,013,240 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)
DRV - [2004/08/03 16:41:42 | 000,129,535 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slnt7554.sys -- (Slnt7554)
DRV - [2004/08/03 16:41:40 | 000,180,360 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax)
DRV - [2004/08/03 16:41:40 | 000,126,686 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2004/08/03 16:41:40 | 000,013,776 | ---- | M] (Smart Link) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\RecAgent.sys -- (RecAgent)
DRV - [2004/08/03 16:41:38 | 001,309,184 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)
DRV - [2004/04/15 07:52:32 | 000,204,032 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RT2500.sys -- (RT2500)
DRV - [2004/03/19 08:02:08 | 000,613,244 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/02/23 23:08:52 | 000,400,384 | R--- | M] (Sensaura) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2003/10/30 23:22:38 | 000,077,312 | R--- | M] (VIA Technologies inc,.ltd) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\viasraid.sys -- (viasraid)
DRV - [2003/08/05 22:43:04 | 000,159,744 | R--- | M] (Promise Technology, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Fasttx2k.sys -- (fasttx2k)
DRV - [2003/07/01 22:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2002/09/09 13:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,Prev Search Page = Google
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\Steffi_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Steffi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/04/26 02:51:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/04/05 16:32:46 | 000,000,000 | ---D | M]
[2012/04/26 02:51:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/03/20 12:25:05 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/04/26 02:51:14 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012/04/04 16:03:50 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012/03/20 12:24:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/03/20 12:24:39 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012/03/20 12:24:39 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012/03/20 12:24:39 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/03/20 12:24:39 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/03/20 12:24:39 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/10/25 15:05:07 | 000,000,928 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TempLeer] C:\WINDOWS\System32\Cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [YarcGUI] File not found
O4 - HKU\Steffi_ON_C..\Run: [C46AAF3D] C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Steffi\Startmenü\Programme\Autostart\dnetc.lnk = D:\Anwendungen\dnet\dnetc.exe (Distributed Computing Technologies, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Steffi\Startmenü\Programme\Autostart\PeerGuardian.lnk = D:\Anwendungen\Peerguardian\PeerGuardian2\pg2.exe (Methlabs)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 6
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoExpandedNewMenu = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = [binary data]
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261563041203 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (pushow9.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe) - C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2005/07/08 07:59:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/05/18 14:33:58 | 000,000,042 | ---- | M] () - E:\autorun.inf -- [ FAT ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/05/04 05:43:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\TEMP
[2012/05/02 14:56:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Gpqn
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\winrm
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\WindowsPowerShell
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2012/04/27 15:29:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$
[2012/04/26 02:51:18 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012/04/26 02:51:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2007/10/02 05:40:49 | 000,092,064 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmmdm.sys
[2007/10/02 05:40:49 | 000,079,328 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmserd.sys
[2007/10/02 05:40:49 | 000,066,656 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmbus.sys
[2007/10/02 05:40:49 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Steffi\usbsermptxp.sys
[2007/10/02 05:40:49 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Steffi\usbsermpt.sys
[2007/10/02 05:40:49 | 000,009,232 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmmdfl.sys
[2007/10/02 05:40:49 | 000,006,208 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmcmnt.sys
[2007/10/02 05:40:49 | 000,005,936 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmwhnt.sys
[2007/10/02 05:40:49 | 000,004,048 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmcr.sys
[2005/08/17 07:28:59 | 000,076,472 | ---- | C] (InstallShield Software Corporation) -- C:\Programme\setup.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Eigene Dateien\*.tmp files -> D:\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/05/05 19:24:20 | 000,786,432 | -H-- | M] () -- C:\Dokumente und Einstellungen\Administrator\NTUSER.DAT
[2012/05/04 05:43:58 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/04 05:43:38 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2012/05/04 05:43:36 | 000,044,964 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2012/05/04 05:43:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/02 15:05:22 | 000,162,304 | ---- | M] () -- C:\locked-UNWISE.EXE.kfqh
[2012/05/02 15:04:50 | 000,015,428 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\locked-RefEdit.exd.nsap
[2012/05/02 15:04:36 | 001,522,968 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Desktop\locked-TeamViewer_Setup_de.exe.xqzz
[2012/05/02 15:04:36 | 000,000,080 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Desktop\locked-Zeige Stadt.URL.irly
[2012/05/02 15:04:35 | 000,000,109 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\locked-default.pls.qwlv
[2012/05/02 15:02:55 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.qflp
[2012/05/02 14:57:37 | 3178,889,216 | ---- | M] () -- D:\Eigene Dateien\locked-diashow.mpg.tjrl
[2012/05/02 14:57:35 | 000,000,168 | ---- | M] () -- D:\Eigene Dateien\locked-BereinigungsScript.cmd.xjyr
[2012/05/02 14:57:12 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.vfdz
[2012/05/02 14:56:01 | 000,105,472 | -H-- | M] () -- C:\WINDOWS\System32\E7A11F41C46AAF3D36AA.exe
[2012/05/01 16:14:47 | 000,262,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT
[2012/05/01 16:14:47 | 000,262,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT
[2012/05/01 16:14:32 | 006,291,456 | -H-- | M] () -- C:\Dokumente und Einstellungen\Steffi\NTUSER.DAT
[2012/05/01 16:14:32 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Steffi\ntuser.ini
[2012/04/30 11:29:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/04/30 11:29:30 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012/04/30 11:28:00 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/04/30 11:26:42 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/04/27 15:32:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/27 15:29:56 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Zubehör
