|
Plagegeister aller Art und deren Bekämpfung: GVU-TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
30.06.2012, 15:03 | #16 |
| GVU-Trojaner ok, nehm ich dann die OTLPE_New_Std.iso oder OTLPE_New_Net.iso ? |
30.06.2012, 15:04 | #17 |
/// Malware-holic | GVU-Trojaner die hier:
__________________http://filepony.de/download-otlpe/
__________________ |
30.06.2012, 15:46 | #18 |
| GVU-Trojaner Hallejuja...
__________________-Bin auf dem Reatogo-X-PE Desktop -Habe OTLPE doppelklick -Ich wurde gefragt "Do you wish to load remote user profile(s) for scanning" -Habe Yes gedrückt, die andere Frage wurde nicht gestellt Soll ich jetzt alles, was du in deinem ersten Post in den Kasten geschrieben hast abschreiben und dann bei OTL unten eingeben? Und da sind noch viele andere Knöpfe bei OTL, die sollen alle so bleiben? |
30.06.2012, 17:47 | #19 |
/// Malware-holic | GVU-Trojaner hi abschreiben, nein, zb auf nem usb stick als text speichern und dann in otl reinkopieren. die restlichen einstellungen bleiben so.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
30.06.2012, 18:01 | #20 |
| GVU-Trojaner Wie lange dauert der Scan-Vorgang ca? |
30.06.2012, 18:06 | #21 |
/// Malware-holic | GVU-Trojaner dauert schon ne weile.
__________________ --> GVU-Trojaner |
30.06.2012, 20:45 | #22 |
| GVU-Trojaner dauert aber wirklich ne ganze weile... |
01.07.2012, 11:43 | #23 |
| GVU-Trojaner Hallo, ich habe die Extras.txt-Datei nicht bekommen... Aber die OTL: Code:
ATTFilter OTL logfile created on: 7/1/2012 2:22:55 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 6.0.2900.2180) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free Paging file location(s): c:\pagefile.sys 4606 4606 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme Drive C: | 146.48 Gb Total Space | 37.47 Gb Free Space | 25.58% Space Free | Partition Type: NTFS Drive D: | 319.27 Gb Total Space | 214.29 Gb Free Space | 67.12% Space Free | Partition Type: NTFS Drive E: | 3.74 Gb Total Space | 3.74 Gb Free Space | 100.00% Space Free | Partition Type: FAT32 Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - [2012/06/23 13:01:17 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/06/23 02:27:28 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINXP\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/05/08 18:30:47 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2012/05/08 18:30:47 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012/05/08 18:30:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011/10/24 16:32:00 | 000,055,144 | ---- | M] (Apple Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2011/07/20 00:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2010/06/24 10:41:38 | 000,092,008 | ---- | M] (TomTom) [Auto] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService) SRV - [2010/06/14 09:07:14 | 000,615,936 | ---- | M] (Nokia) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2009/08/18 05:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2009/05/25 06:18:04 | 000,040,960 | ---- | M] () [Auto] -- C:\Programme\Gemeinsame Dateien\DeviceHelper\DeviceManager.exe -- (DeviceManager) SRV - [2006/10/26 08:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2005/04/03 19:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (SenFiltService) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | Boot] -- -- (IntelIde) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - File not found [Kernel | On_Demand] -- -- (ATHFMWDL) DRV - File not found [Kernel | On_Demand] -- -- (AEAudio) DRV - File not found [Kernel | On_Demand] -- -- (ADIHdAudAddService) DRV - [2012/05/08 18:30:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\avipbb.sys -- (avipbb) DRV - [2012/05/08 18:30:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINXP\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011/12/20 03:39:28 | 000,100,368 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\AtihdXP3.sys -- (AtiHDAudioService) DRV - [2011/12/05 23:42:18 | 007,490,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2011/10/11 09:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011/02/09 13:39:46 | 000,218,688 | ---- | M] (DT Soft Ltd) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2010/06/17 09:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010/02/26 08:32:58 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2010/02/26 08:32:46 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2010/02/26 08:32:44 | 000,022,528 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2010/02/26 08:32:44 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2009/07/16 08:38:53 | 000,165,376 | ---- | M] () [Kernel | Auto] -- C:\WINXP\system32\drivers\atksgt.sys -- (atksgt) DRV - [2009/07/16 08:38:53 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\WINXP\system32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009/05/25 06:18:02 | 000,103,552 | ---- | M] (TCT International Mobile Ltd) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\qcusbser.sys -- (qcusbser) DRV - [2009/02/28 10:39:38 | 000,015,890 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto] -- C:\WINXP\system32\drivers\mdc8021x.sys -- (MDC8021X) AEGIS Protocol (IEEE 802.1x) DRV - [2008/10/20 22:03:13 | 000,089,600 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2008/08/26 04:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008/05/21 04:48:04 | 000,277,376 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2008/04/18 05:28:10 | 000,384,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\WPN111.sys -- (WPN111) DRV - [2008/02/14 09:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\monfilt.sys -- (monfilt) DRV - [2007/06/24 15:56:54 | 000,038,920 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\btcusb.sys -- (Btcsrusb) DRV - [2007/06/24 15:56:40 | 000,027,656 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio) DRV - [2007/06/24 15:56:34 | 000,034,312 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\blueletaudio.sys -- (BlueletAudio) DRV - [2007/04/16 11:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINXP\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2007/04/10 17:46:48 | 001,966,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\VX3000.sys -- (VX3000) DRV - [2007/03/06 07:27:32 | 000,019,968 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2007/03/06 07:27:28 | 000,058,752 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2007/03/05 14:59:04 | 000,018,320 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\btnetdrv.sys -- (BT) DRV - [2007/03/05 14:56:18 | 000,035,600 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- C:\WINXP\system32\drivers\BTHidMgr.sys -- (BTHidMgr) DRV - [2007/03/05 14:55:12 | 000,020,880 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- C:\WINXP\system32\drivers\vbtenum.sys -- (BTHidEnum) DRV - [2007/03/05 14:53:18 | 000,044,304 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\VcommMgr.sys -- (VcommMgr) DRV - [2007/03/05 14:52:18 | 000,034,448 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\VComm.sys -- (VComm) DRV - [2006/06/18 18:38:18 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINXP\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005/04/12 04:41:20 | 000,004,608 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ElbyDelay.sys -- (ElbyDelay) DRV - [2004/08/12 22:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2003/09/03 00:02:42 | 000,020,064 | ---- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) [Kernel | Auto] -- C:\WINXP\system32\MLPTDR_B.SYS -- (MLPTDR_B) DRV - [2003/07/24 07:10:34 | 000,017,149 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINXP\system32\DNINDIS5.sys -- (DNINDIS5) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\User_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm IE - HKU\User_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\User_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.youtube.com/ IE - HKU\User_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\User_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\User_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "BearShare Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=" FF - prefs.js..browser.search.order.1: "BearShare Web Search" FF - prefs.js..browser.search.selectedEngine: "BearShare Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://www.youtube.com/?gl=DE&hl=de" FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.723 FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.0.0.10 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..keyword.URL: "hxxp://search.bearshare.com/web?src=ffb&systemid=2&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "chrome://browser-region/locale/region.properties" FF - prefs.js..browser.startup.homepage: "resource:/browserconfig.properties" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINXP\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Programme\DNA\plugins\npbtdna.dll (BitTorrent, Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Programme\Nokia\Nokia PC Suite 7\bkmrksync\ [2010/06/07 14:37:02 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/10/23 09:03:58 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/06/23 13:01:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/06/25 06:48:57 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/10/23 09:04:00 | 000,000,000 | ---D | M] [2010/08/08 07:10:57 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\mozilla\Extensions [2010/08/08 07:10:57 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\mozilla\Extensions\home2@tomtom.com [2012/06/24 07:10:56 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\mozilla\Firefox\Profiles\sgvnn1v4.default\extensions [2010/12/16 11:13:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\mozilla\Firefox\Profiles\sgvnn1v4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011/07/20 23:31:18 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\mozilla\Firefox\Profiles\sgvnn1v4.