| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows-Verschlüsselungs-TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.05.2012, 18:16
| #1 |
| |  Windows-Verschlüsselungs-Trojaner Hallo, habe mir au so einen tollen Verschlüsselungstrojaner eingefangen. Er kam über mein e-mail-Postfach als Rechnung hereingeflattert. Nachdem ich im Forum gelesen und immer wieder auf das OTL gestoßen bin, hab ich's mir kurzerhand runtergeladen., und bin den Anweisungen durch gegangen. Folgende Log hat er ausgespuckt:OTL logfile created on: 5/5/2012 9:53:34 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 894.00 Mb Total Physical Memory | 686.00 Mb Available Physical Memory | 77.00% Memory free 806.00 Mb Paging File | 713.00 Mb Available in Paging File | 89.00% Paging File free Paging file location(s): C:\pagefile.sys 1344 2688 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 74.53 Gb Total Space | 54.77 Gb Free Space | 73.48% Space Free | Partition Type: NTFS Drive D: | 3.73 Gb Total Space | 0.77 Gb Free Space | 20.76% Space Free | Partition Type: FAT32 Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand] -- -- (AppMgmt) SRV - [2009/12/10 06:16:10 | 000,185,632 | ---- | M] (Ralink Technology, Corp.) [Auto] -- C:\Programme\Hama\Common\RaRegistry.exe -- (RalinkRegistryWriter) SRV - [2009/07/21 08:34:28 | 000,185,089 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009/05/13 10:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2008/02/27 19:07:26 | 000,594,600 | ---- | M] ( ) [Auto] -- C:\WINDOWS\System32\lxdncoms.exe -- (lxdn_device) SRV - [2008/02/27 19:07:14 | 000,098,984 | ---- | M] () [Auto] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdnserv.exe -- (lxdnCATSCustConnectService) SRV - [2003/07/28 07:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003/06/19 18:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | System] -- -- (Wbutton) DRV - File not found [Kernel | On_Demand] -- -- (wanatw) WAN Miniport (ATW) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (mailKmd) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2010/02/11 08:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6) DRV - [2009/12/10 06:16:16 | 000,019,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\Scutum50.sys -- (Scutum50) DRV - [2009/12/10 06:16:04 | 000,476,544 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rt73.sys -- (RT73) DRV - [2009/11/25 06:19:02 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009/05/11 04:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009/03/30 04:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2009/02/13 06:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008/04/13 14:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx) DRV - [2008/04/13 14:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm) DRV - [2007/09/28 23:05:59 | 002,456,064 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2006/06/22 14:33:13 | 000,016,512 | ---- | M] (Adaptec) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (Aspi32) DRV - [2006/06/22 14:30:54 | 000,223,128 | ---- | M] (DT Soft Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\dtscsi.sys -- (dtscsi) DRV - [2006/06/22 14:28:50 | 000,642,560 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd) DRV - [2005/08/18 11:52:06 | 000,093,568 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvatabus.sys -- (nvatabus) DRV - [2005/08/01 02:28:35 | 001,038,208 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP) DRV - [2005/08/01 02:28:34 | 000,703,232 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf) DRV - [2005/08/01 02:28:34 | 000,200,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWATI.sys -- (HSFHWATI) DRV - [2005/08/01 02:28:33 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) DRV - [2005/08/01 02:28:33 | 000,039,424 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005/08/01 02:28:32 | 000,146,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2005/08/01 02:28:18 | 002,314,560 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2005/05/04 20:08:38 | 000,463,168 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2004/08/04 08:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb) DRV - [2004/08/04 08:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx) DRV - [2004/08/03 17:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) DRV - [2003/04/28 06:27:06 | 000,009,867 | ---- | M] () [Kernel | System] -- C:\WINDOWS\System32\drivers\HOTKEY.sys -- (Hotkey) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank IE - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = about:blank IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = about:blank IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/fsc/ IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Maren_Heitmann_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank IE - HKU\Maren_Heitmann_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredimail.com/german IE - HKU\Maren_Heitmann_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/01/24 14:52:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/07/29 09:33:08 | 000,000,000 | ---D | M] [2012/01/24 14:52:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2007/02/24 05:51:47 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2011/12/21 03:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011/12/21 01:08:50 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011/12/21 01:02:40 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011/12/21 01:08:50 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011/12/21 01:08:50 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011/12/21 01:08:50 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011/12/21 01:08:50 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll (kikin) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CtrlVol] File not found O4 - HKLM..\Run: [LaunchAp] C:\Launch Manager\LaunchAp.exe () O4 - HKLM..\Run: [RealTray] File not found O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [Wbutton] C:\Launch Manager\WButton.exe () O4 - HKU\Maren_Heitmann_ON_C..\Run: [EC73CB8A] C:\WINDOWS\system32\657AB15AEC73CB8A275F.exe () O4 - HKU\Maren_Heitmann_ON_C..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10u_Plugin.exe (Adobe Systems, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Hama Wireless LAN Utility.lnk = C:\Programme\Hama\Common\RaUI.exe (Hama GmbH & Co KG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Maren_Heitmann_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Maren_Heitmann_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O7 - HKU\Maren_Heitmann_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll (kikin) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation) O16 - DPF: {22E5D91F-89E6-4405-AD9C-0AF27BA6F06B} file://D:\components\hidinputmonitorx.ocx (HidInputMonitorX Control) O16 - DPF: {4F63D44B-6274-4D60-8AB1-CAA7116B8AF3} file://D:\components\A9.ocx (A9Helper.A9) O16 - DPF: {7030CC6C-1A88-4591-BB5A-651B9F7F0C30} file://D:\components\wmvhdrating.ocx (WMVHDRatingCtrl Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\657AB15AEC73CB8A275F.exe) - C:\WINDOWS\system32\657AB15AEC73CB8A275F.exe () O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/02/01 13:27:22 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370) ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE NetSvcs: AppMgmt - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk - - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^Maren Heitmann^Startmenü^Programme^Autostart^WEB.DE SmartSurfer.lnk - - File not found MsConfig - StartUpReg: ALDI_SUED_FotoSuite_Download - hkey= - key= - File not found MsConfig - StartUpReg: Arcor Online - hkey= - key= - File not found MsConfig - StartUpReg: HotkeyApp - hkey= - key= - File not found MsConfig - StartUpReg: HP Software Update - hkey= - key= - File not found MsConfig - StartUpReg: IncrediMail - hkey= - key= - C:\Programme\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.) MsConfig - StartUpReg: LaunchAp - hkey= - key= - C:\Launch Manager\LaunchAp.exe () MsConfig - StartUpReg: LMgrOSD - hkey= - key= - File not found MsConfig - StartUpReg: LMgrVolOSD - hkey= - key= - File not found MsConfig - StartUpReg: lxdnamon - hkey= - key= - C:\Programme\Lexmark 2600 Series\lxdnamon.exe () MsConfig - StartUpReg: lxdnmon.exe - hkey= - key= - C:\Programme\Lexmark 2600 Series\lxdnmon.exe () MsConfig - StartUpReg: MSMSGS - hkey= - key= - C:\Programme\Messenger\msmsgs.exe (Microsoft Corporation) MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= - File not found MsConfig - StartUpReg: Outpost Firewall - hkey= - key= - File not found MsConfig - StartUpReg: OutpostFeedBack - hkey= - key= - File not found MsConfig - StartUpReg: QuickTime Task - hkey= - key= - File not found MsConfig - StartUpReg: RealTray - hkey= - key= - File not found MsConfig - StartUpReg: SoundMan - hkey= - key= - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - File not found MsConfig - StartUpReg: SynTPEnh - hkey= - key= - File not found MsConfig - StartUpReg: Ulead AutoDetector - hkey= - key= - C:\Programme\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe (Ulead Systems, Inc.) MsConfig - StartUpReg: Ulead Photo Express 5 SE Calendar Checker - hkey= - key= - C:\Programme\Ulead Systems\Ulead Photo Express 5 SE\CalCheck.exe (Ulead Systems, Inc.) MsConfig - StartUpReg: Wbutton - hkey= - key= - C:\Launch Manager\Wbutton.exe () MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 ========== Files/Folders - Created Within 30 Days ========== [2012/05/03 15:03:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\Fpncvl [2008/10/21 14:36:25 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\LXDNhcp.dll [2008/10/21 14:36:24 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdninpa.dll [2008/10/21 14:36:24 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdniesc.dll [2008/10/21 14:36:23 | 001,101,824 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnserv.dll [2008/10/21 14:36:23 | 000,843,776 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnusb1.dll [2008/10/21 14:36:23 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnpmui.dll [2008/10/21 14:36:23 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnprox.dll [2008/10/21 14:36:22 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnhbn3.dll [2008/10/21 14:36:22 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnlmpm.dll [2008/10/21 14:36:22 | 000,320,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdnih.exe [2008/10/21 14:36:20 | 000,851,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdncomc.dll [2008/10/21 14:36:20 | 000,594,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdncoms.exe [2008/10/21 14:36:20 | 000,376,832 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdncomm.dll [2008/10/21 14:36:20 | 000,365,224 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdncfg.exe [3 C:\Dokumente und Einstellungen\All Users\*.tmp files -> C:\Dokumente und Einstellungen\All Users\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/05/05 14:40:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012/05/05 14:38:20 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012/05/05 14:38:10 | 937,660,416 | -HS- | M] () -- C:\hiberfil.sys [2012/05/03 15:18:07 | 000,000,002 | ---- | M] () -- C:\locked-oem.tag.lplf [2012/05/03 15:09:17 | 000,001,912 | ---- | M] () -- C:\locked-IPH.PH.xdsl [2012/05/03 15:09:16 | 000,000,522 | ---- | M] () -- C:\locked-hpfr3420.xml.cfds [2012/05/03 15:09:12 | 000,018,211 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\locked-maren 2010.elfo.hinw [2012/05/03 15:09:12 | 000,011,330 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\locked-Maren2009.elfo.uedc [2012/05/03 15:09:12 | 000,008,053 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\locked-Martin 2009.elfo.fxyg [2012/05/03 15:07:29 | 002,094,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-Ferrero Fan Connection-764GG4A400.pdf.yygl [2012/05/03 15:07:21 | 003,314,706 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;21;00.JPG.kppi [2012/05/03 15:07:20 | 004,647,014 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;17;17.JPG.xdma [2012/05/03 15:07:20 | 002,356,505 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;44.JPG.njyg [2012/05/03 15:07:20 | 002,355,294 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;20;54.JPG.njwg [2012/05/03 15:07:20 | 002,290,111 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;49.JPG.aehq [2012/05/03 15:07:20 | 002,219,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;26.JPG.aehq [2012/05/03 15:07:20 | 002,100,006 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;53.JPG.zsfp [2012/05/03 15:07:20 | 001,188,342 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;20;48.JPG.jomu [2012/05/03 15:07:20 | 001,080,823 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-09.04.2012 22;09;15.JPG.epin [2012/05/03 15:07:19 | 001,754,673 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-Schimmel Broschüre 3PDF.pdf.bhgf [2012/05/03 15:07:19 | 000,851,067 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-Schimmel Broschüre.PDF.srxw [2012/05/03 15:07:18 | 001,446,841 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-RECHNUNG - JOHN DEERE X729 Rasentraktor + Extras-1.pdf.guyt [2012/05/03 15:07:18 | 000,513,702 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-Schimmel Broschüre 2.PDF.oqnr [2012/05/03 15:07:17 | 002,678,016 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-FoxitReader23_setup.exe.nbvc [2012/05/03 15:07:17 | 000,811,755 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-Energie sparen.PDF.pwqn [2012/05/03 15:07:16 | 087,262,320 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-avira_free_antivirus_de.exe.mkjh [2012/05/03 15:07:16 | 022,322,568 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-antivir_workstation8_winu_de_h.exe.dtre [2012/05/03 15:07:16 | 017,222,360 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-antivir_workstation_win704u_de_h.exe.guyt [2012/05/03 15:07:16 | 003,559,856 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Desktop\locked-agsetup183se.exe.qhgf [2012/05/03 15:06:02 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.kpol [2012/05/03 15:04:25 | 000,000,305 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\locked-addr_file.html.hiny [2012/05/03 15:04:23 | 000,000,079 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked-Desktop anzeigen.scf.xdsa [2012/05/03 15:04:22 | 035,753,518 | ---- | M] () -- C:\locked-Die_Firma_Die_Eine_2005_(Instrumental)_31519.wav.vsap [2012/05/03 15:04:22 | 000,139,728 | ---- | M] () -- C:\locked-Die_Firma_Die_Eine_2005_(Instrumental)_31519.wav.peak.xdsa [2012/05/03 15:04:12 | 040,771,630 | ---- | M] () -- C:\locked-Andrea_Berg_Du_Hast_Mich_Tausendmal_Belogen_(Instrumentalversion)_31250.wav.cyjn [2012/05/03 15:04:12 | 000,159,328 | ---- | M] () -- C:\locked-Andrea_Berg_Du_Hast_Mich_Tausendmal_Belogen_(Instrumentalversion)_31250.wav.peak.erfq [2012/05/03 15:03:05 | 000,052,224 | -H-- | M] () -- C:\WINDOWS\System32\657AB15AEC73CB8A275F.exe [2012/04/30 11:29:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321 [2012/04/30 11:29:30 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320 [2012/04/30 11:28:00 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323 [2012/04/30 11:26:42 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322 [2012/04/26 12:38:10 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh325 [2012/04/26 12:37:48 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh324 [2012/04/11 16:37:42 | 000,528,698 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012/04/11 16:37:42 | 000,503,498 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012/04/11 16:37:42 | 000,105,980 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012/04/11 16:37:42 | 000,088,352 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012/04/11 16:34:13 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [3 C:\Dokumente und Einstellungen\All Users\*.tmp files -> C:\Dokumente und Einstellungen\All Users\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/05/03 15:04:05 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325 [2012/05/03 15:04:05 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324 [2012/05/03 15:04:05 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323 [2012/05/03 15:04:05 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322 [2012/05/03 15:04:05 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321 [2012/05/03 15:04:05 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320 [2012/05/03 15:03:05 | 000,052,224 | -H-- | C] () -- C:\WINDOWS\System32\657AB15AEC73CB8A275F.exe [2012/05/03 07:35:04 | 002,100,006 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;53.JPG.zsfp [2012/05/03 07:34:53 | 002,290,111 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;49.JPG.aehq [2012/05/03 07:34:49 | 002,356,505 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;44.JPG.njyg [2012/05/03 07:34:44 | 002,219,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-03.05.2012 13;34;26.JPG.aehq [2012/04/24 01:21:06 | 003,314,706 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;21;00.JPG.kppi [2012/04/24 01:21:00 | 002,355,294 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;20;54.JPG.njwg [2012/04/24 01:20:54 | 001,188,342 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;20;48.JPG.jomu [2012/04/24 01:17:28 | 004,647,014 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-24.04.2012 07;17;17.JPG.xdma [2012/04/18 05:56:48 | 002,094,950 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-Ferrero Fan Connection-764GG4A400.pdf.yygl [2012/04/09 16:09:27 | 001,080,823 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Eigene Dateien\locked-09.04.2012 22;09;15.JPG.epin [2012/02/17 12:09:09 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2012/01/14 06:37:06 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2012/01/01 07:57:07 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\sqlite36_engine.dll [2011/11/26 13:27:51 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2011/07/23 09:13:40 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\DiagFunc.dll [2011/07/23 09:13:40 | 000,001,191 | ---- | C] () -- C:\WINDOWS\System32\W32N55.INI [2011/07/23 09:13:40 | 000,000,516 | ---- | C] () -- C:\WINDOWS\System32\DiagFunc.ini [2011/03/18 17:33:01 | 000,018,211 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\locked-maren 2010.elfo.hinw [2010/10/15 09:36:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\musiceditor.INI [2010/04/30 13:31:32 | 000,008,053 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\locked-Martin 2009.elfo.fxyg [2010/04/13 13:57:48 | 000,011,330 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\locked-Maren2009.elfo.uedc [2009/04/13 16:41:35 | 000,000,019 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\mdbu.bin [2009/04/13 16:38:49 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll [2008/10/21 14:40:03 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdnvs.dll [2008/10/21 14:40:00 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdncoin.dll [2008/10/21 14:39:00 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\lxdndrs.dll [2008/10/21 14:39:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lxdncaps.dll [2008/10/21 14:38:59 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdncnv4.dll [2008/10/21 14:36:37 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\lxdnrwrd.ini [2008/10/21 14:36:25 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\LXDNinst.dll [2008/10/21 14:36:21 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdngrd.dll [2008/09/16 08:12:55 | 000,000,203 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2008/09/16 08:04:44 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2008/09/14 05:07:39 | 000,000,113 | ---- | C] () -- C:\WINDOWS\videodeLuxe.INI [2008/08/05 06:20:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WATCH.INI [2008/08/05 05:30:21 | 000,004,007 | ---- | C] () -- C:\WINDOWS\hpdj3840.ini [2008/07/01 16:03:41 | 000,001,144 | ---- | C] () -- C:\WINDOWS\mozver.dat [2007/10/25 04:26:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin [2007/10/25 04:22:08 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe [2007/10/25 04:17:14 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2007/10/14 11:59:27 | 000,000,298 | ---- | C] () -- C:\WINDOWS\homeDVD-Fotos5_dlx.INI [2007/09/28 22:36:05 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat [2007/09/28 22:36:05 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat [2007/09/28 22:36:05 | 000,972,072 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat [2007/08/14 17:11:53 | 000,156,671 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2007/07/30 14:51:19 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\wklnhst.dat [2007/02/24 06:05:49 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\locked-addr_file.html.hiny [2006/10/15 15:35:44 | 000,037,888 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006/07/24 15:39:15 | 000,000,072 | ---- | C] () -- C:\WINDOWS\pex.INI [2006/07/06 14:44:02 | 000,000,147 | ---- | C] () -- C:\WINDOWS\Ulead32.ini [2006/06/22 14:33:28 | 000,052,858 | ---- | C] () -- C:\WINDOWS\System32\interceptor.sys [2006/06/22 14:33:28 | 000,027,059 | ---- | C] () -- C:\WINDOWS\System32\drivers\GDTdiIcpt.sys [2006/06/22 14:08:03 | 000,000,004 | ---- | C] () -- C:\WINDOWS\msoffice.ini [2006/06/11 14:10:39 | 000,000,731 | ---- | C] () -- C:\WINDOWS\aolback.exe.lnk [2006/06/11 13:55:27 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2006/06/11 13:53:27 | 000,039,703 | ---- | C] () -- C:\WINDOWS\System32\compare.dat [2006/06/11 13:52:58 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Maren Heitmann\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2006/02/01 14:58:15 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2006/02/01 14:57:23 | 000,000,180 | ---- | C] () -- C:\WINDOWS\Option.ini [2006/02/01 14:53:16 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\property.dll [2006/02/01 14:53:06 | 000,528,698 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2006/02/01 14:53:06 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2006/02/01 14:53:06 | 000,105,980 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2006/02/01 14:53:06 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2006/02/01 14:52:56 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2006/02/01 14:52:54 | 000,503,498 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2006/02/01 14:52:54 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2006/02/01 14:52:54 | 000,088,352 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2006/02/01 14:52:54 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2006/02/01 14:52:53 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2006/02/01 14:52:53 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2006/02/01 14:52:51 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2006/02/01 14:52:49 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2006/02/01 14:52:49 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2006/02/01 14:52:45 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2006/02/01 14:52:41 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2006/02/01 14:46:21 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006/02/01 14:31:06 | 000,000,522 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006/02/01 14:24:28 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll [2006/02/01 14:21:29 | 000,007,119 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini [2006/02/01 14:20:37 | 000,009,867 | ---- | C] () -- C:\WINDOWS\System32\drivers\HOTKEY.sys [2006/02/01 14:19:19 | 000,001,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\alcxinit.dat [2006/02/01 14:11:32 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006/02/01 13:31:46 | 000,000,778 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2006/02/01 13:30:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2006/02/01 13:24:52 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2006/02/01 13:23:26 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2006/02/01 13:19:31 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006/02/01 