[2012/04/26 12:38:10 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh325
[2012/04/26 12:37:48 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh324
[2012/04/23 07:23:23 | 000,842,601 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\mdbu.bin
[2012/04/13 02:55:28 | 001,025,154 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2012/04/13 02:55:28 | 000,459,194 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/04/13 02:55:28 | 000,441,552 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/13 02:55:28 | 000,084,708 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/04/13 02:55:28 | 000,071,488 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Eigene Dateien\*.tmp files -> D:\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/05/02 14:56:01 | 000,105,472 | -H-- | C] () -- C:\WINDOWS\System32\E7A11F41C46AAF3D36AA.exe
[2012/04/27 15:29:04 | 000,225,262 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msimain.sdb
[2011/08/15 18:38:18 | 000,112,072 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010/10/18 09:31:53 | 000,842,601 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\mdbu.bin
[2010/03/12 10:02:02 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010/01/17 06:25:24 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2010/01/17 06:24:28 | 000,007,119 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2010/01/10 17:51:02 | 000,015,428 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\locked-RefEdit.exd.nsap
[2010/01/10 12:25:59 | 000,000,071 | ---- | C] () -- C:\WINDOWS\Ripper.ini
[2010/01/10 07:28:15 | 000,000,406 | ---- | C] () -- C:\WINDOWS\Generator.ini
[2009/12/23 09:02:52 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\MKCoInstaller.dll
[2009/11/25 09:15:43 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/10/11 03:20:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2008/10/11 03:17:08 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2008/10/11 03:12:26 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2008/08/20 21:37:54 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2008/08/20 21:37:54 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2008/08/20 21:37:54 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2008/08/05 17:14:13 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ATIBRTMON.EXE
[2008/07/17 08:23:36 | 000,174,818 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2008/06/03 17:20:33 | 000,000,047 | ---- | C] () -- C:\WINDOWS\System32\imon1.dat
[2007/10/24 04:33:10 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\SI.bin
[2007/10/02 05:40:49 | 000,009,913 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_MDM.INF
[2007/10/02 05:40:49 | 000,009,232 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_MOT_BRIT.INF
[2007/10/02 05:40:49 | 000,007,201 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USBMOT2000.INF
[2007/10/02 05:40:49 | 000,006,989 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_BUS.INF
[2007/10/02 05:40:49 | 000,006,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USBMOT2000XP.INF
[2007/10/02 05:40:49 | 000,005,960 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_MOT_A1000.INF
[2007/10/02 05:40:49 | 000,005,880 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_CMCS_2000.INF
[2007/10/02 05:40:49 | 000,004,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_SDM.INF
[2007/09/01 08:18:15 | 000,000,005 | -HS- | C] () -- C:\WINDOWS\System32\ebeacac0_s.dll
[2007/08/21 10:00:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2007/08/03 16:07:08 | 000,000,109 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\locked-default.pls.qwlv
[2007/07/03 12:48:37 | 004,303,980 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2007/07/03 12:41:23 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.ini
[2007/07/03 12:41:20 | 000,786,432 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\NTUSER.DAT
[2007/01/28 06:23:21 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2007/01/28 06:23:21 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2006/09/28 09:55:34 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PhysXLoader.dll
[2006/09/26 09:01:40 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2006/08/25 03:10:35 | 000,000,065 | ---- | C] () -- C:\WINDOWS\gvcasinos.ini
[2006/06/29 09:58:52 | 000,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 09:53:56 | 000,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/06/04 04:18:36 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2006/05/26 11:28:49 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2006/05/26 11:28:48 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2006/05/26 11:28:48 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2006/04/18 10:39:28 | 000,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 10:39:28 | 000,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/03/20 06:05:53 | 000,000,167 | ---- | C] () -- C:\WINDOWS\game.ini
[2006/01/29 11:13:02 | 000,065,536 | ---- | C] () -- C:\WINDOWS\IFinst27.exe
[2005/10/07 16:42:33 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2005/10/07 16:42:33 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2005/10/07 16:42:33 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2005/10/07 16:30:23 | 000,000,257 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2005/08/05 08:26:04 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/08/02 05:38:10 | 000,043,360 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2005/07/17 03:52:18 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\hpgt21.dll
[2005/07/17 03:41:17 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3w.DLL
[2005/07/11 17:07:53 | 000,831,600 | ---- | C] () -- C:\WINDOWS\System32\Ctaa1.dat
[2005/07/11 17:07:53 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\cddvdint.dll
[2005/07/11 16:48:55 | 000,098,304 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/07/11 16:48:55 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/07/08 12:33:11 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/08 10:02:32 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005/07/08 10:01:12 | 000,262,144 | ---- | C] () -- C:\WINDOWS\system32\config\systemprofile\ntuser.dat
[2005/07/08 09:38:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/07/08 09:38:45 | 000,107,132 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2005/07/08 09:37:05 | 000,005,222 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/07/08 08:41:58 | 001,025,154 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2005/07/08 08:41:57 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/07/08 08:39:06 | 000,176,264 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/07/08 08:26:02 | 000,155,648 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005/07/08 08:23:31 | 000,005,179 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2005/07/08 08:23:28 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/07/08 08:11:24 | 004,841,546 | -H-- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2005/07/08 08:06:53 | 000,043,360 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2005/07/08 08:04:27 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\Steffi\ntuser.ini
[2005/07/08 08:04:26 | 006,291,456 | -H-- | C] () -- C:\Dokumente und Einstellungen\Steffi\NTUSER.DAT
[2005/07/08 08:02:41 | 000,262,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT
[2005/07/08 08:02:41 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\LocalService\ntuser.ini