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012/06/13 12:59:52 | 000,000,000 | ---D | M] ("Avira SearchFree Toolbar plus Web Protection") -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\mozilla\Firefox\Profiles\sgvnn1v4.default\extensions\toolbar@ask.com [2011/10/13 11:19:44 | 000,000,855 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\1und1-suche.xml [2011/10/10 09:27:30 | 000,001,281 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\amazondotcom-de.xml [2010/09/14 08:41:12 | 000,002,506 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\BearShareWebSearch.xml [2011/10/10 08:59:22 | 000,002,364 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\eBay-de.xml [2011/10/13 11:01:56 | 000,010,507 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\gmx-suche.xml [2011/10/10 09:12:38 | 000,002,385 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\lastminute.xml [2011/10/13 11:34:10 | 000,002,248 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\mailcom-search.xml [2010/03/04 08:09:42 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\sweetim.xml [2011/10/13 09:07:08 | 000,005,490 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\sgvnn1v4.default\searchplugins\webde-suche.xml [2012/02/21 08:41:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions File not found (No name found) -- () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\USER\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\SGVNN1V4.DEFAULT\EXTENSIONS\{66E978CD-981F-47DF-AC42-E3CF417C1467}.XPI () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\USER\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\SGVNN1V4.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}.XPI [2012/06/23 13:01:18 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011/05/03 22:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2012/06/23 13:01:15 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2010/09/14 08:41:12 | 000,002,506 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\BearShareWebSearch.xml [2012/06/23 13:01:15 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012/06/23 13:01:15 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012/06/23 13:01:15 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012/06/23 13:01:15 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012/06/23 13:01:15 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001/08/23 06:00:00 | 000,000,820 | ---- | M]) - C:\WINXP\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (IE7Pro BHO) - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Programme\IEPro\IEPro.dll (IE7Pro.com) O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - File not found O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - File not found O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - File not found O2 - BHO: (WEB.DE Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - File not found O3 - HKLM\..\Toolbar: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - File not found O3 - HKLM\..\Toolbar: (WEB.DE Toolbar) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\IEPro\IEProRecorder.dll () O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\User_ON_C\..\Toolbar\WebBrowser: (no name) - {6F4F95AF-1647-4B72-A632-055405455423} - No CLSID value found. O3 - HKU\User_ON_C\..\Toolbar\WebBrowser: (WEB.DE Toolbar) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3 - HKU\User_ON_C\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\IEPro\IEProRecorder.dll () O3 - HKU\User_ON_C\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName}) O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ATICustomerCare] C:\Programme\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [ATIModeChange] C:\WINXP\System32\Ati2mdxx.exe (ATI Technologies, Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [bC4lJzJAS4eHdGa] C:\Dokumente und Einstellungen\User\Anwendungsdaten\w6j6rt45jtuhdre5.exe () O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] File not found O4 - HKU\User_ON_C..\Run: [] File not found O4 - HKU\User_ON_C..\Run: [1und1Dispatcher] C:\Programme\1und1Softwareaktualisierung\SchedDispatcher.exe (1&1 Mail & Media GmbH) O4 - HKU\User_ON_C..\Run: [alxreo] File not found O4 - HKU\User_ON_C..\Run: [bC4lJzJAS4eHdGa] C:\Dokumente und Einstellungen\User\Anwendungsdaten\w6j6rt45jtuhdre5.exe () O4 - HKU\User_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\User_ON_C..\Run: [BitTorrent DNA] C:\Programme\DNA\btdna.exe (BitTorrent, Inc.) O4 - HKU\User_ON_C..\Run: [DAEMON Tools Lite] C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\User_ON_C..\Run: [Voobly] File not found O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINXP\system32\tscupgrd.exe (Microsoft Corporation) O4 - HKU\LocalService_ON_C..\RunOnce: [nltide_2] File not found O4 - HKU\NetworkService_ON_C..\RunOnce: [nltide_2] File not found O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\NETGEAR WPN111 Smart Wizard.lnk = C:\Programme\NETGEAR\WPN111\WPN111.exe (NETGEAR) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1 O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\User\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to iPhone Converter - C:\Dokumente und Einstellungen\User\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetoiphoneconverter.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\User\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Programme\IEPro\IEPro.dll (IE7Pro.com) O9 - Extra 'Tools' menuitem : IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Programme\IEPro\IEPro.dll (IE7Pro.com) O9 - Extra Button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Programme\IEPro\IEPro.dll (IE7Pro.com) O9 - Extra 'Tools' menuitem : IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Programme\IEPro\IEPro.dll (IE7Pro.com) O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_26.dll (Sun Microsystems, Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - File not found O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINXP\system32\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINXP\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINXP\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop Components:1 (Aqua Real) - 7db39a0d-580f-4be9-9195-8bfcd226f6c2 O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/02/11 14:01:20 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008/12/16 10:18:26 | 000,000,126 | ---- | M] () - E:\Autorun.inf -- [ FAT32 ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{49cf8b72-c246-11de-a8cb-00146c0a6960}\Shell - "" = AutoRun O33 - MountPoints2\{49cf8b72-c246-11de-a8cb-00146c0a6960}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{49cf8b72-c246-11de-a8cb-00146c0a6960}\Shell\AutoRun\command - "" = G:\autorun.exe O33 - MountPoints2\{5492c8cf-821a-11e0-ad96-00146c0a6960}\Shell - "" = AutoRun O33 - MountPoints2\{5492c8cf-821a-11e0-ad96-00146c0a6960}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{5492c8cf-821a-11e0-ad96-00146c0a6960}\Shell\AutoRun\command - "" = H:\setup\rsrc\Autorun.exe O33 - MountPoints2\{5492c8cf-821a-11e0-ad96-00146c0a6960}\Shell\dinstall\command - "" = H:\Directx\dxsetup.exe O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell - "" = AutoRun O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell\adobe\command - "" = G:\goodies\ar405eng.exe O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell\AutoRun\command - "" = G:\aocsetup.exe /autorun O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell\log\command - "" = G:\goodies\machine\machine.exe -l O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell\machine\command - "" = G:\goodies\machine\machine.exe O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell\setup\command - "" = G:\aocsetup.exe /autorun O33 - MountPoints2\{58ec6d62-3222-11e0-acbd-00146c0a6960}\Shell\zone\command - "" = G:\goodies\mszone\zonea660.exe O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell - "" = AutoRun O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell\adobe\command - "" = H:\goodies\ar405eng.exe O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell\AutoRun\command - "" = H:\aocsetup.exe /autorun O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell\log\command - "" = H:\goodies\machine\machine.exe -l O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell\machine\command - "" = H:\goodies\machine\machine.exe O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell\setup\command - "" = H:\aocsetup.exe /autorun O33 - MountPoints2\{58ec6d63-3222-11e0-acbd-00146c0a6960}\Shell\zone\command - "" = H:\goodies\mszone\zonea660.exe O33 - MountPoints2\{5f7211ac-a2dd-11df-ab62-00146c0a6960}\Shell\AutoRun\command - "" = G:\InstallTomTomHOME.exe O33 - MountPoints2\{7cad330c-0426-11de-85a4-001d608ff8d6}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\svsys.exe O33 - MountPoints2\{7cad330c-0426-11de-85a4-001d608ff8d6}\Shell\open\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\svsys.exe O33 - MountPoints2\{9e5f9524-3473-11e0-accb-00146c0a6960}\Shell - "" = AutoRun O33 - MountPoints2\{9e5f9524-3473-11e0-accb-00146c0a6960}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{9e5f9524-3473-11e0-accb-00146c0a6960}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe O33 - MountPoints2\{9e5f9524-3473-11e0-accb-00146c0a6960}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell - "" = AutoRun O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell\adobe\command - "" = G:\goodies\ar405eng.exe O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell\AutoRun\command - "" = G:\aocsetup.exe /autorun O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell\log\command - "" = G:\goodies\machine\machine.exe -l O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell\machine\command - "" = G:\goodies\machine\machine.exe O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell\setup\command - "" = G:\aocsetup.exe /autorun O33 - MountPoints2\{d963aa78-32ef-11e0-acc3-00146c0a6960}\Shell\zone\command - "" = G:\goodies\mszone\zonea660.