![]() |
|
Log-Analyse und Auswertung: Verschlüsselungs-Trojaner,OTL.exe im Anhang, Windows XP SV3, abgesicherter Modus nicht möglichWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
![]() | ![]() Verschlüsselungs-Trojaner,OTL.exe im Anhang, Windows XP SV3, abgesicherter Modus nicht möglich Bitte um Hilfe. Hier die übersicht über den OTL scan: OTL logfile created on: 5/26/2012 7:43:57 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,022.00 Mb Total Physical Memory | 830.00 Mb Available Physical Memory | 81.00% Memory free 906.00 Mb Paging File | 846.00 Mb Available in Paging File | 93.00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 33.64 Gb Total Space | 23.55 Gb Free Space | 70.00% Space Free | Partition Type: NTFS Drive D: | 33.64 Gb Total Space | 33.44 Gb Free Space | 99.42% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days Using ControlSet: ControlSet002 ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand] -- -- (AppMgmt) SRV - [2012/04/27 12:46:36 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/02/29 02:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2005/05/28 03:35:56 | 000,036,864 | R--- | M] () [Auto] -- C:\Programme\samsung\Samsung Network Manager\SNMWLANService.exe -- (SNM WLAN Service) SRV - [2002/09/20 10:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto] -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2010/12/08 15:56:36 | 000,004,300 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO) DRV - [2005/06/28 01:01:58 | 001,241,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2005/06/08 11:58:10 | 000,017,792 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WOWFilter.sys -- (wowfilter) DRV - [2005/04/30 11:01:56 | 003,281,408 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R) DRV - [2005/04/18 17:21:08 | 000,027,136 | ---- | M] (REDC) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\risdptsk.sys -- (risdptsk) DRV - [2004/12/06 10:51:10 | 000,051,328 | ---- | M] (REDC) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2004/12/05 16:57:14 | 000,307,456 | ---- | M] (REDC) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2004/05/26 09:18:18 | 000,044,928 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\TMH_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/04/27 12:46:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/04/15 15:43:07 | 000,000,000 | ---D | M] [2010/12/08 16:32:40 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\mozilla\Extensions [2011/04/15 15:27:00 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\mozilla\Firefox\Profiles\hw42as3f.default\extensions [2012/05/23 17:01:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\mozilla\Firefox\Profiles\hw42as3f.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012/05/23 17:01:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\mozilla\Firefox\Profiles\hw42as3f.default\extensions\dplauncher@digitalpublishing.de [2012/01/12 13:09:49 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012/04/30 12:32:43 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012/04/27 12:46:35 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011/10/02 23:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2012/01/12 13:09:28 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/01/12 13:09:28 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012/01/12 13:09:28 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012/01/12 13:09:28 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012/01/12 13:09:28 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012/01/12 13:09:28 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKU\TMH_ON_C..\Run: [80906D2D] C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Bcrwn\04F6CA0480906D2DC90C.exe (Корпорация Майкрософт) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\TMH_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\TMH_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O7 - HKU\TMH_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1 O7 - HKU\TMH_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\30AF2DA780906D2D623F.exe) - C:\WINDOWS\system32\30AF2DA780906D2D623F.exe (Корпорация Майкрософт) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found O32 - HKLM CDRom: AutoRun - 0 O32 - AutoRun File - [2010/12/08 15:40:10 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 7 Days ========== [2012/05/23 16:54:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Bcrwn [2012/05/23 16:54:00 | 000,052,224 | -H-- | C] (Корпорация Майкрософт) -- C:\WINDOWS\System32\30AF2DA780906D2D623F.exe [2012/05/23 16:53:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 7 Days ========== [2012/05/26 12:26:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012/05/25 16:39:01 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012/05/23 16:54:00 | 000,052,224 | -H-- | M] (Корпорация Майкрософт) -- C:\WINDOWS\System32\30AF2DA780906D2D623F.exe [2012/05/23 07:54:39 | 000,000,043 | ---- | M] () -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\XtQETUOjDxJnpfN [2012/05/22 15:10:57 | 000,001,584 | ---- | M] () -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2012/05/21 17:10:11 | 000,036,471 | ---- | M] () -- C:\Dokumente und Einstellungen\TMH\Desktop\dOADGvLXfNyesQoaUOAl [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/05/23 16:55:12 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325 [2012/05/23 16:55:12 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324 [2012/05/23 16:55:12 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323 [2012/05/23 16:55:12 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322 [2012/05/23 16:55:12 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321 [2012/05/23 16:55:12 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320 [2012/05/22 15:10:57 | 000,001,584 | ---- | C] () -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2012/05/08 01:33:00 | 000,122,136 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2012/02/16 02:11:16 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011/01/29 16:29:45 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2011/01/01 13:24:54 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2010/12/12 09:42:08 | 000,045,056 | ---- | C] () -- C:\Dokumente und Einstellungen\TMH\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/12/08 16:32:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2010/12/08 15:56:39 | 000,004,300 | ---- | C] () -- C:\WINDOWS\System32\MEMIO.SYS [2010/12/08 15:53:06 | 000,095,617 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2010/12/08 15:42:30 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2010/12/08 15:37:10 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2010/12/08 15:16:50 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2005/06/08 11:58:10 | 000,017,792 | ---- | C] () -- C:\WINDOWS\System32\drivers\WOWFilter.sys [2005/06/08 11:58:08 | 000,035,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\WOWXT_kern_i386.sys [2005/06/08 11:58:08 | 000,029,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSXT_kern_i386.sys [2004/08/04 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004/08/04 08:00:00 | 000,449,418 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2004/08/04 08:00:00 | 000,433,138 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004/08/04 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004/08/04 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2004/08/04 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004/08/04 08:00:00 | 000,080,936 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2004/08/04 08:00:00 | 000,068,094 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004/08/04 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004/08/04 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2004/08/04 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004/08/04 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004/08/04 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004/08/04 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2001/08/31 01:32:24 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001/08/31 01:30:56 | 000,004,486 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat ========== LOP Check ========== [2012/05/23 16:54:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Bcrwn [2012/05/07 03:07:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Canon [2011/02/15 13:55:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\digital publishing [2012/05/23 17:01:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\DVDVideoSoftIEHelpers [2012/05/07 06:08:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\elsterformular [2011/02/08 15:17:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\OpenOffice.org [2010/12/30 19:19:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\Serif [2010/12/21 19:02:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\TMH\Anwendungsdaten\XMedia Recode [2012/05/23 17:01:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular ========== Purity Check ========== < End of report > |
Themen zu Verschlüsselungs-Trojaner,OTL.exe im Anhang, Windows XP SV3, abgesicherter Modus nicht möglich |
.dll, bho, browser, cdrom, dateien, desktop, disabletaskmgr, einstellungen, error, explorer, explorer.exe, firefox, format, homepage, ics, logfile, mozilla, nicht möglich, otl-file, plug-in, registry, scan, servicepack3, software, system32, verschlüsselungs-trojaner, wallpaper, win32, windows, windows xp, winlogon |