[2005/07/08 08:02:35 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\NetworkService\ntuser.ini
[2005/07/08 08:02:34 | 000,262,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT
[2005/07/08 08:01:47 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/07/08 07:59:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[2005/07/08 07:57:49 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2005/07/08 07:57:44 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2005/07/08 07:54:15 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/07/08 07:54:05 | 000,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[2005/07/08 07:54:05 | 000,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[2005/07/08 07:50:03 | 000,027,055 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[2005/07/08 07:50:01 | 000,003,999 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[2004/08/10 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 08:00:00 | 001,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini
[2004/08/10 08:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll
[2004/08/10 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 08:00:00 | 000,459,194 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/10 08:00:00 | 000,456,192 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll
[2004/08/10 08:00:00 | 000,441,552 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 08:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll
[2004/08/10 08:00:00 | 000,291,840 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll
[2004/08/10 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/10 08:00:00 | 000,253,440 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll
[2004/08/10 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 08:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll
[2004/08/10 08:00:00 | 000,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll
[2004/08/10 08:00:00 | 000,084,708 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/10 08:00:00 | 000,071,488 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 08:00:00 | 000,071,022 | ---- | C] () -- C:\WINDOWS\System32\edit.com
[2004/08/10 08:00:00 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll
[2004/08/10 08:00:00 | 000,054,128 | ---- | C] () -- C:\WINDOWS\System32\dosx.exe
[2004/08/10 08:00:00 | 000,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini
[2004/08/10 08:00:00 | 000,052,777 | ---- | C] () -- C:\WINDOWS\System32\command.com
[2004/08/10 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 08:00:00 | 000,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys
[2004/08/10 08:00:00 | 000,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys
[2004/08/10 08:00:00 | 000,039,546 | ---- | C] () -- C:\WINDOWS\System32\mem.exe
[2004/08/10 08:00:00 | 000,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys
[2004/08/10 08:00:00 | 000,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys
[2004/08/10 08:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys
[2004/08/10 08:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys
[2004/08/10 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/10 08:00:00 | 000,034,032 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys
[2004/08/10 08:00:00 | 000,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys
[2004/08/10 08:00:00 | 000,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys
[2004/08/10 08:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys
[2004/08/10 08:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys
[2004/08/10 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 08:00:00 | 000,027,914 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys
[2004/08/10 08:00:00 | 000,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys
[2004/08/10 08:00:00 | 000,021,542 | ---- | C] () -- C:\WINDOWS\System32\mqperf.ini
[2004/08/10 08:00:00 | 000,021,210 | ---- | C] () -- C:\WINDOWS\System32\debug.exe
[2004/08/10 08:00:00 | 000,019,726 | ---- | C] () -- C:\WINDOWS\System32\graphics.com
[2004/08/10 08:00:00 | 000,017,241 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini
[2004/08/10 08:00:00 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll
[2004/08/10 08:00:00 | 000,014,816 | ---- | C] () -- C:\WINDOWS\System32\kb16.com
[2004/08/10 08:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll
[2004/08/10 08:00:00 | 000,014,060 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini
[2004/08/10 08:00:00 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll
[2004/08/10 08:00:00 | 000,013,026 | ---- | C] () -- C:\WINDOWS\System32\edlin.exe
[2004/08/10 08:00:00 | 000,012,610 | ---- | C] () -- C:\WINDOWS\System32\append.exe
[2004/08/10 08:00:00 | 000,011,903 | ---- | C] () -- C:\WINDOWS\System32\setver.exe
[2004/08/10 08:00:00 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\scriptpw.dll
[2004/08/10 08:00:00 | 000,009,032 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys
[2004/08/10 08:00:00 | 000,008,584 | ---- | C] () -- C:\WINDOWS\System32\exe2bin.exe
[2004/08/10 08:00:00 | 000,007,084 | ---- | C] () -- C:\WINDOWS\System32\nlsfunc.exe
[2004/08/10 08:00:00 | 000,006,287 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini
[2004/08/10 08:00:00 | 000,004,992 | ---- | C] () -- C:\WINDOWS\System32\himem.sys
[2004/08/10 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 08:00:00 | 000,004,438 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini
[2004/08/10 08:00:00 | 000,004,233 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini
[2004/08/10 08:00:00 | 000,003,358 | ---- | C] () -- C:\WINDOWS\System32\redir.exe
[2004/08/10 08:00:00 | 000,003,262 | ---- | C] () -- C:\WINDOWS\System32\nw16.exe
[2004/08/10 08:00:00 | 000,002,656 | ---- | C] () -- C:\WINDOWS\System32\netware.drv
[2004/08/10 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 08:00:00 | 000,001,783 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini
[2004/08/10 08:00:00 | 000,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini
[2004/08/10 08:00:00 | 000,001,273 | ---- | C] () -- C:\WINDOWS\System32\loadfix.com
[2004/08/10 08:00:00 | 000,001,157 | ---- | C] () -- C:\WINDOWS\System32\vwipxspx.exe
[2004/08/10 08:00:00 | 000,000,977 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/10 08:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\share.exe
[2004/08/10 08:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\fastopen.exe
[2004/08/10 08:00:00 | 000,000,817 | ---- | C] () -- C:\WINDOWS\System32\mscdexnt.exe
[2004/08/10 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 08:00:00 | 000,000,369 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini
[2004/08/10 08:00:00 | 000,000,356 | ---- | C] () -- C:\WINDOWS\system.ini
[2001/08/18 00:54:50 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\dvdplay.exe
[2001/08/18 00:54:08 | 000,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll
[1997/06/14 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
========== LOP Check ==========
[2011/09/23 07:35:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PC Suite
[2010/11/06 03:50:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Amazon
[2006/11/13 12:11:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Ankh
[2010/02/19 07:21:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\AquaSoft
[2012/05/02 15:02:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\BearShare
[2012/05/02 15:02:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\FRITZ!