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINXP\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINXP\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINXP\system32\Rundll32.exe C:\WINXP\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate ActiveX: {foMqgAqV-VEhY-fWHG-wpMj-OSQWcWzshdP0} - ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINXP\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINXP\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE ActiveX: Microsoft Base Smart Card Crypto Provider Package - NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpReg: NokiaMServer - hkey= - key= - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia) MsConfig - StartUpReg: NokiaOviSuite2 - hkey= - key= - C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia) MsConfig - StartUpReg: PC Suite Tray - hkey= - key= - C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia) MsConfig - StartUpReg: RGSC - hkey= - key= - C:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe (Take-Two Interactive Software, Inc.) MsConfig - StartUpReg: swg - hkey= - key= - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) MsConfig - StartUpReg: TomTomHOME.exe - hkey= - key= - C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) MsConfig - StartUpReg: VX3000 - hkey= - key= - C:\WINXP\vVX3000.exe (Microsoft Corporation) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 ========== Files/Folders - Created Within 30 Days ========== [2012/06/27 16:22:49 | 000,000,000 | ---D | C] -- C:\WINXP\Prefetch [2012/06/27 16:17:52 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\winzm.ime [2012/06/27 16:17:51 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\winsp.ime [2012/06/27 16:17:51 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\winpy.ime [2012/06/27 16:17:51 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\wingb.ime [2012/06/27 16:17:51 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\winime.ime [2012/06/27 16:17:50 | 000,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\winar30.ime [2012/06/27 16:17:50 | 000,041,600 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\weitekp9.dll [2012/06/27 16:17:50 | 000,031,360 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\weitekp9.sys [2012/06/27 16:17:49 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\wam51.dll [2012/06/27 16:17:49 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\wamreg51.dll [2012/06/27 16:17:49 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\wamps51.dll [2012/06/27 16:17:48 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\w3svc.dll [2012/06/27 16:17:48 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\w3ext.dll [2012/06/27 16:17:48 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\w3svapi.dll [2012/06/27 16:17:48 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\w3ctrs51.dll [2012/06/27 16:17:47 | 000,086,073 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\voicesub.dll [2012/06/27 16:17:47 | 000,048,256 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\w32.dll [2012/06/27 16:17:46 | 000,426,041 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\voicepad.dll [2012/06/27 16:17:41 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\uniime.dll [2012/06/27 16:17:40 | 000,103,936 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\uihelper.dll [2012/06/27 16:17:40 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\unicdime.ime [2012/06/27 16:17:39 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tsprof.exe [2012/06/27 16:17:38 | 000,455,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tintsetp.exe [2012/06/27 16:17:38 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tintlphr.exe [2012/06/27 16:17:38 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tools.dll [2012/06/27 16:17:38 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tmigrate.dll [2012/06/27 16:17:37 | 000,571,392 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tintlgnt.ime [2012/06/27 16:17:37 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\thawbrkr.dll [2012/06/27 16:17:37 | 000,021,896 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tdipx.sys [2012/06/27 16:17:37 | 000,019,464 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tdspx.sys [2012/06/27 16:17:37 | 000,013,192 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tdasync.sys [2012/06/27 16:17:35 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\svcext51.dll [2012/06/27 16:17:35 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\status.dll [2012/06/27 16:17:34 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\srusbusd.dll [2012/06/27 16:17:34 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sspifilt.dll [2012/06/27 16:17:34 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ssinc51.dll [2012/06/27 16:17:33 | 000,143,422 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\softkey.dll [2012/06/27 16:17:32 | 000,358,400 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmpincl.dll [2012/06/27 16:17:32 | 000,259,072 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmpcl.dll [2012/06/27 16:17:32 | 000,188,416 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmpsmir.dll [2012/06/27 16:17:32 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmpthrd.dll [2012/06/27 16:17:32 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmpstup.dll [2012/06/27 16:17:32 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmptrap.exe [2012/06/27 16:17:32 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_snprfdll.dll [2012/06/27 16:17:32 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmpmib.dll [2012/06/27 16:17:31 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\smtpsvc.dll [2012/06/27 16:17:31 | 000,236,544 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\smi2smir.exe [2012/06/27 16:17:31 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\snmp.exe [2012/06/27 16:17:31 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\smierrsm.dll [2012/06/27 16:17:31 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_smtpctrs.dll [2012/06/27 16:17:31 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\smimsgif.dll [2012/06/27 16:17:31 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\smierrsy.dll [2012/06/27 16:17:30 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm9aw.dll [2012/06/27 16:17:30 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\smb6w.dll [2012/06/27 16:17:30 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sma3w.dll [2012/06/27 16:17:30 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm87w.dll [2012/06/27 16:17:30 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm81w.dll [2012/06/27 16:17:30 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm8cw.dll [2012/06/27 16:17:30 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm93w.dll [2012/06/27 16:17:30 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm92w.dll [2012/06/27 16:17:30 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm90w.dll [2012/06/27 16:17:30 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm8dw.dll [2012/06/27 16:17:30 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm8aw.dll [2012/06/27 16:17:30 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm89w.dll [2012/06/27 16:17:29 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\sm59w.dll [2012/06/27 16:17:27 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\simptcp.dll [2012/06/27 16:17:23 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_seos.dll [2012/06/27 16:17:22 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_scripto.dll [2012/06/27 16:17:21 | 000,081,408 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINXP\System32\dllcache\rwia330.dll [2012/06/27 16:17:20 | 000,081,408 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINXP\System32\dllcache\rwia001.dll [2012/06/27 16:17:20 | 000,026,624 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINXP\System32\dllcache\rw330ext.dll [2012/06/27 16:17:20 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\rw001ext.dll [2012/06/27 16:17:20 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\rpcref.dll [2012/06/27 16:17:19 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\romanime.ime [2012/06/27 16:17:18 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_regtrace.exe [2012/06/27 16:17:18 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\register.exe [2012/06/27 16:17:17 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\quick.ime [2012/06/27 16:17:17 | 000,020,736 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ramdisk.sys [2012/06/27 16:17:17 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\quser.exe [2012/06/27 16:17:16 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\query.exe [2012/06/27 16:17:16 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pwsdata.dll [2012/06/27 16:17:14 | 000,482,304 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pintlgnt.ime [2012/06/27 16:17:14 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pmxviceo.dll [2012/06/27 16:17:14 | 000,070,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pintlphr.exe [2012/06/27 16:17:14 | 000,067,584 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pmigrate.dll [2012/06/27 16:17:14 | 000,053,760 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pintlcsd.dll [2012/06/27 16:17:14 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pmxmcro.dll [2012/06/27 16:17:14 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pmxgl.dll [2012/06/27 16:17:13 | 000,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\phon.ime [2012/06/27 16:17:13 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\permchk.dll [2012/06/27 16:17:12 | 000,036,927 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\padrs411.dll [2012/06/27 16:17:12 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\pagecnt.dll [2012/06/27 16:17:12 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\padrs404.dll [2012/06/27 16:17:12 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\padrs804.dll [2012/06/27 16:17:12 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\padrs412.dll [2012/06/27 16:17:08 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\nsepm.dll [2012/06/27 16:17:08 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_ntfsdrv.dll [2012/06/27 16:17:07 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\nextlink.dll [2012/06/27 16:17:03 | 000,229,439 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\multibox.dll [2012/06/27 16:17:03 | 000,111,104 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\mtstocom.exe [2012/06/27 16:16:59 | 001,875,968 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\msir3jp.lex [2012/06/27 16:16:59 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\msir3jp.dll [2012/06/27 16:16:52 | 000,092,416 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\mga.sys [2012/06/27 16:16:52 | 000,092,032 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\mga.dll [2012/06/27 16:16:52 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\metada51.dll [2012/06/27 16:16:52 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\migregdb.exe [2012/06/27 16:16:51 | 000,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\md5filt.dll [2012/06/27 16:16:51 | 000,026,624 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\mdsync.dll [2012/06/27 16:16:50 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_mailmsg.dll [2012/06/27 16:16:50 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\lpdsvc.dll [2012/06/27 16:16:50 | 000,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\logscrpt.dll [2012/06/27 16:16:50 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\lprmon.dll [2012/06/27 16:16:50 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\lonsint.dll [2012/06/27 16:16:49 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\lmmib2.dll [2012/06/27 16:16:47 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\korwbrkr.dll [2012/06/27 16:16:46 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdth3.dll [2012/06/27 16:16:46 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdth2.dll [2012/06/27 16:16:46 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdvntc.dll [2012/06/27 16:16:46 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdusa.dll [2012/06/27 16:16:46 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdurdu.dll [2012/06/27 16:16:46 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdth1.dll [2012/06/27 16:16:46 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdth0.dll [2012/06/27 16:16:45 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdnecat.dll [2012/06/27 16:16:45 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdnecnt.dll [2012/06/27 16:16:45 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdnec95.dll [2012/06/27 16:16:45 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdlk41a.dll [2012/06/27 16:16:45 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdlk41j.dll [2012/06/27 16:16:45 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdsyr2.dll [2012/06/27 16:16:45 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdsyr1.dll [2012/06/27 16:16:44 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdibm02.dll [2012/06/27 16:16:44 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdinpun.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdintel.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdintam.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdinmar.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdinkan.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdinhin.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdinguj.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdindev.dll [2012/06/27 16:16:44 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdheb.dll [2012/06/27 16:16:43 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdax2.dll [2012/06/27 16:16:43 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdfa.dll [2012/06/27 16:16:43 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbddiv2.dll [2012/06/27 16:16:43 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbddiv1.dll [2012/06/27 16:16:43 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbda3.dll [2012/06/27 16:16:43 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbda2.dll [2012/06/27 16:16:43 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdgeo.dll [2012/06/27 16:16:43 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdarmw.dll [2012/06/27 16:16:43 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbdarme.dll [2012/06/27 16:16:42 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iscomlog.dll [2012/06/27 16:16:42 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\jupiw.dll [2012/06/27 16:16:42 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iwrps.dll [2012/06/27 16:16:42 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\isapips.dll [2012/06/27 16:16:42 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbd106n.dll [2012/06/27 16:16:42 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbd101a.dll [2012/06/27 16:16:42 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbd101.dll [2012/06/27 16:16:42 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\kbda1.dll [2012/06/27 16:16:40 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iprip.dll [2012/06/27 16:16:39 | 000,471,102 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imskdic.dll [2012/06/27 16:16:39 | 000,315,452 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imskf.dll [2012/06/27 16:16:39 | 000,257,024 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\infocomm.dll [2012/06/27 16:16:39 | 000,015,872 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\inetin51.exe [2012/06/27 16:16:39 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\infoctrs.dll [2012/06/27 16:16:38 | 000,274,489 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjputyc.dll [2012/06/27 16:16:38 | 000,262,200 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjputy.exe [2012/06/27 16:16:38 | 000,233,527 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjprw.exe [2012/06/27 16:16:38 | 000,208,952 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpmig.exe [2012/06/27 16:16:38 | 000,155,705 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpdsvr.exe [2012/06/27 16:16:38 | 000,102,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imlang.dll [2012/06/27 16:16:38 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imkrinst.exe [2012/06/27 16:16:38 | 000,045,109 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpuex.exe [2012/06/27 16:16:37 | 000,811,064 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjp81k.dll [2012/06/27 16:16:37 | 000,716,856 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpcus.dll [2012/06/27 16:16:37 | 000,368,696 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpcic.dll [2012/06/27 16:16:37 | 000,340,023 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjp81.ime [2012/06/27 16:16:37 | 000,311,359 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imepadsv.exe [2012/06/27 16:16:37 | 000,307,257 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpdct.exe [2012/06/27 16:16:37 | 000,102,463 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imepadsm.dll [2012/06/27 16:16:37 | 000,081,976 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpdct.dll [2012/06/27 16:16:37 | 000,057,398 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imjpdadm.exe [2012/06/27 16:16:36 | 000,106,496 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imekrcic.dll [2012/06/27 16:16:36 | 000,094,720 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imekr61.ime [2012/06/27 16:16:36 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imekrmbx.dll [2012/06/27 16:16:36 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iislog51.dll [2012/06/27 16:16:36 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisclex4.dll [2012/06/27 16:16:36 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\imekrmig.exe [2012/06/27 16:16:36 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iiscrmap.dll [2012/06/27 16:16:36 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisfecnv.dll [2012/06/27 16:16:36 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iissync.exe [2012/06/27 16:16:36 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iismui.dll [2012/06/27 16:16:35 | 000,145,408 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iische51.dll [2012/06/27 16:16:35 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisadmin.dll [2012/06/27 16:16:32 | 010,129,408 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\hwxkor.dll [2012/06/27 16:16:23 | 010,096,640 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\hwxcht.dll [2012/06/27 16:16:23 | 000,268,288 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\httpext.dll [2012/06/27 16:16:23 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\httpod51.dll [2012/06/27 16:16:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\httpmb51.dll [2012/06/27 16:16:22 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\hostmib.dll [2012/06/27 16:16:21 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\hanjadic.dll [2012/06/27 16:16:20 | 