13:18:36 | 000,309,192 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2003/02/20 12:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI ========== LOP Check ========== [2012/05/03 15:04:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\DesktopIconForAmazon [2012/01/31 12:55:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\DVDVideoSoft [2012/05/03 15:05:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\DVDVideoSoftIEHelpers [2011/03/18 17:02:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\elsterformular [2012/05/03 15:03:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\Fpncvl [2012/05/03 15:05:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\kikin [2012/05/03 15:05:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\Lexmark Productivity Studio [2012/01/14 06:47:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\MAGIX [2012/05/03 15:06:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\MSNInstaller [2012/03/01 05:25:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\PriceGong [2008/06/14 09:32:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\SmartSurfer [2007/07/30 14:53:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\Template [2006/07/24 13:20:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\Ulead Systems [2007/12/16 15:19:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\WEB.DE SmartSurfer [2008/06/26 06:30:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\WEBDE [2009/04/13 16:39:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Aldi Sued Fotoservice [2012/05/03 14:55:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess [2012/05/03 15:04:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2006/02/01 14:25:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX [2011/07/23 09:13:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RalinkRT7x Driver [2006/06/11 14:27:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online [2009/10/12 06:34:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ThumbnailCache4R [2006/07/06 14:51:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ulead Systems [2006/06/11 13:58:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2007/02/24 06:51:40 | 000,000,000 | ---D | M] -- C:\388555c906a92a8b2c [2012/05/03 15:04:12 | 000,000,000 | ---D | M] -- C:\Addon [2007/10/25 04:20:48 | 000,000,000 | ---D | M] -- C:\ATI [2012/01/14 06:36:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2006/02/01 14:32:45 | 000,000,000 | ---D | M] -- C:\drivers [2012/01/16 09:31:41 | 000,000,000 | ---D | M] -- C:\e2f23e821fd6f471ee5cd2 [2012/05/03 15:09:16 | 000,000,000 | ---D | M] -- C:\FirstSteps [2012/05/03 15:09:16 | 000,000,000 | ---D | M] -- C:\frndial [2012/05/03 15:10:13 | 000,000,000 | ---D | M] -- C:\ISP [2012/05/03 15:10:14 | 000,000,000 | ---D | M] -- C:\Launch Manager [2012/05/03 15:10:44 | 000,000,000 | ---D | M] -- C:\LFS [2008/10/21 14:40:24 | 000,000,000 | ---D | M] -- C:\logs [2007/10/14 11:57:35 | 000,000,000 | ---D | M] -- C:\MAGIX [2012/05/03 15:17:24 | 000,000,000 | ---D | M] -- C:\Magix MediaSuite 2005 [2006/02/01 14:28:53 | 000,000,000 | RH-D | M] -- C:\MSOCache [2012/05/03 15:18:07 | 000,000,000 | ---D | M] -- C:\MSWorks [2006/06/11 13:57:58 | 000,000,000 | ---D | M] -- C:\My Music [2012/05/03 15:18:14 | 000,000,000 | ---D | M] -- C:\Office11 [2008/10/21 14:54:13 | 000,000,000 | ---D | M] -- C:\Panel [2012/03/01 06:04:22 | 000,000,000 | R--D | M] -- C:\Programme [2006/06/22 14:06:28 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2012/05/03 15:18:27 | 000,000,000 | ---D | M] -- C:\SBSI [2012/05/03 15:20:51 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012/05/03 15:18:28 | 000,000,000 | ---D | M] -- C:\VOIP_Sipgate [2012/04/12 15:40:35 | 000,000,000 | ---D | M] -- C:\WINDOWS [2012/05/03 15:18:31 | 000,000,000 | ---D | M] -- C:\WinDVD < %PROGRAMFILES%\*.exe > Invalid Environment Variable: %LOCALAPPDATA%\*.exe < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2012/01/21 08:43:54 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys [2012/01/21 08:43:54 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys < MD5 for: ATAPI.SYS > [2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2012/01/21 08:43:54 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys [2012/01/21 08:43:54 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004/08/03 16:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys [2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL > [2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: EXPLORER.EXE > [2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB884883$\explorer.exe [2007/06/13 09:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [2008/04/13 22:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008/04/13 22:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2005/04/07 