[2008/10/03 15:42:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\GMX
[2012/05/02 14:56:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Gpqn
[2006/02/10 09:44:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\ICQLite
[2010/01/10 07:27:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\IN-MEDIAKG
[2005/07/11 17:08:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\InterVideo
[2005/11/16 21:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Leadertech
[2010/01/17 06:26:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\MAGIX
[2010/09/17 08:36:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\PC Suite
[2011/11/14 04:56:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\RavensburgerTipToi
[2010/10/27 08:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Samsung
[2007/07/19 04:39:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\T-Online
[2012/05/02 15:04:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\TeamViewer
[2007/06/25 15:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Teleca
[2007/11/26 08:16:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\WEB.DE
[2007/06/25 13:42:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth
[2008/10/28 09:25:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
[2008/12/03 14:48:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010/09/17 08:29:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2010/01/17 06:25:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010/09/17 08:32:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011/11/14 04:56:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RavensburgerTipToi
[2007/07/19 04:38:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2008/10/12 03:29:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010/12/17 09:02:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2012/05/02 15:02:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{250C2EDD-210F-4A78-93B6-91C0DBFA8255}
[2012/05/02 15:02:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{6738AD63-3870-4128-AF40-6CA60DF765A7}
========== Purity Check ==========
< End of report >
OTL Logfile: Code:
ATTFilter OTL logfile created on: 5/5/2012 7:24:42 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,023.00 Mb Total Physical Memory | 791.00 Mb Available Physical Memory | 77.00% Memory free
907.00 Mb Paging File | 832.00 Mb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 24.41 Gb Total Space | 11.42 Gb Free Space | 46.77% Space Free | Partition Type: NTFS
Drive D: | 124.63 Gb Total Space | 17.46 Gb Free Space | 14.01% Space Free | Partition Type: NTFS
Drive E: | 1.80 Gb Total Space | 1.79 Gb Free Space | 99.44% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV - File not found [On_Demand] -- -- (de_serv)
SRV - File not found [Auto] -- -- (AviraUpgradeService)
SRV - [2012/04/26 02:51:14 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2008/11/11 03:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2001/02/23 04:07:30 | 000,270,336 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe -- (MDM)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (VcommMgr)
DRV - File not found [Kernel | On_Demand] -- -- (VComm)
DRV - File not found [Kernel | On_Demand] -- -- (SNPSTD3) USB PC Camera (SNPSTD3)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (InCDRm)
DRV - File not found [Kernel | System] -- -- (InCDPass)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - File not found [Kernel | Boot] -- -- (BTHidMgr)
DRV - File not found [Kernel | On_Demand] -- -- (BTHidEnum)
DRV - File not found [Kernel | On_Demand] -- -- (Btcsrusb)
DRV - File not found [Kernel | On_Demand] -- -- (BT)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletSCOAudio)
DRV - File not found [Kernel | On_Demand] -- -- (BlueletAudio)
DRV - [2010/01/17 11:54:32 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2008/08/26 03:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/08/21 00:52:41 | 003,299,840 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/07/29 21:53:52 | 000,017,920 | ---- | M] (SAMSUNG Electronics Co.,Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SSUSBDownload.sys -- (SSUSBDownload)
DRV - [2008/05/02 04:58:12 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007/12/06 04:51:00 | 000,285,952 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2007/05/02 10:32:34 | 000,135,680 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsa.sys -- (nmwcdsa)
DRV - [2007/05/02 10:31:54 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsacm.sys -- (nmwcdsacm)
DRV - [2007/05/02 10:31:54 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsacj.sys -- (nmwcdsacj)
DRV - [2007/05/02 10:31:54 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdsac.sys -- (nmwcdsac)
DRV - [2007/04/16 16:46:00 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2007/01/28 06:23:22 | 000,271,360 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2007/01/28 06:23:21 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2006/09/18 09:59:08 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27unic.sys -- (se27unic) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)
DRV - [2006/09/18 09:59:02 | 000,086,560 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27obex.sys -- (SE27obex)
DRV - [2006/09/18 09:59:00 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\se27nd5.sys -- (se27nd5) Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)
DRV - [2006/09/18 09:58:58 | 000,088,688 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mgmt.sys -- (SE27mgmt) Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)
DRV - [2006/09/18 09:58:54 | 000,097,184 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdm.sys -- (SE27mdm)
DRV - [2006/09/18 09:58:52 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27mdfl.sys -- (SE27mdfl)
DRV - [2006/09/18 09:58:48 | 000,061,600 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SE27bus.sys -- (SE27bus) Sony Ericsson Device 039 Driver driver (WDM)
DRV - [2006/01/29 11:20:11 | 000,002,368 | ---- | M] (AntiCracking) [Kernel | Auto] -- C:\WINDOWS\system32\SVKP.sys -- (SVKP)
DRV - [2005/09/18 12:02:52 | 000,005,632 | ---- | M] () [Kernel | On_Demand] -- D:\Anwendungen\Peerguardian\PeerGuardian2\pgfilter.sys -- (pgfilter)
DRV - [2005/02/21 19:00:00 | 000,015,104 | R--- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\avmunet.sys -- (AVMUNET)
DRV - [2004/08/03 16:41:46 | 000,095,424 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)