000,032,256 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\gzip.dll [2012/06/27 16:16:19 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsxp32.dll [2012/06/27 16:16:19 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxswzrd.dll [2012/06/27 16:16:18 | 000,563,200 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsst.dll [2012/06/27 16:16:18 | 000,397,312 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxstiff.dll [2012/06/27 16:16:18 | 000,268,800 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxssvc.exe [2012/06/27 16:16:18 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxst30.dll [2012/06/27 16:16:18 | 000,155,648 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsui.dll [2012/06/27 16:16:18 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsevent.dll [2012/06/27 16:16:18 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsroute.dll [2012/06/27 16:16:18 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsmon.dll [2012/06/27 16:16:18 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsext32.dll [2012/06/27 16:16:18 | 000,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxssend.exe [2012/06/27 16:16:18 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsperf.dll [2012/06/27 16:16:18 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsres.dll [2012/06/27 16:16:17 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsapi.dll [2012/06/27 16:16:17 | 000,285,184 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxscomex.dll [2012/06/27 16:16:17 | 000,235,520 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxscover.exe [2012/06/27 16:16:17 | 000,143,360 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsclnt.exe [2012/06/27 16:16:17 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsclntr.dll [2012/06/27 16:16:17 | 000,125,952 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ftpsv251.dll [2012/06/27 16:16:17 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxscfgwz.dll [2012/06/27 16:16:17 | 000,072,192 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxscom.dll [2012/06/27 16:16:17 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fxsdrv.dll [2012/06/27 16:16:17 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ftpctrs2.dll [2012/06/27 16:16:17 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ftpmib.dll [2012/06/27 16:16:16 | 000,024,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fpadmcgi.exe [2012/06/27 16:16:16 | 000,020,541 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fpadmdll.dll [2012/06/27 16:16:16 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ftlx041e.dll [2012/06/27 16:16:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_fcachdll.dll [2012/06/27 16:16:15 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\flattemp.exe [2012/06/27 16:16:15 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\f3ahvoas.dll [2012/06/27 16:16:14 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\evntagnt.dll [2012/06/27 16:16:14 | 000,094,208 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\evntwin.exe [2012/06/27 16:16:14 | 000,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINXP\System32\dllcache\esuimgd.dll [2012/06/27 16:16:14 | 000,045,568 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINXP\System32\dllcache\esunid.dll [2012/06/27 16:16:14 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\evntcmd.exe [2012/06/27 16:16:14 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\et4000.sys [2012/06/27 16:16:14 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\exstrace.dll [2012/06/27 16:16:13 | 000,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINXP\System32\dllcache\esucmd.dll [2012/06/27 16:16:09 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\dayi.ime [2012/06/27 16:16:08 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\davcdata.exe [2012/06/27 16:16:07 | 000,057,399 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\cplexe.exe [2012/06/27 16:16:07 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\convlog.exe [2012/06/27 16:16:07 | 000,020,480 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\counters.dll [2012/06/27 16:16:07 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\cprofile.exe [2012/06/27 16:16:06 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\controt.dll [2012/06/27 16:16:06 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\compfilt.dll [2012/06/27 16:16:05 | 000,480,256 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\cintsetp.exe [2012/06/27 16:16:05 | 000,198,656 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\cintime.dll [2012/06/27 16:16:05 | 000,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\cintlgnt.ime [2012/06/27 16:16:04 | 001,677,824 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chsbrkr.dll [2012/06/27 16:16:04 | 000,838,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chtbrkr.dll [2012/06/27 16:16:04 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chtmbx.dll [2012/06/27 16:16:04 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chtskdic.dll [2012/06/27 16:16:03 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chajei.ime [2012/06/27 16:16:03 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chgport.exe [2012/06/27 16:16:03 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chgusr.exe [2012/06/27 16:16:03 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\chglogon.exe [2012/06/27 16:16:03 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\change.exe [2012/06/27 16:16:01 | 000,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINXP\System32\dllcache\cap7146.sys [2012/06/27 16:15:57 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\browscap.dll [2012/06/27 16:15:56 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\authfilt.dll [2012/06/27 16:15:49 | 000,375,296 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\asp51.dll [2012/06/27 16:15:49 | 000,334,848 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\aqueue.dll [2012/06/27 16:15:49 | 000,110,080 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\appconf.dll [2012/06/27 16:15:49 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_aqadmin.dll [2012/06/27 16:15:49 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\asptxn.dll [2012/06/27 16:15:49 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\aspperf.dll [2012/06/27 16:15:47 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\agt0804.dll [2012/06/27 16:15:47 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\agt0412.dll [2012/06/27 16:15:47 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\agt0411.dll [2012/06/27 16:15:47 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\agt040d.dll [2012/06/27 16:15:47 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\agt0404.dll [2012/06/27 16:15:47 | 000,019,456 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\agt0401.dll [2012/06/27 16:15:42 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\adrot.dll [2012/06/27 16:15:42 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\EXCH_adsiisex.dll [2012/06/27 16:15:41 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\admexs.dll [2012/06/27 16:15:41 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\admxprox.dll [2012/06/27 16:15:38 | 000,032,827 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tcptest.exe [2012/06/27 16:15:38 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\tcptsat.dll [2012/06/27 16:15:38 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\staxmem.dll [2012/06/27 16:15:38 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\wamregps.dll [2012/06/27 16:15:37 | 000,020,536 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\shtml.dll [2012/06/27 16:15:37 | 000,016,437 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\shtml.exe [2012/06/27 16:15:34 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\logui.ocx [2012/06/27 16:15:33 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\inetmgr.dll [2012/06/27 16:15:33 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisui.dll [2012/06/27 16:15:33 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisrtl.dll [2012/06/27 16:15:33 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\isatq.dll [2012/06/27 16:15:33 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\inetsloc.dll [2012/06/27 16:15:33 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\infoadmn.dll [2012/06/27 16:15:33 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\inetmgr.exe [2012/06/27 16:15:32 | 000,217,088 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fpmmcsat.dll [2012/06/27 16:15:32 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisext51.dll [2012/06/27 16:15:32 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iismap.dll [2012/06/27 16:15:32 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisrstas.exe [2012/06/27 16:15:32 | 000,020,538 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fpremadm.exe [2012/06/27 16:15:32 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisreset.exe [2012/06/27 16:15:32 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ftpsapi2.dll [2012/06/27 16:15:32 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\iisrstap.dll [2012/06/27 16:15:31 | 000,876,653 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4awel.dll [2012/06/27 16:15:31 | 000,598,071 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fpmmc.dll [2012/06/27 16:15:31 | 000,188,494 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fpcount.exe [2012/06/27 16:15:31 | 000,109,328 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp98swin.exe [2012/06/27 16:15:31 | 000,102,509 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4atxt.dll [2012/06/27 16:15:31 | 000,049,212 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4awebs.dll [2012/06/27 16:15:31 | 