| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus mit dem Titel: "Cyber Crime Investigation Departement"Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
25.07.2012, 23:57
| #1 |
 |  Virus mit dem Titel: "Cyber Crime Investigation Departement" Hallo Leute, ich habe mir gestern auf meinem Rechner einen Virus eingefangen, der sich wie folgt äußert: sobald der Computer Internetzugang hat, kommt ein Screen auf dem (zusammengefasst) steht, dass mein Rechner von der Polizei gesperrt wurde und ich 100€ zahlen muss. Diesen Screen kann man nicht wegklicken: das einzige was man tun kann, ist den Computer neuzustarten. Ich habe einen OTL Scan und einen GMER Scan auf dem infizierten Rechner durchgeführt. Hier das Ergebnis von OTL.txt. Die Datein Extras.txt und Gmer.txt sind im Anhang zu finden. Ich bin dankbar für jede Hilfe. LG Cettt OTL logfile created on: 7/26/2012 1:00:25 AM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 1,023.00 Mb Total Physical Memory | 760.00 Mb Available Physical Memory | 74.00% Memory free 907.00 Mb Paging File | 813.00 Mb Available in Paging File | 90.00% Paging File free Paging file location(s): H:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 7.81 Gb Total Space | 1.47 Gb Free Space | 18.80% Space Free | Partition Type: NTFS Drive D: | 596.17 Gb Total Space | 24.76 Gb Free Space | 4.15% Space Free | Partition Type: NTFS Drive E: | 24.41 Gb Total Space | 16.16 Gb Free Space | 66.18% Space Free | Partition Type: NTFS Drive F: | 79.55 Gb Total Space | 46.22 Gb Free Space | 58.11% Space Free | Partition Type: NTFS Drive X: | 1.96 Gb Total Space | 1.53 Gb Free Space | 78.00% Space Free | Partition Type: FAT Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - File not found [Auto] -- -- (tvnserver) SRV - File not found [Auto] -- -- (SkypeUpdate) SRV - File not found [Auto] -- -- (JavaQuickStarterService) SRV - [2012/07/22 18:06:30 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/07/13 02:34:02 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/07/05 12:41:46 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2011/08/03 07:49:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011/06/29 07:26:06 | 000,520,216 | ---- | M] (Ant.com) [Auto] -- C:\Programme\Ant.com\IE add-on\AntUpdaterService.exe -- (AntUpdaterService) SRV - [2008/09/26 10:02:21 | 000,354,560 | ---- | M] (TuneUp Software GmbH) [On_Demand] -- C:\WINDOWS\system32\TuneUpDefragService.exe -- (TuneUp.Defrag) SRV - [2008/04/04 08:51:32 | 000,028,416 | ---- | M] (TuneUp Software GmbH) [Auto] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp) SRV - [2005/12/21 06:51:04 | 000,139,264 | ---- | M] () [Auto] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) SRV - [2005/12/21 06:48:04 | 000,127,035 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp) SRV - [2005/12/21 06:47:48 | 000,061,503 | ---- | M] (NVIDIA) [Auto] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog) SRV - [2005/09/23 05:04:38 | 000,020,543 | ---- | M] (Apache Software Foundation) [Auto] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface) SRV - [2004/10/21 21:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003/07/28 07:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003/06/19 18:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | On_Demand] -- -- (pccsmcfd) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2008/06/06 03:24:44 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2008/05/07 01:38:36 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2008/05/07 01:38:20 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2008/05/07 01:38:20 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2006/04/24 12:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\nvata.sys -- (nvata) DRV - [2006/04/14 15:09:06 | 000,013,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006/04/14 15:09:04 | 000,034,176 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006/04/14 15:08:56 | 000,101,888 | ---- | M] (NVIDIA Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\nvtcp.sys -- (NVTCP) DRV - [2006/03/27 11:53:28 | 000,167,808 | ---- | M] (NETGEAR Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wg111v2.sys -- (RTLWUSB) DRV - [2005/09/19 03:41:00 | 000,241,280 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp) DRV - [2005/07/26 02:01:56 | 000,415,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvapu.sys -- (nvnforce) Service for NVIDIA(R) nForce(TM) DRV - [2005/07/26 01:58:30 | 000,053,376 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvax.sys -- (nvax) Service for NVIDIA(R) nForce(TM) DRV - [2005/03/09 10:53:00 | 000,043,008 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2004/08/12 22:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2004/04/26 01:10:00 | 000,038,081 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidUsbK.sys -- (LHidUsbK) DRV - [2004/04/26 01:09:52 | 000,054,657 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou) DRV - [2004/04/26 01:09:42 | 000,071,405 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE) DRV - [2004/04/26 01:09:24 | 000,024,605 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe) DRV - [2004/01/28 09:03:26 | 000,021,456 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SilvrLnk.sys -- (SilverLink) Texas Instruments SilverLink (USB GraphLink) DRV - [2003/10/01 21:16:48 | 000,119,552 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\pnpshark.sys -- (pnpshark) DRV - [2003/09/27 08:37:16 | 000,005,504 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\st3shark.sys -- (st3shark) DRV - [2002/10/02 02:57:12 | 000,013,532 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SjyPkt.sys -- (SjyPkt) DRV - [2002/04/11 05:47:52 | 000,011,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ipfilter.sys -- (IPFilter) DRV - [2001/08/17 09:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401) DRV - [2001/08/17 08:04:46 | 000,223,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\camdrv21.sys -- (camvid20) DRV - [2001/08/17 07:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Cetnick_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.telekom.at/suche IE - HKU\Cetnick_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.puls4.com/home IE - HKU\Cetnick_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp IE - HKU\Cetnick_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at IE - HKU\Cetnick_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 00 F7 0F C6 9E CB 01 [binary data] IE - HKU\Cetnick_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\Cetnick_ON_C\..\URLSearchHook: {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - Reg Error: Key error. File not found IE - HKU\Cetnick_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2321: C:\Programme\Real Alternative\Browser\Plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1483: C:\Programme\Real Alternative\Browser\Plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\jqs@sun.com: E:\Programme\Java\lib\deploy\jqs\ff FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: E:\Programme\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: E:\Programme\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Programme\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/11/26 18:11:42 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\mozilla\Extensions [2012/07/04 02:53:44 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\mozilla\Firefox\Profiles\a7jv1izp.default\extensions [2011/11/26 18:25:39 | 000,000,000 | ---D | M] (German Dictionary, extended for Austria) -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\mozilla\Firefox\Profiles\a7jv1izp.default\extensions\de-AT@dictionaries.addons.mozilla.org [2011/11/26 18:25:39 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\mozilla\Firefox\Profiles\a7jv1izp.default\extensions\en-GB@dictionaries.addons.mozilla.org [2011/12/24 17:20:59 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\Mozilla\Firefox\Profiles\a7jv1izp.default\searchplugins\sweetim.xml File not found (No name found) -- () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\CETNICK\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\A7JV1IZP.DEFAULT\EXTENSIONS\{4DC70064-89E2-4A55-8FC6-E8CDEAE3618C}.XPI File not found (No name found) -- E:\PROGRAMME\JAVA\LIB\DEPLOY\JQS\FF O1 HOSTS File: ([2001/08/18 08:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {346FDE31-DFF9-418A-90C8-BA31DC9FF2EF} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - File not found O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - File not found O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - File not found O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - File not found O3 - HKLM\..\Toolbar: (no name) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - No CLSID value found. O3 - HKU\Cetnick_ON_C\..\Toolbar\WebBrowser: (no name) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - No CLSID value found. O3 - HKU\Cetnick_ON_C\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O3 - HKU\Cetnick_ON_C\..\Toolbar\WebBrowser: (no name) - {BC4FFE41-DE9F-46FA-B455-AAD49B9F9938} - No CLSID value found. O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [IntelliType] C:\Programme\Microsoft Hardware\Keyboard\type32.exe (Microsoft Corporation) O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.) O4 - HKLM..\Run: [nTrayFw] C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe (NVIDIA Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NVMixerTray] C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe () O4 - HKLM..\Run: [POINTER] File not found O4 - HKLM..\Run: [SAIMON] C:\WINDOWS\system32\SaiMon.exe (Saitek) O4 - HKU\.DEFAULT..\Run: [Nokia.PCSync] File not found O4 - HKU\Cetnick_ON_C..\Run: [Skype] File not found O4 - Startup: C:\Dokumente und Einstellungen\Cetnick\Startmenü\Programme\Autostart\ctfmon.lnk = X:\minint\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation) O4 - Startup: C:\Dokumente und Einstellungen\Cetnick\Startmenü\Programme\Autostart\PowerReg Scheduler.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Cetnick_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\UpdatusUser_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: Download videos by Ant.com - {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - Reg Error: Key error. File not found O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - File not found O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA) O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - File not found O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll () O20 - HKU\Cetnick_ON_C Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007/03/12 17:19:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 13:06:42 | 000,000,053 | ---- | M] () - X:\AUTORUN.INF -- [ FAT ] O33 - MountPoints2\{f3e1a580-4600-11df-af10-00184dcce78d}\Shell - "" = AutoRun O33 - MountPoints2\{f3e1a580-4600-11df-af10-00184dcce78d}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f3e1a580-4600-11df-af10-00184dcce78d}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.html O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/07/24 17:52:04 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Cetnick\Recent [2012/07/08 16:38:40 