DRV - [2004/08/03 16:41:46 | 000,013,240 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)
DRV - [2004/08/03 16:41:42 | 000,129,535 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slnt7554.sys -- (Slnt7554)
DRV - [2004/08/03 16:41:40 | 000,180,360 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax)
DRV - [2004/08/03 16:41:40 | 000,126,686 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)
DRV - [2004/08/03 16:41:40 | 000,013,776 | ---- | M] (Smart Link) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\RecAgent.sys -- (RecAgent)
DRV - [2004/08/03 16:41:38 | 001,309,184 | ---- | M] (Smart Link) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)
DRV - [2004/04/15 07:52:32 | 000,204,032 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RT2500.sys -- (RT2500)
DRV - [2004/03/19 08:02:08 | 000,613,244 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/02/23 23:08:52 | 000,400,384 | R--- | M] (Sensaura) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2003/10/30 23:22:38 | 000,077,312 | R--- | M] (VIA Technologies inc,.ltd) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\viasraid.sys -- (viasraid)
DRV - [2003/08/05 22:43:04 | 000,159,744 | R--- | M] (Promise Technology, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Fasttx2k.sys -- (fasttx2k)
DRV - [2003/07/01 22:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1)
DRV - [2002/09/09 13:54:06 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\ASNDIS5.sys -- (ASNDIS5)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,Prev Search Page = Google
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Steffi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\Steffi_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Steffi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/04/26 02:51:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/04/05 16:32:46 | 000,000,000 | ---D | M]
[2012/04/26 02:51:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012/03/20 12:25:05 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/04/26 02:51:14 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012/04/04 16:03:50 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012/03/20 12:24:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/03/20 12:24:39 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012/03/20 12:24:39 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012/03/20 12:24:39 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/03/20 12:24:39 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/03/20 12:24:39 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/10/25 15:05:07 | 000,000,928 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (XTTBPos00 Class) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - File not found
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TempLeer] C:\WINDOWS\System32\Cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [YarcGUI] File not found
O4 - HKU\Steffi_ON_C..\Run: [C46AAF3D] C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\Steffi\Startmenü\Programme\Autostart\dnetc.lnk = D:\Anwendungen\dnet\dnetc.exe (Distributed Computing Technologies, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Steffi\Startmenü\Programme\Autostart\PeerGuardian.lnk = D:\Anwendungen\Peerguardian\PeerGuardian2\pg2.exe (Methlabs)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MaxRecentDocs = 6
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoExpandedNewMenu = 0
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = [binary data]
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Steffi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - File not found
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - Reg Error: Value error. File not found
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261563041203 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (pushow9.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe) - C:\WINDOWS\system32\E7A11F41C46AAF3D36AA.exe ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2005/07/08 07:59:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/05/18 14:33:58 | 000,000,042 | ---- | M] () - E:\autorun.inf -- [ FAT ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/05/04 05:43:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\TEMP
[2012/05/02 14:56:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Gpqn
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\winrm
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\WindowsPowerShell
[2012/04/27 15:29:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
[2012/04/27 15:29:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$
[2012/04/26 02:51:18 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012/04/26 02:51:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla
[2007/10/02 05:40:49 | 000,092,064 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmmdm.sys
[2007/10/02 05:40:49 | 000,079,328 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmserd.sys
[2007/10/02 05:40:49 | 000,066,656 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmbus.sys
[2007/10/02 05:40:49 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Steffi\usbsermptxp.sys
[2007/10/02 05:40:49 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Steffi\usbsermpt.sys
[2007/10/02 05:40:49 | 000,009,232 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmmdfl.sys
[2007/10/02 05:40:49 | 000,006,208 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmcmnt.sys
[2007/10/02 05:40:49 | 000,005,936 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmwhnt.sys
[2007/10/02 05:40:49 | 000,004,048 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\Steffi\mqdmcr.sys
[2005/08/17 07:28:59 | 000,076,472 | ---- | C] (InstallShield Software Corporation) -- C:\Programme\setup.exe
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Eigene Dateien\*.tmp files -> D:\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012/05/05 19:24:20 | 000,786,432 | -H-- | M] () -- C:\Dokumente und Einstellungen\Administrator\NTUSER.DAT
[2012/05/04 05:43:58 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/04 05:43:38 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2012/05/04 05:43:36 | 000,044,964 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2012/05/04 05:43:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/02 15:05:22 | 000,162,304 | ---- | M] () -- C:\locked-UNWISE.EXE.kfqh
[2012/05/02 15:04:50 | 000,015,428 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\locked-RefEdit.exd.nsap