000,041,020 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4avnb.dll [2012/06/27 16:15:31 | 000,032,826 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4avss.dll [2012/06/27 16:15:31 | 000,020,541 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fpexedll.dll [2012/06/27 16:15:31 | 000,014,608 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp98sadm.exe [2012/06/27 16:15:30 | 000,184,435 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4amsft.dll [2012/06/27 16:15:30 | 000,147,513 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4apws.dll [2012/06/27 16:15:30 | 000,082,035 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4anscp.dll [2012/06/27 16:15:30 | 000,049,210 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\fp4areg.dll [2012/06/27 16:15:30 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\coadmin.dll [2012/06/27 16:15:29 | 000,282,624 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\certwiz.ocx [2012/06/27 16:15:29 | 000,188,480 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\cfgwiz.exe [2012/06/27 16:15:29 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\certmap.ocx [2012/06/27 16:15:29 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\cnfgprts.ocx [2012/06/27 16:15:29 | 000,020,540 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\author.dll [2012/06/27 16:15:29 | 000,016,439 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\author.exe [2012/06/27 16:15:28 | 000,290,816 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\adsiis51.dll [2012/06/27 16:15:28 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\admwprox.dll [2012/06/27 16:15:28 | 000,016,439 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\admin.exe [2012/06/27 16:15:27 | 000,020,540 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\admin.dll [2012/06/27 16:13:58 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\isignup.exe [2012/06/27 15:42:04 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\irclass.dll [2012/06/27 15:42:04 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\irclass.dll [2012/06/27 15:42:03 | 000,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINXP\System32\spxcoins.dll [2012/06/27 15:42:03 | 000,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINXP\System32\dllcache\spxcoins.dll [2012/06/25 06:48:15 | 000,000,000 | ---D | C] -- C:\Programme\Adobe [2012/06/25 06:47:55 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012/06/23 13:01:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Mozilla [2012/06/23 13:01:20 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service [2012/06/22 10:02:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Mozilla [2012/06/22 10:02:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Mozilla [2012/06/01 14:36:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\FalloutNV [15 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ] [1 D:\*.tmp files -> D:\*.tmp -> ] [1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/06/29 17:32:00 | 000,000,412 | -H-- | M] () -- C:\WINXP\tasks\User_Feed_Synchronization-{BE05D94E-DF19-4C86-98AA-740F46DE4F23}.job [2012/06/29 17:32:00 | 000,000,224 | ---- | M] () -- C:\WINXP\tasks\Scheduled Update for Ask Toolbar.job [2012/06/29 17:27:00 | 000,000,880 | ---- | M] () -- C:\WINXP\tasks\Adobe Flash Player Updater.job [2012/06/29 17:19:11 | 000,001,090 | ---- | M] () -- C:\WINXP\tasks\GoogleUpdateTaskMachineUA.job [2012/06/29 16:59:06 | 000,013,868 | ---- | M] () -- C:\WINXP\System32\wpa.dbl [2012/06/29 16:59:05 | 000,001,086 | ---- | M] () -- C:\WINXP\tasks\GoogleUpdateTaskMachineCore.job [2012/06/29 16:58:58 | 000,002,048 | --S- | M] () -- C:\WINXP\bootstat.dat [2012/06/27 16:48:50 | 000,000,759 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Internet Explorer Browser starten.lnk [2012/06/27 16:48:29 | 000,013,868 | ---- | M] () -- C:\WINXP\System32\wpa.bak [2012/06/27 16:23:59 | 000,522,310 | ---- | M] () -- C:\WINXP\System32\perfh007.dat [2012/06/27 16:23:59 | 000,498,030 | ---- | M] () -- C:\WINXP\System32\perfh009.dat [2012/06/27 16:23:59 | 000,103,120 | ---- | M] () -- C:\WINXP\System32\perfc007.dat [2012/06/27 16:23:59 | 000,086,130 | ---- | M] () -- C:\WINXP\System32\perfc009.dat [2012/06/27 16:22:26 | 000,287,704 | ---- | M] () -- C:\WINXP\System32\FNTCACHE.DAT [2012/06/27 16:20:17 | 000,000,288 | ---- | M] () -- C:\WINXP\System32\$winnt$.inf [2012/06/27 16:15:15 | 000,000,000 | R--D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Verwaltung [2012/06/27 16:15:12 | 000,316,640 | ---- | M] () -- C:\WINXP\WMSysPr9.prx [2012/06/27 16:15:12 | 000,023,392 | ---- | M] () -- C:\WINXP\System32\nscompat.tlb [2012/06/27 16:15:12 | 000,016,832 | ---- | M] () -- C:\WINXP\System32\amcompat.tlb [2012/06/27 16:15:02 | 000,004,073 | ---- | M] () -- C:\WINXP\ODBCINST.INI [2012/06/27 16:14:08 | 000,000,758 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Movie Maker.lnk [2012/06/27 16:12:47 | 000,000,621 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Messenger.lnk [2012/06/27 16:12:45 | 000,022,880 | ---- | M] () -- C:\WINXP\System32\emptyregdb.dat [2012/06/27 16:11:23 | 000,000,219 | -HS- | M] () -- C:\boot.ini [2012/06/27 14:45:50 | 000,212,480 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\w6j6rt45jtuhdre5.exe [2012/06/27 06:24:00 | 000,001,044 | ---- | M] () -- C:\WINXP\tasks\Google Software Updater.job [2012/06/25 06:48:57 | 000,002,333 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader 9.lnk [2012/06/24 18:02:53 | 000,000,134 | ---- | M] () -- C:\Dokumente und Einstellungen\User\default.pls [2012/06/24 18:02:52 | 000,000,116 | ---- | M] () -- C:\WINXP\NeroDigital.ini [2012/06/23 02:27:28 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINXP\System32\FlashPlayerApp.exe [2012/06/23 02:27:28 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINXP\System32\FlashPlayerCPLApp.cpl [2012/06/22 11:34:07 | 000,000,276 | ---- | M] () -- C:\WINXP\tasks\AppleSoftwareUpdate.job [2012/06/22 07:00:18 | 000,055,656 | ---- | M] () -- C:\WINXP\setupapi.old [2012/06/20 07:18:17 | 000,001,566 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Desktop\Mozilla Firefox.lnk [2012/06/13 14:37:28 | 000,001,374 | ---- | M] () -- C:\WINXP\imsins.BAK [2012/06/02 09:19:38 | 000,015,896 | ---- | M] (Microsoft Corporation) -- C:\WINXP\System32\wuapi.dll.mui [2012/06/02 09:19:34 | 000,045,080 | ---- | M] (Microsoft Corporation) -- C:\WINXP\System32\wups2.dll [2012/06/02 09:19:28 | 000,023,576 | ---- | M] (Microsoft Corporation) -- C:\WINXP\System32\wucltui.dll.mui [2012/06/02 09:18:58 | 000,275,696 | ---- | M] (Microsoft Corporation) -- C:\WINXP\System32\mucltui.dll [2012/06/02 09:18:58 | 000,018,160 | ---- | M] (Microsoft Corporation) -- C:\WINXP\System32\mucltui.dll.mui [15 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ] [1 D:\*.tmp files -> D:\*.tmp -> ] [1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/06/27 16:17:14 | 000,175,104 | ---- | C] () -- C:\WINXP\System32\dllcache\pintlcsa.dll [2012/06/27 16:16:47 | 001,158,818 | ---- | C] () -- C:\WINXP\System32\dllcache\korwbrkr.lex [2012/06/27 16:16:39 | 000,059,392 | ---- | C] () -- C:\WINXP\System32\dllcache\imscinst.exe [2012/06/27 16:16:38 | 000,196,665 | ---- | C] () -- C:\WINXP\System32\dllcache\imjpinst.exe [2012/06/27 16:16:36 | 000,134,339 | ---- | C] () -- C:\WINXP\System32\dllcache\imekr.lex [2012/06/27 16:16:26 | 013,463,552 | ---- | C] () -- C:\WINXP\System32\dllcache\hwxjpn.dll [2012/06/27 16:16:20 | 000,108,827 | ---- | C] () -- C:\WINXP\System32\dllcache\hanja.lex [2012/06/27 16:16:16 | 000,094,208 | ---- | C] () -- C:\WINXP\System32\dllcache\fpencode.dll [2012/06/27 16:16:04 | 000,173,568 | ---- | C] () -- C:\WINXP\System32\dllcache\chtskf.dll [2012/06/27 16:12:47 | 000,000,621 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows Messenger.lnk [2012/06/27 15:41:53 | 000,141,702 | ---- | C] () -- C:\WINXP\System32\dllcache\netfx.cat [2012/06/27 15:41:53 | 000,031,965 | ---- | C] () -- C:\WINXP\System32\dllcache\mediactr.cat [2012/06/27 15:41:53 | 000,018,989 | ---- | C] () -- C:\WINXP\System32\dllcache\msn7.cat [2012/06/27 15:41:53 | 000,011,651 | ---- | C] () -- C:\WINXP\System32\dllcache\msn9.cat [2012/06/27 15:41:52 | 001,899,936 | ---- | C] () -- C:\WINXP\System32\dllcache\NT5.CAT [2012/06/27 15:41:52 | 001,014,663 | ---- | C] () -- C:\WINXP\System32\dllcache\SP2.CAT [2012/06/27 15:41:52 | 000,817,199 | ---- | C] () -- C:\WINXP\System32\dllcache\NT5IIS.CAT [2012/06/27 15:41:52 | 000,618,406 | ---- | C] () -- C:\WINXP\System32\dllcache\NT5INF.CAT [2012/06/27 15:41:52 | 000,399,645 | ---- | C] () -- C:\WINXP\System32\dllcache\MAPIMIG.CAT [2012/06/27 15:41:52 | 000,103,124 | ---- | C] () -- C:\WINXP\System32\dllcache\tabletpc.cat [2012/06/27 15:41:52 | 000,041,270 | ---- | C] () -- C:\WINXP\System32\dllcache\MW770.CAT [2012/06/27 15:41:52 | 000,030,983 | ---- | C] () -- C:\WINXP\System32\dllcache\FP4.CAT [2012/06/27 15:41:52 | 000,014,043 | ---- | C] () -- C:\WINXP\System32\dllcache\IMS.CAT [2012/06/27 15:41:52 | 000,013,472 | ---- | C] () -- C:\WINXP\System32\dllcache\HPCRDP.CAT [2012/06/27 15:41:52 | 000,009,581 | ---- | C] () -- C:\WINXP\System32\dllcache\MSMSGS.CAT [2012/06/27 15:41:52 | 000,008,574 | ---- | C] () -- C:\WINXP\System32\dllcache\IASNT4.CAT [2012/06/27 15:41:52 | 000,007,382 | ---- | C] () -- C:\WINXP\System32\dllcache\OEMBIOS.CAT [2012/06/27 15:41:52 | 000,007,334 | ---- | C] () -- C:\WINXP\System32\dllcache\wmerrenu.cat [2012/06/27 15:41:52 | 000,007,245 | ---- | C] () -- C:\WINXP\System32\dllcache\MSTSWEB.CAT [2012/06/27 14:45:51 | 000,212,480 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\w6j6rt45jtuhdre5.exe [2012/06/25 06:48:24 | 000,002,333 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader 9.lnk [2012/06/20 07:18:17 | 000,001,566 