14:46:59 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=64322E8399B205B7281FF883737A9B03 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe < MD5 for: IASTOR.SYS > [2005/10/12 07:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\I386\$oem$\textmode\iaStor.sys [2005/10/12 07:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\OemDir\iaStor.sys [2005/10/12 07:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\system32\drivers\iaStor.sys < MD5 for: NETLOGON.DLL > [2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtUninstallKB968389_0$\netlogon.dll [2009/02/06 14:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll [2009/02/06 14:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$NtUninstallKB975467_0$\netlogon.dll < MD5 for: NVATABUS.SYS > [2005/08/18 11:52:06 | 000,093,568 | ---- | M] (NVIDIA Corporation) MD5=0344AA9113DC16EEC379F4652020849D -- C:\WINDOWS\I386\$oem$\textmode\nvatabus.sys [2005/08/18 11:52:06 | 000,093,568 | ---- | M] (NVIDIA Corporation) MD5=0344AA9113DC16EEC379F4652020849D -- C:\WINDOWS\OemDir\nvatabus.sys [2005/08/18 11:52:06 | 000,093,568 | ---- | M] (NVIDIA Corporation) MD5=0344AA9113DC16EEC379F4652020849D -- C:\WINDOWS\system32\drivers\nvatabus.sys < MD5 for: SCECLI.DLL > [2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll < MD5 for: USER32.DLL > [2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll [2007/03/08 11:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2005/03/02 14:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2004/08/04 08:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll [2007/03/08 11:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: VIAMRAID.SYS > [2005/11/23 05:12:12 | 000,092,672 | ---- | M] (VIA Technologies inc,.ltd) MD5=FBF18F9F5FB852C2976723587B44F346 -- C:\WINDOWS\I386\$oem$\textmode\viamraid.sys [2005/11/23 05:12:12 | 000,092,672 | ---- | M] (VIA Technologies inc,.ltd) MD5=FBF18F9F5FB852C2976723587B44F346 -- C:\WINDOWS\OemDir\viamraid.sys [2005/11/23 05:12:12 | 000,092,672 | ---- | M] (VIA Technologies inc,.ltd) MD5=FBF18F9F5FB852C2976723587B44F346 -- C:\WINDOWS\system32\drivers\viamraid.sys < MD5 for: WINLOGON.EXE > [2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtUninstallKB883529$\winlogon.exe [2004/08/25 12:59:56 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=325A82EBBD69248D75C5F831E8817D17 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2006/02/01 14:18:02 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2006/02/01 14:18:02 | 000,638,976 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2006/02/01 14:18:02 | 000,430,080 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\system32\*.dll /lockedfiles > [2011/03/03 02:54:43 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll [2008/04/13 22:22:18 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll [2008/04/13 22:22:20 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll [2012/02/28 14:49:18 | 001,510,400 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shdocvw.dll [2011/01/21 10:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll [2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] Invalid Environment Variable: %USERPROFILE%\*.* Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe < End of report > Würde mich sehr über Eure Hilfe freuen.... Danke. |
|
07.05.2012, 19:59
| #2 |
| /// Malware-holic   | Windows-Verschlüsselungs-Trojaner hi,
__________________na dann, schaun wir mal: auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein: Code:
ATTFilter :OTL
O4 - HKU\Maren_Heitmann_ON_C..\Run: [EC73CB8A] C:\WINDOWS\system32\657AB15AEC73CB8A275F.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\Maren_Heitmann_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Maren_Heitmann_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\657AB15AEC73CB8A275F.exe) - C:\WINDOWS\system32\657AB15AEC73CB8A275F.exe ()
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
[2012/05/03 15:03:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Maren Heitmann\Anwendungsdaten\Fpncvl
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
dieses speicherst du auf nem usb stick als fix.txt nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist. • Klicke nun bitte auf den Fix Button. es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick. wenn dies nicht funktioniert, bitte den fix manuell eintragen. dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen, log posten bitte.
__________________ |
|
| Themen zu Windows-Verschlüsselungs-Trojaner |
| .dll, 0x00000001, antivir, antivirus, avira, bho, desktop, disabletaskmgr, einstellungen, error, explorer, feedback, firefox, format, google, helper, home, homepage, hotkey.sys, logfile, monitor.exe, plug-in, realtek, rundll, scan, security, security update, software, usb, windows, windows xp, winlogon.exe |
Linear-Darstellung