[2012/05/02 15:04:36 | 001,522,968 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Desktop\locked-TeamViewer_Setup_de.exe.xqzz
[2012/05/02 15:04:36 | 000,000,080 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Desktop\locked-Zeige Stadt.URL.irly
[2012/05/02 15:04:35 | 000,000,109 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\locked-default.pls.qwlv
[2012/05/02 15:02:55 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.qflp
[2012/05/02 14:57:37 | 3178,889,216 | ---- | M] () -- D:\Eigene Dateien\locked-diashow.mpg.tjrl
[2012/05/02 14:57:35 | 000,000,168 | ---- | M] () -- D:\Eigene Dateien\locked-BereinigungsScript.cmd.xjyr
[2012/05/02 14:57:12 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.vfdz
[2012/05/02 14:56:01 | 000,105,472 | -H-- | M] () -- C:\WINDOWS\System32\E7A11F41C46AAF3D36AA.exe
[2012/05/01 16:14:47 | 000,262,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT
[2012/05/01 16:14:47 | 000,262,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT
[2012/05/01 16:14:32 | 006,291,456 | -H-- | M] () -- C:\Dokumente und Einstellungen\Steffi\NTUSER.DAT
[2012/05/01 16:14:32 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Steffi\ntuser.ini
[2012/04/30 11:29:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/04/30 11:29:30 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012/04/30 11:28:00 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/04/30 11:26:42 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/04/27 15:32:03 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/04/27 15:29:56 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Zubehör
[2012/04/26 12:38:10 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh325
[2012/04/26 12:37:48 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh324
[2012/04/23 07:23:23 | 000,842,601 | ---- | M] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\mdbu.bin
[2012/04/13 02:55:28 | 001,025,154 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2012/04/13 02:55:28 | 000,459,194 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/04/13 02:55:28 | 000,441,552 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/13 02:55:28 | 000,084,708 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/04/13 02:55:28 | 000,071,488 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Eigene Dateien\*.tmp files -> D:\Eigene Dateien\*.tmp -> ]
[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/05/02 14:57:01 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/05/02 14:56:01 | 000,105,472 | -H-- | C] () -- C:\WINDOWS\System32\E7A11F41C46AAF3D36AA.exe
[2012/04/27 15:29:04 | 000,225,262 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msimain.sdb
[2011/08/15 18:38:18 | 000,112,072 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010/10/18 09:31:53 | 000,842,601 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\mdbu.bin
[2010/03/12 10:02:02 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2010/01/17 06:25:24 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2010/01/17 06:24:28 | 000,007,119 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2010/01/10 17:51:02 | 000,015,428 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\locked-RefEdit.exd.nsap
[2010/01/10 12:25:59 | 000,000,071 | ---- | C] () -- C:\WINDOWS\Ripper.ini
[2010/01/10 07:28:15 | 000,000,406 | ---- | C] () -- C:\WINDOWS\Generator.ini
[2009/12/23 09:02:52 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\MKCoInstaller.dll
[2009/11/25 09:15:43 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/10/11 03:20:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2008/10/11 03:17:08 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe
[2008/10/11 03:12:26 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2008/08/20 21:37:54 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat
[2008/08/20 21:37:54 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2008/08/20 21:37:54 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2008/08/05 17:14:13 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ATIBRTMON.EXE
[2008/07/17 08:23:36 | 000,174,818 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2008/06/03 17:20:33 | 000,000,047 | ---- | C] () -- C:\WINDOWS\System32\imon1.dat
[2007/10/24 04:33:10 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\SI.bin
[2007/10/02 05:40:49 | 000,009,913 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_MDM.INF
[2007/10/02 05:40:49 | 000,009,232 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_MOT_BRIT.INF
[2007/10/02 05:40:49 | 000,007,201 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USBMOT2000.INF
[2007/10/02 05:40:49 | 000,006,989 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_BUS.INF
[2007/10/02 05:40:49 | 000,006,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USBMOT2000XP.INF
[2007/10/02 05:40:49 | 000,005,960 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_MOT_A1000.INF
[2007/10/02 05:40:49 | 000,005,880 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\USB_CMCS_2000.INF
[2007/10/02 05:40:49 | 000,004,477 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\MCCI_SDM.INF
[2007/09/01 08:18:15 | 000,000,005 | -HS- | C] () -- C:\WINDOWS\System32\ebeacac0_s.dll
[2007/08/21 10:00:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mngui.INI
[2007/08/03 16:07:08 | 000,000,109 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\locked-default.pls.qwlv
[2007/07/03 12:48:37 | 004,303,980 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2007/07/03 12:41:23 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.ini
[2007/07/03 12:41:20 | 000,786,432 | -H-- | C] () -- C:\Dokumente und Einstellungen\Administrator\NTUSER.DAT
[2007/01/28 06:23:21 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2007/01/28 06:23:21 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2006/09/28 09:55:34 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\PhysXLoader.dll
[2006/09/26 09:01:40 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2006/09/08 04:01:50 | 000,045,056 | R--- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2006/08/25 03:10:35 | 000,000,065 | ---- | C] () -- C:\WINDOWS\gvcasinos.ini
[2006/06/29 09:58:52 | 000,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/06/29 09:53:56 | 000,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/06/04 04:18:36 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2006/05/26 11:28:49 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2006/05/26 11:28:48 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2006/05/26 11:28:48 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2006/04/18 10:39:28 | 000,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/04/18 10:39:28 | 000,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/03/20 06:05:53 | 000,000,167 | ---- | C] () -- C:\WINDOWS\game.ini