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Desktop\Mozilla Firefox.lnk [2012/04/09 04:58:59 | 000,534,892 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1060284298-412668190-682003330-1003-0.dat [2012/04/09 04:58:58 | 000,306,550 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat [2011/12/05 17:04:00 | 000,059,904 | ---- | C] () -- C:\WINXP\System32\OpenVideo.dll [2011/12/05 17:03:52 | 000,054,784 | ---- | C] () -- C:\WINXP\System32\OVDecode.dll [2011/11/26 17:03:46 | 000,000,020 | ---- | C] () -- C:\WINXP\popcinfot.dat [2011/11/26 17:03:46 | 000,000,000 | ---- | C] () -- C:\WINXP\popcreg.dat [2011/09/28 11:44:14 | 000,179,271 | ---- | C] () -- C:\WINXP\System32\xlive.dll.cat [2011/05/19 09:26:09 | 000,000,248 | ---- | C] () -- C:\WINXP\RomeTW.ini [2011/01/24 08:44:13 | 000,010,747 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TheHunterSettings_live.bin [2011/01/24 08:41:08 | 000,000,043 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TheHunterSettings_live.cfg [2010/08/21 10:25:59 | 000,000,035 | ---- | C] () -- C:\WINXP\SIERRA.INI [2010/03/09 03:10:09 | 000,887,724 | ---- | C] () -- C:\WINXP\System32\ativva6x.dat [2010/03/09 03:10:08 | 000,000,003 | ---- | C] () -- C:\WINXP\System32\ativva5x.dat [2010/03/08 15:34:05 | 002,434,856 | ---- | C] () -- C:\WINXP\System32\pbsvc_bc2.exe [2010/02/02 19:10:53 | 000,002,002 | ---- | C] () -- C:\WINXP\musi.ini [2010/02/01 12:56:06 | 000,000,054 | ---- | C] () -- C:\WINXP\Player.INI [2010/01/10 11:37:02 | 000,262,170 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\alxreo_nav.dat [2010/01/10 11:37:02 | 000,004,094 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\alxreo.dat [2010/01/10 11:37:02 | 000,002,696 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\alxreo_navps.dat [2009/11/22 09:52:54 | 000,155,624 | ---- | C] () -- C:\WINXP\System32\drivers\ar5523.bin [2009/11/01 18:44:21 | 000,010,243 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TheHunterSettings.bin [2009/10/28 08:43:14 | 000,554,496 | ---- | C] () -- C:\WINXP\System32\dvmsg.dll [2009/10/28 08:33:10 | 000,000,032 | ---- | C] () -- C:\WINXP\Menu.INI [2009/09/07 17:32:36 | 000,682,280 | ---- | C] () -- C:\WINXP\System32\pbsvc.exe [2009/08/23 06:38:36 | 000,000,103 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\AVSMediaPlayer.m3u [2009/08/23 06:38:15 | 000,524,288 | ---- | C] () -- C:\WINXP\System32\xvidcore.dll [2009/08/23 06:38:15 | 000,139,264 | ---- | C] () -- C:\WINXP\System32\xvidvfw.dll [2009/07/29 12:13:20 | 000,015,498 | ---- | C] () -- C:\WINXP\VX3000.ini [2009/07/16 08:38:53 | 000,165,376 | ---- | C] () -- C:\WINXP\System32\drivers\atksgt.sys [2009/07/16 08:38:53 | 000,018,048 | ---- | C] () -- C:\WINXP\System32\drivers\lirsgt.sys [2009/06/01 15:52:30 | 000,000,151 | ---- | C] () -- C:\WINXP\PhotoSnapViewer.INI [2009/05/13 13:07:02 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TheHunterSettings.cfg [2009/05/11 09:11:18 | 000,001,816 | ---- | C] () -- C:\WINXP\TSearch.INI [2009/04/20 14:30:52 | 000,001,984 | ---- | C] () -- C:\WINXP\System32\d3d9caps.dat [2009/03/22 12:28:34 | 000,000,134 | ---- | C] () -- C:\Dokumente und Einstellungen\User\default.pls [2009/02/28 13:51:25 | 000,139,488 | ---- | C] () -- C:\WINXP\System32\drivers\PnkBstrK.sys [2009/02/28 13:51:25 | 000,022,328 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\PnkBstrK.sys [2009/02/28 13:50:57 | 000,270,776 | ---- | C] () -- C:\WINXP\System32\PnkBstrB.exe [2009/02/28 13:50:56 | 000,075,136 | ---- | C] () -- C:\WINXP\System32\PnkBstrA.exe [2009/02/28 13:39:13 | 000,000,632 | ---- | C] () -- C:\WINXP\CoD.INI [2009/02/28 10:39:28 | 000,651,264 | ---- | C] () -- C:\WINXP\System32\libeay32.dll [2009/02/28 10:39:28 | 000,147,456 | ---- | C] () -- C:\WINXP\System32\ssleay32.dll [2009/02/28 10:39:28 | 000,110,592 | ---- | C] () -- C:\WINXP\System32\AegisI5.exe [2009/02/28 10:26:42 | 000,000,116 | ---- | C] () -- C:\WINXP\NeroDigital.ini [2009/02/28 10:26:41 | 000,047,616 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/02/26 20:28:42 | 000,003,948 | R--- | C] () -- C:\WINXP\System32\drivers\nvphy.bin [2009/02/11 14:05:02 | 000,014,129 | ---- | C] () -- C:\WINXP\Ascd_log.ini [2009/02/11 14:04:40 | 000,031,577 | ---- | C] () -- C:\WINXP\Ascd_tmp.ini [2009/02/11 14:04:40 | 000,005,810 | R--- | C] () -- C:\WINXP\System32\drivers\ASACPI.sys [2009/02/11 14:04:27 | 000,010,288 | ---- | C] () -- C:\WINXP\System32\drivers\ASUSHWIO.SYS [2009/02/11 14:02:11 | 000,002,048 | --S- | C] () -- C:\WINXP\bootstat.dat [2009/02/11 13:58:55 | 000,022,880 | ---- | C] () -- C:\WINXP\System32\emptyregdb.dat [2009/02/11 13:54:52 | 000,004,073 | ---- | C] () -- C:\WINXP\ODBCINST.INI [2009/02/11 13:52:09 | 000,287,704 | ---- | C] () -- C:\WINXP\System32\FNTCACHE.DAT [2009/02/11 07:39:51 | 000,000,000 | ---- | C] () -- C:\WINXP\nsreg.dat [2009/02/11 07:29:38 | 000,000,000 | ---- | C] () -- C:\WINXP\ativpsrm.bin [2009/02/11 07:23:38 | 000,593,920 | ---- | C] () -- C:\WINXP\System32\ati2sgag.exe [2009/02/11 07:23:30 | 003,107,788 | R--- | C] () -- C:\WINXP\System32\ativvaxx.dat [2009/02/11 07:23:30 | 000,608,507 | ---- | C] () -- C:\WINXP\System32\atiicdxx.dat [2009/02/11 07:05:36 | 000,000,276 | R--- | C] () -- C:\WINXP\System32\raidmgmt.ini [2009/02/11 07:05:35 | 000,000,804 | R--- | C] () -- C:\WINXP\System32\AsusSetup.ini [2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- C:\WINXP\System32\physxcudart_20.dll [2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelTraditionalChinese.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelSwedish.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelSpanish.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelSimplifiedChinese.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelPortugese.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelKorean.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelJapanese.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelGerman.dll [2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- C:\WINXP\System32\AgCPanelFrench.dll [2004/08/04 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINXP\System32\oembios.bin [2004/08/04 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINXP\System32\mlang.dat [2004/08/04 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINXP\System32\perfi009.dat [2004/08/04 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINXP\System32\perfi007.dat [2004/08/04 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINXP\System32\dssec.dat [2004/08/04 08:00:00 | 000,081,920 | ---- | C] () -- C:\WINXP\System32\ieencode.dll [2004/08/04 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINXP\System32\mib.bin [2004/08/04 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINXP\System32\perfd007.dat [2004/08/04 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINXP\System32\perfd009.dat [2004/08/04 08:00:00 | 000,027,440 | ---- | C] () -- C:\WINXP\System32\drivers\secdrv.sys [2004/08/04 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINXP\System32\secupd.dat [2004/08/04 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINXP\System32\oembios.dat [2004/08/04 08:00:00 | 000,001,788 | ---- | C] () -- C:\WINXP\System32\Dcache.bin [2004/08/03 20:57:34 | 000,363,520 | ---- | C] () -- C:\WINXP\System32\psisdecd.dll [2003/09/03 00:03:10 | 000,018,932 | ---- | C] () -- C:\WINXP\MSUMLT_B.INI [2003/09/03 00:03:06 | 000,026,471 | ---- | C] () -- C:\WINXP\MSTMON_B.INI [2003/09/02 09:00:58 | 000,001,484 | ---- | C] () -- C:\WINXP\MSD4___B.INI [2001/08/23 06:00:00 | 000,522,310 | ---- | C] () -- C:\WINXP\System32\perfh007.dat [2001/08/23 06:00:00 | 000,498,030 | ---- | C] () -- C:\WINXP\System32\perfh009.dat [2001/08/23 06:00:00 | 000,103,120 | ---- | C] () -- C:\WINXP\System32\perfc007.dat [2001/08/23 06:00:00 | 000,086,130 | ---- | C] () -- C:\WINXP\System32\perfc009.dat [2001/08/23 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINXP\System32\noise.dat [1997/06/14 04:56:08 | 000,056,832 | ---- | C] () -- C:\WINXP\System32\iyvu9_32.dll [1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- C:\WINXP\System32\giveio.sys ========== LOP Check ========== [2012/04/07 18:15:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\.minecraft [2011/12/19 12:48:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\1&1 Mail & Media GmbH [2011/06/29 19:41:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\AskToolbar [2011/07/14 13:01:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\DAEMON Tools Lite [2012/06/29 16:57:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\DNA [2012/03/06 17:58:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\DVDVideoSoft [2011/05/06 06:59:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\DVDVideoSoftIEHelpers [2011/07/22 15:46:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\ElevatedDiagnostics [2011/12/10 14:25:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\GetRightToGo [2011/04/30 11:12:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\GrabPro [2009/10/28 08:37:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\IEPro [2011/11/21 14:32:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Kuroi [2009/11/01 14:41:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\MiniDm [2012/03/28 15:37:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Mount&Blade Warband [2010/08/26 07:46:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\MusE [2010/09/15 15:27:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\New Technology Studio [2010/10/23 09:10:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Nokia [2011/06/30 00:16:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Notepad++ [2009/03/01 10:00:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\OpenOffice.org [2010/06/07 14:42:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\PC