[2006/01/29 11:13:02 | 000,065,536 | ---- | C] () -- C:\WINDOWS\IFinst27.exe
[2005/10/07 16:42:33 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2005/10/07 16:42:33 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2005/10/07 16:42:33 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2005/10/07 16:30:23 | 000,000,257 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2005/08/05 08:26:04 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/08/02 05:38:10 | 000,043,360 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2005/07/17 03:52:18 | 000,083,968 | ---- | C] () -- C:\WINDOWS\System32\hpgt21.dll
[2005/07/17 03:41:17 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS3w.DLL
[2005/07/11 17:07:53 | 000,831,600 | ---- | C] () -- C:\WINDOWS\System32\Ctaa1.dat
[2005/07/11 17:07:53 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\cddvdint.dll
[2005/07/11 16:48:55 | 000,098,304 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/07/11 16:48:55 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2005/07/08 12:33:11 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/07/08 10:02:32 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005/07/08 10:01:12 | 000,262,144 | ---- | C] () -- C:\WINDOWS\system32\config\systemprofile\ntuser.dat
[2005/07/08 09:38:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/07/08 09:38:45 | 000,107,132 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2005/07/08 09:37:05 | 000,005,222 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/07/08 08:41:58 | 001,025,154 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2005/07/08 08:41:57 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2005/07/08 08:39:06 | 000,176,264 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2005/07/08 08:26:02 | 000,155,648 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2005/07/08 08:23:31 | 000,005,179 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2005/07/08 08:23:28 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/07/08 08:11:24 | 004,841,546 | -H-- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2005/07/08 08:06:53 | 000,043,360 | ---- | C] () -- C:\Dokumente und Einstellungen\Steffi\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2005/07/08 08:04:27 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\Steffi\ntuser.ini
[2005/07/08 08:04:26 | 006,291,456 | -H-- | C] () -- C:\Dokumente und Einstellungen\Steffi\NTUSER.DAT
[2005/07/08 08:02:41 | 000,262,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT
[2005/07/08 08:02:41 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\LocalService\ntuser.ini
[2005/07/08 08:02:35 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\NetworkService\ntuser.ini
[2005/07/08 08:02:34 | 000,262,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT
[2005/07/08 08:01:47 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2005/07/08 07:59:08 | 000,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[2005/07/08 07:57:49 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2005/07/08 07:57:44 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2005/07/08 07:54:15 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2005/07/08 07:54:05 | 000,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[2005/07/08 07:54:05 | 000,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[2005/07/08 07:50:03 | 000,027,055 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[2005/07/08 07:50:01 | 000,003,999 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[2004/08/10 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 08:00:00 | 001,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini
[2004/08/10 08:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll
[2004/08/10 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 08:00:00 | 000,459,194 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/10 08:00:00 | 000,456,192 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll
[2004/08/10 08:00:00 | 000,441,552 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 08:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll
[2004/08/10 08:00:00 | 000,291,840 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll
[2004/08/10 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/10 08:00:00 | 000,253,440 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll
[2004/08/10 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 08:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll
[2004/08/10 08:00:00 | 000,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll
[2004/08/10 08:00:00 | 000,084,708 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/10 08:00:00 | 000,071,488 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 08:00:00 | 000,071,022 | ---- | C] () -- C:\WINDOWS\System32\edit.com
[2004/08/10 08:00:00 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll
[2004/08/10 08:00:00 | 000,054,128 | ---- | C] () -- C:\WINDOWS\System32\dosx.exe
[2004/08/10 08:00:00 | 000,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini
[2004/08/10 08:00:00 | 000,052,777 | ---- | C] () -- C:\WINDOWS\System32\command.com
[2004/08/10 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 08:00:00 | 000,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys
[2004/08/10 08:00:00 | 000,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys
[2004/08/10 08:00:00 | 000,039,546 | ---- | C] () -- C:\WINDOWS\System32\mem.exe
[2004/08/10 08:00:00 | 000,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys
[2004/08/10 08:00:00 | 000,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys
[2004/08/10 08:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys
[2004/08/10 08:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys
[2004/08/10 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/10 08:00:00 | 000,034,032 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys
[2004/08/10 08:00:00 | 000,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys
[2004/08/10 08:00:00 | 000,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys
[2004/08/10 08:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys
[2004/08/10 08:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys
[2004/08/10 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 08:00:00 | 000,027,914 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys
[2004/08/10 08:00:00 | 000,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys
[2004/08/10 08:00:00 | 000,021,542 | ---- | C] () -- C:\WINDOWS\System32\mqperf.ini
[2004/08/10 08:00:00 | 000,021,210 | ---- | C] () -- C:\WINDOWS\System32\debug.exe
[2004/08/10 08:00:00 | 000,019,726 | ---- | C] () -- C:\WINDOWS\System32\graphics.com
[2004/08/10 08:00:00 | 000,017,241 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini
[2004/08/10 08:00:00 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll
[2004/08/10 08:00:00 | 000,014,816 | ---- | C] () -- C:\WINDOWS\System32\kb16.com
[2004/08/10 08:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll
[2004/08/10 08:00:00 | 000,014,060 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini
[2004/08/10 08:00:00 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll
[2004/08/10 08:00:00 | 000,013,026 | ---- | C] () -- C:\WINDOWS\System32\edlin.exe
[2004/08/10 08:00:00 | 000,012,610 | ---- | C] () -- C:\WINDOWS\System32\append.exe
[2004/08/10 08:00:00 | 000,011,903 | ---- | C] () -- C:\WINDOWS\System32\setver.exe
[2004/08/10 08:00:00 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\scriptpw.dll
[2004/08/10 08:00:00 | 000,009,032 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys
[2004/08/10 08:00:00 | 000,008,584 | ---- | C] () -- C:\WINDOWS\System32\exe2bin.exe
[2004/08/10 08:00:00 | 000,007,084 | ---- | C] () -- C:\WINDOWS\System32\nlsfunc.exe
[2004/08/10 08:00:00 | 000,006,287 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini
[2004/08/10 08:00:00 | 000,004,992 | ---- | C] () -- C:\WINDOWS\System32\himem.sys
[2004/08/10 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 08:00:00 | 000,004,438 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini
[2004/08/10 08:00:00 | 000,004,233 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini
[2004/08/10 08:00:00 | 000,003,358 | ---- | C] () -- C:\WINDOWS\System32\redir.exe
[2004/08/10 08:00:00 | 000,003,262 | ---- | C] () -- C:\WINDOWS\System32\nw16.exe
[2004/08/10 08:00:00 | 000,002,656 | ---- | C] () -- C:\WINDOWS\System32\netware.drv
[2004/08/10 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/10 08:00:00 | 000,001,783 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini
[2004/08/10 08:00:00 | 000,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini
[2004/08/10 08:00:00 | 000,001,273 | ---- | C] () -- C:\WINDOWS\System32\loadfix.com
[2004/08/10 08:00:00 | 000,001,157 | ---- | C] () -- C:\WINDOWS\System32\vwipxspx.exe
[2004/08/10 08:00:00 | 000,000,977 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/10 08:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\share.exe
[2004/08/10 08:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\fastopen.exe
[2004/08/10 08:00:00 | 000,000,817 | ---- | C] () -- C:\WINDOWS\System32\mscdexnt.exe
[2004/08/10 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 08:00:00 | 000,000,369 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini
[2004/08/10 08:00:00 | 000,000,356 | ---- | C] () -- C:\WINDOWS\system.ini
[2001/08/18 00:54:50 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\dvdplay.exe
[2001/08/18 00:54:08 | 000,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll
[1997/06/14 07:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
========== LOP Check ==========
[2011/09/23 07:35:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PC Suite
[2010/11/06 03:50:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Amazon
[2006/11/13 12:11:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Ankh
[2010/02/19 07:21:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\AquaSoft
[2012/05/02 15:02:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\BearShare
[2012/05/02 15:02:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\FRITZ!
[2008/10/03 15:42:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\GMX
[2012/05/02 14:56:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Gpqn
[2006/02/10 09:44:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\ICQLite
[2010/01/10 07:27:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\IN-MEDIAKG
[2005/07/11 17:08:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\InterVideo
[2005/11/16 21:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Leadertech
[2010/01/17 06:26:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\MAGIX
[2010/09/17 08:36:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\PC Suite
[2011/11/14 04:56:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\RavensburgerTipToi
[2010/10/27 08:07:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Samsung
[2007/07/19 04:39:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\T-Online
[2012/05/02 15:04:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\TeamViewer
[2007/06/25 15:03:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\Teleca
[2007/11/26 08:16:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Steffi\Anwendungsdaten\WEB.DE
[2007/06/25 13:42:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth
[2008/10/28 09:25:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ESET
[2008/12/03 14:48:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010/09/17 08:29:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2010/01/17 06:25:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2010/09/17 08:32:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011/11/14 04:56:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RavensburgerTipToi
[2007/07/19 04:38:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2008/10/12 03:29:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010/12/17 09:02:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\tmp
[2012/05/02 15:02:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{250C2EDD-210F-4A78-93B6-91C0DBFA8255}
[2012/05/02 15:02:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{6738AD63-3870-4128-AF40-6CA60DF765A7}
========== Purity Check ==========
< End of report >
|
|
| Themen zu Auch ich habe mich mit dem Verschluesselungstroaner infiziert. |
| .dll, 0x00000001, 7-zip, administrator, bho, c:\windows\system32\cmd.exe, desktop, disabletaskmgr, einstellungen, error, explorer, firefox, fontcache, format, helper, homepage, icq, infiziert, infiziert., launch, log, logfile, mdm.exe, mozilla, object, plug-in, realtek, registry, remote control, scan, software, super, usb, windows, windows internet, windows xp |
Linear-Darstellung