Suite [2011/01/28 07:37:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Spore [2010/01/09 10:14:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Steganos [2011/11/12 09:19:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\The Creative Assembly [2010/08/08 07:10:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TomTom [2011/08/08 16:27:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TS3Client [2011/05/15 09:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\ts3overlay [2012/04/24 17:23:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\uTorrent [2011/07/12 08:10:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Windows Search [2011/11/21 15:18:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Ynadk [2012/02/29 09:11:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Big Fish Games [2009/07/07 01:31:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth [2011/02/06 10:54:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite [2010/01/04 19:46:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FarmFrenzy2 [2011/01/24 08:09:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Hunter [2010/06/07 14:36:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations [2010/10/23 09:02:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache [2010/06/07 14:42:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2011/11/26 17:04:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PopCap Games [2010/01/04 19:46:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2010/08/08 07:11:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom [2011/12/20 10:56:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UUdb [2011/07/27 09:59:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2012/06/29 17:32:00 | 000,000,224 | ---- | M] () -- C:\WINXP\Tasks\Scheduled Update for Ask Toolbar.job [2012/06/29 17:32:00 | 000,000,412 | -H-- | M] () -- C:\WINXP\Tasks\User_Feed_Synchronization-{BE05D94E-DF19-4C86-98AA-740F46DE4F23}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2012/03/07 11:48:22 | 000,000,000 | ---D | M] -- C:\AMD [2009/03/09 19:33:53 | 000,000,000 | ---D | M] -- C:\ATI [2012/06/25 06:49:06 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2010/01/09 10:15:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2010/03/22 06:20:39 | 000,000,000 | ---D | M] -- C:\downloads [2012/04/08 12:50:55 | 000,000,000 | ---D | M] -- C:\Google [2009/04/25 11:45:20 | 000,000,000 | RH-D | M] -- C:\MSOCache [2010/01/10 19:45:16 | 000,000,000 | ---D | M] -- C:\NVIDIA [2009/04/14 14:24:16 | 000,000,000 | ---D | M] -- C:\pentax56 [2009/02/11 14:51:34 | 000,000,000 | ---D | M] -- C:\Postinstall [2012/06/27 16:14:22 | 000,000,000 | R--D | M] -- C:\Programme [2009/02/11 07:38:34 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2012/06/27 16:24:26 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011/07/14 12:34:59 | 000,000,000 | ---D | M] -- C:\Temp [2012/06/28 02:32:48 | 000,000,000 | ---D | M] -- C:\WINXP < %PROGRAMFILES%\*.exe > Invalid Environment Variable: %LOCALAPPDATA%\*.exe < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINXP\Driver Cache\i386\sp2.cab:AGP440.sys [2004/08/03 17:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINXP\system32\drivers\agp440.sys < MD5 for: ATAPI.SYS > [2004/08/04 08:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINXP\Driver Cache\i386\sp2.cab:atapi.sys [2004/08/04 08:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINXP\system32\drivers\atapi.sys < MD5 for: EVENTLOG.DLL > [2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINXP\system32\dllcache\eventlog.dll [2004/08/04 08:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINXP\system32\eventlog.dll < MD5 for: EXPLORER.EXE > [2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINXP\explorer.exe [2004/08/04 08:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINXP\system32\dllcache\explorer.exe < MD5 for: NETLOGON.DLL > [2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINXP\system32\dllcache\netlogon.dll [2004/08/04 08:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINXP\system32\netlogon.dll < MD5 for: NVATA.SYS > [2006/08/14 02:51:28 | 000,105,344 | R--- | M] (NVIDIA Corporation) MD5=947C4A0E7B25BCECC3B40F0F1070378B -- C:\WINXP\system32\drivers\nvata.sys < MD5 for: NVGTS.SYS > [2009/06/30 12:31:18 | 000,164,896 | ---- | M] (NVIDIA Corporation) MD5=17F915C35450783A446E70693AFA749B -- C:\NVIDIA\nForce\15.45\International\IDE\WinXP\sataraid\nvgts.sys [2009/06/30 12:31:00 | 000,164,896 | ---- | M] (NVIDIA Corporation) MD5=619D8943725402D1179941FD58574CC8 -- C:\NVIDIA\nForce\15.45\International\IDE\WinXP\sata_ide\nvgts.sys < MD5 for: SCECLI.DLL > [2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINXP\system32\dllcache\scecli.dll [2004/08/04 08:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINXP\system32\scecli.dll < MD5 for: USER32.DLL > [2004/08/04 08:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINXP\system32\dllcache\user32.dll [2004/08/04 08:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINXP\system32\user32.dll < MD5 for: USERINIT.EXE > [2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINXP\system32\dllcache\userinit.exe [2004/08/04 08:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINXP\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINXP\system32\dllcache\winlogon.exe [2004/08/04 08:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINXP\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINXP\system32\dllcache\ws2ifsl.sys [2004/08/04 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINXP\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2012/06/27 17:39:59 | 000,524,288 | ---- | M] () -- C:\WINXP\System32\config\default.sav [2012/06/26 20:46:36 | 000,262,144 | ---- | M] () -- C:\WINXP\System32\config\security.sav [2012/06/27 17:39:59 | 047,710,208 | ---- | M] () -- C:\WINXP\System32\config\software.sav [2012/06/27 17:39:59 | 007,602,176 | ---- | M] () -- C:\WINXP\System32\config\system.sav < %systemroot%\system32\*.dll /lockedfiles > [2004/08/04 08:00:00 | 000,148,480 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\dnsapi.dll [2004/08/04 08:00:00 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\mstask.dll [2004/08/04 08:00:00 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\ntdsapi.dll [2004/08/04 08:00:00 | 001,483,776 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\shdocvw.dll [2004/08/04 08:00:00 | 008,424,960 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINXP\system32\shell32.dll [1 C:\WINXP\system32\*.tmp files -> C:\WINXP\system32\*.tmp -> ] Invalid Environment Variable: %USERPROFILE%\*.* Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe ========== Alternate Data Streams ========== @Alternate Data Stream - 113 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:8140CB50 < End of report > |
02.07.2012, 17:50 | #24 |
| GVU-Trojaner Hey, bist du noch dran? |
03.07.2012, 19:00 | #25 |
/// Malware-holic | GVU-Trojaner hi auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein: Code:
ATTFilter :OTL O4 - HKU\User_ON_C..\Run: [bC4lJzJAS4eHdGa] C:\Dokumente und Einstellungen\User\Anwendungsdaten\w6j6rt45jtuhdre5.exe () O4 - HKU\User_ON_C..\Run: [bC4lJzJAS4eHdGa] C:\Dokumente und Einstellungen\User\Anwendungsdaten\w6j6rt45jtuhdre5.exe () :Files :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] dieses speicherst du auf nem usb stick als fix.txt nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist. • Klicke nun bitte auf den Fix Button. es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick. wenn dies nicht funktioniert, bitte den fix manuell eintragen. dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen, log posten bitte.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
03.07.2012, 20:20 | #26 |
| GVU-Trojaner ok, -processing complete! -do you wish to reboot now? -hab ich yes gedrückt aber er rebootet nicht, soll ich die CD rausnehmen und manuell rebooten? -Ich wollte den PC runterfahren, da spuckt er mir die CD aus -Dann hab ich ihn hochgefahren und er HAT MEIN WINDOWS Gestartet! -nur es fehlen alle desktopsymbole -Und eine Fehlermeldung gleich am Anfang: Microsoft Feeds Synchronization hat ein Problem festgestellt und muss beendet werden. Ich rühr jetzt erstmal nix an.. |
04.07.2012, 17:12 | #27 | |
/// Malware-holic | GVU-Trojaner hi geht der taskmanager dann dort anwendung, durchsuchen tippe iexplore.exe enter dann combofix laden, dann wieder in taskmanager, neuer task, durchsuchen zum download ordner navigieren combofix ausführen wenn das programm durch ist, neustarten, rechtsklick ansicht, symbole einblenden log posten. Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
04.07.2012, 18:36 | #28 |
| GVU-Trojaner "Der Taskmanager wurde durch den Administrator deaktiviert" PS: Damit wir uns nicht mehr Arbeit machen als nötig: Ich möchte nach alldem mein System neu aufsetzen. Kannst mich dabei vielleicht auch betreuen? |
05.07.2012, 19:37 | #29 |
/// Malware-holic | GVU-Trojaner hättest das nicht früher sagen können :-) starte die otl cd und sichere dann bilder, dokumente, musik, vidios.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
05.07.2012, 22:30 | #30 |
| GVU-Trojaner Oh entschuldigung, ich dachte wir müssen alle dateien erst saubern... OK, wenn ich über die OTL-CD boote, kann ich dann auf alles zugreifen? Ich muss nämlich viele verschiedene Sachen speichern, Internetfavoriten, Spiele, Spielstände, Arbeitsdokumente und-dateien und vieles mehr? Sorry nochmal |
Themen zu GVU-Trojaner |
anleitung, bildschirm, bli, bootet nicht, cd-rom, cdburnerxp, cdrom, desktop, device, erstellt, glaskugel, gvu trojaner, infizierte, kaspersky, laufwerk, minute, minuten, problem, rechner, rescue, schwarzer bildschirm, seite, setup, startet, trojaner, unterschied, windows |