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype [2012/07/08 16:38:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype [2003/10/01 21:16:48 | 000,119,552 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\pnpshark.sys [2003/09/27 08:37:16 | 000,005,504 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\st3shark.sys [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/07/26 00:57:51 | 010,223,616 | ---- | M] () -- C:\Dokumente und Einstellungen\Cetnick\NTUSER.DAT [2012/07/25 17:45:21 | 000,262,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\UpdatusUser\NTUSER.DAT [2012/07/25 17:45:21 | 000,262,144 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT [2012/07/25 17:45:21 | 000,229,376 | ---- | M] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT [2012/07/25 17:45:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012/07/25 17:45:17 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2012/07/25 17:45:16 | 000,000,300 | -HS- | M] () -- C:\Dokumente und Einstellungen\Cetnick\ntuser.ini [2012/07/25 17:45:11 | 004,842,982 | -H-- | M] () -- C:\Dokumente und Einstellungen\Cetnick\Lokale Einstellungen\Anwendungsdaten\IconCache.db [2012/07/25 17:39:41 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job [2012/07/25 17:39:40 | 000,000,496 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job [2012/07/25 17:29:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012/07/25 15:41:54 | 000,267,008 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2012/07/25 04:56:10 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\z7_0ytr.pad [2012/07/25 04:53:18 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012/07/24 17:47:40 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2012/07/24 17:35:06 | 000,001,612 | ---- | M] () -- C:\Dokumente und Einstellungen\Cetnick\Startmenü\Programme\Autostart\ctfmon.lnk [2012/07/13 02:34:02 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2012/07/13 02:34:02 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2012/07/08 16:38:40 | 000,001,870 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2012/07/08 16:38:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype [2012/07/01 17:46:24 | 000,162,816 | ---- | M] () -- C:\Dokumente und Einstellungen\Cetnick\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012/06/28 19:05:36 | 045,927,588 | ---- | M] () -- C:\Dokumente und Einstellungen\Cetnick\Desktop\microeconomics Robert S.pindyck.pdf [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/07/25 15:41:54 | 000,267,008 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2012/07/24 17:35:06 | 000,001,612 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Startmenü\Programme\Autostart\ctfmon.lnk [2012/07/24 17:35:05 | 004,503,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\z7_0ytr.pad [2012/06/29 15:46:18 | 000,000,884 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012/06/28 19:03:00 | 045,927,588 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Desktop\microeconomics Robert S.pindyck.pdf [2012/02/16 05:13:33 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2011/10/13 09:04:32 | 000,000,127 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2011/09/30 18:55:35 | 000,000,300 | -H-- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\wndsksi.inf [2011/09/18 10:23:46 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\UpdatusUser\ntuser.ini [2011/09/18 10:23:45 | 000,262,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\UpdatusUser\NTUSER.DAT [2011/09/18 10:23:04 | 000,280,276 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin [2011/09/18 10:23:04 | 000,280,276 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin [2011/09/18 10:23:03 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin [2011/09/18 10:22:09 | 002,128,778 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data [2011/06/02 16:00:38 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Lokale Einstellungen\Anwendungsdaten\PUTTY.RND [2011/06/02 15:45:03 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\winscp.rnd [2010/08/24 11:00:33 | 000,001,040 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\NMM-MetaData.db [2010/08/23 18:12:55 | 004,842,982 | -H-- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Lokale Einstellungen\Anwendungsdaten\IconCache.db [2010/04/27 16:40:08 | 000,005,800 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\untitled10_MAS.bak [2010/04/27 16:26:38 | 000,004,840 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\untitled9_MAS.bak [2010/04/27 16:25:03 | 000,004,920 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\untitled8_MAS.bak [2010/04/27 16:14:55 | 000,005,560 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\untitled7_MAS.bak [2010/04/27 16:10:58 | 000,005,976 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\untitled4_MAS.bak [2010/04/26 17:15:46 | 000,002,024 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\untitled3_MAS.bak [2010/04/01 16:53:09 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/02/11 19:29:32 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\binkw32.dll [2009/12/09 15:27:30 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2009/09/14 14:24:48 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\SAICFG.dll [2009/08/10 11:15:44 | 000,003,352 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\untitled2_MAS.bak [2009/08/03 09:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll [2009/08/03 09:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe [2008/12/11 19:59:11 | 000,000,284 | ---- | C] () -- C:\WINDOWS\matlab.ini [2008/11/04 20:27:15 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini [2008/10/25 11:15:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcfriend.INI [2008/10/19 09:27:31 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2008/09/30 18:15:38 | 000,038,272 | ---- | C] () -- C:\WINDOWS\System32\geBqOfFv.dll [2008/09/19 17:57:34 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008/09/19 17:55:10 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2008/09/19 17:55:10 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2008/09/19 17:54:18 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2008/08/10 17:55:23 | 000,001,203 | ---- | C] () -- C:\WINDOWS\wininit.ini [2008/08/10 17:52:08 | 000,000,291 | ---- | C] () -- C:\WINDOWS\SIERRA.INI [2008/07/12 13:02:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PowerReg.dat [2008/05/09 08:54:08 | 000,000,059 | ---- | C] () -- C:\WINDOWS\iPlayer.INI [2008/04/14 17:06:59 | 000,000,108 | ---- | C] () -- C:\WINDOWS\tb96.ini [2007/07/10 10:16:49 | 000,001,755 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache [2007/04/13 13:29:31 | 000,001,395 | ---- | C] () -- C:\WINDOWS\mozver.dat [2007/04/13 13:16:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2007/04/03 07:06:24 | 000,308,736 | ---- | C] () -- C:\WINDOWS\System32\fpxlib.dll [2007/04/03 07:06:24 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\jpeglib.dll [2007/04/03 07:05:12 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PI_setup.ini [2007/04/03 07:04:08 | 000,000,021 | ---- | C] () -- C:\WINDOWS\PB_setup.ini [2007/03/31 12:35:19 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll [2007/03/29 18:00:40 | 000,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll [2007/03/27 09:16:08 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007/03/27 09:16:06 | 000,162,816 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007/03/12 18:48:55 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2007/03/12 18:48:53 | 000,005,843 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2007/03/12 18:48:51 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2007/03/12 18:40:05 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007/03/12 17:23:49 | 000,000,300 | -HS- | C] () -- C:\Dokumente und Einstellungen\Cetnick\ntuser.ini [2007/03/12 17:23:48 | 010,223,616 | ---- | C] () -- C:\Dokumente und Einstellungen\Cetnick\NTUSER.DAT [2007/03/12 17:23:05 | 000,262,144 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT [2007/03/12 17:23:05 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\LocalService\ntuser.ini [2007/03/12 17:22:49 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\NetworkService\ntuser.ini [2007/03/12 17:22:48 | 000,229,376 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT [2007/03/12 17:21:55 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2007/03/12 17:19:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\control.ini [2007/03/12 17:18:49 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest [2007/03/12 17:18:44 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest [2007/03/12 17:17:20 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2007/03/12 17:17:10 | 000,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini [2007/03/12 17:17:10 | 000,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini [2007/03/12 17:16:38 | 000,027,055 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini [2007/03/12 17:16:37 | 000,003,999 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini [2007/03/12 17:02:50 | 000,997,170 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2007/03/12 17:02:49 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006/10/22 07:22:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006/10/22 07:22:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006/06/29 08:58:52 | 000,030,808 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont [2006/06/29 08:53:56 | 000,026,489 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont [2006/05/03 11:44:32 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\RtlGina2.dll [2006/04/18 09:39:28 | 000,029,779 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont [2006/04/18 09:39:28 | 000,026,040 | ---- | C] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont [2004/08/03 19:12:38 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004/08/03 18:58:14 | 000,023,804 | R-S- | C] () -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\igfxtray.dat [2004/08/03 18:57:34 | 000,270,848 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll [2004/08/03 18:57:26 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll [2004/08/03 18:57:20 | 000,186,880 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll [2004/08/03 18:57:18 | 000,253,440 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll [2004/08/03 18:57:16 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll [2004/08/03 18:56:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll [2004/08/03 16:51:30 | 000,054,128 | ---- | C] () -- C:\WINDOWS\System32\dosx.exe [2004/08/03 16:48:50 | 000,003,358 | ---- | C] () -- C:\WINDOWS\System32\redir.exe [2004/08/03 16:46:56 | 000,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys [2004/08/03 16:45:28 | 000,034,032 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys [2004/08/03 16:45:16 | 000,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys [2004/08/03 16:45:16 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys [2004/08/03 16:45:14 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys [2004/08/03 16:45:12 | 000,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys [2004/08/02 08:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004/07/17 05:46:14 | 000,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini [2004/07/17 05:34:48 | 000,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll [2003/10/01 20:20:48 | 000,061,952 | ---- | C] () -- C:\WINDOWS\daemon.dll [2003/02/20 12:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002/10/15 18:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2002/04/11 05:47:52 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\msmscoin.dll [2001/08/18 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001/08/18 08:00:00 | 001,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini [2001/08/18 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2001/08/18 08:00:00 | 000,448,898 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2001/08/18 08:00:00 | 000,432,784 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2001/08/18 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2001/08/18 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2001/08/18 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2001/08/18 08:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll [2001/08/18 08:00:00 | 000,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll [2001/08/18 08:00:00 | 000,080,338 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2001/08/18 08:00:00 | 000,071,022 | ---- | C] () -- C:\WINDOWS\System32\edit.com [2001/08/18 08:00:00 | 000,067,740 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2001/08/18 08:00:00 | 000,052,777 | ---- | C] () -- C:\WINDOWS\System32\command.com [2001/08/18 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2001/08/18 08:00:00 | 000,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys [2001/08/18 08:00:00 | 000,039,546 | ---- | C] () -- C:\WINDOWS\System32\mem.exe [2001/08/18 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2001/08/18 08:00:00 | 000,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys [2001/08/18 08:00:00 | 000,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys [2001/08/18 08:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys [2001/08/18 08:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys [2001/08/18 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2001/08/18 08:00:00 | 000,027,914 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys [2001/08/18 08:00:00 | 000,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys [2001/08/18 08:00:00 | 000,021,542 | ---- | C] () -- C:\WINDOWS\System32\mqperf.ini [2001/08/18 08:00:00 | 000,021,210 | ---- | C] () -- C:\WINDOWS\System32\debug.exe [2001/08/18 08:00:00 | 000,019,726 | ---- | C] () -- C:\WINDOWS\System32\graphics.com [2001/08/18 08:00:00 | 000,017,241 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini [2001/08/18 08:00:00 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll [2001/08/18 08:00:00 | 000,014,816 | ---- | C] () -- C:\WINDOWS\System32\kb16.com [2001/08/18 08:00:00 | 000,014,060 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini [2001/08/18 08:00:00 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll [2001/08/18 08:00:00 | 000,013,026 | ---- | C] () -- C:\WINDOWS\System32\edlin.exe [2001/08/18 08:00:00 | 000,012,610 | ---- | C] () -- C:\WINDOWS\System32\append.exe [2001/08/18 08:00:00 | 000,011,903 | ---- | C] () -- C:\WINDOWS\System32\setver.exe [2001/08/18 08:00:00 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\scriptpw.dll [2001/08/18 08:00:00 | 000,009,032 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys [2001/08/18 08:00:00 | 000,008,584 | ---- | C] () -- C:\WINDOWS\System32\exe2bin.exe [2001/08/18 08:00:00 | 000,007,084 | ---- | C] () -- C:\WINDOWS\System32\nlsfunc.exe [2001/08/18 08:00:00 | 000,006,287 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini [2001/08/18 08:00:00 | 000,004,992 | ---- | C] () -- C:\WINDOWS\System32\himem.sys [2001/08/18 08:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2001/08/18 08:00:00 | 000,004,438 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini [2001/08/18 08:00:00 | 000,004,233 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini [2001/08/18 08:00:00 | 000,003,262 | ---- | C] () -- C:\WINDOWS\System32\nw16.exe [2001/08/18 08:00:00 | 000,002,656 | ---- | C] () -- C:\WINDOWS\System32\netware.drv [2001/08/18 08:00:00 | 000,001,783 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini [2001/08/18 08:00:00 | 000,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini [2001/08/18 08:00:00 | 000,001,273 | ---- | C] () -- C:\WINDOWS\System32\loadfix.com [2001/08/18 08:00:00 | 000,001,157 | ---- | C] () -- C:\WINDOWS\System32\vwipxspx.exe [2001/08/18 08:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\share.exe [2001/08/18 08:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\fastopen.exe [2001/08/18 08:00:00 | 000,000,817 | ---- | C] () -- C:\WINDOWS\System32\mscdexnt.exe [2001/08/18 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\win.ini [2001/08/18 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2001/08/18 08:00:00 | 000,000,369 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini [2001/08/18 08:00:00 | 000,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2001/08/18 00:54:50 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\dvdplay.exe [2001/08/18 00:54:08 | 000,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll [2001/04/01 06:00:00 | 000,320,512 | ---- | C] () -- C:\WINDOWS\System32\W32MKDE.EXE [2001/04/01 06:00:00 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\W32MKRC.DLL [1998/10/10 19:07:38 | 000,088,576 | ---- | C] () -- C:\WINDOWS\System32\Iticheck.dll [1998/09/16 17:25:24 | 000,004,096 | ---- | C] () -- C:\WINDOWS\delttsul.exe ========== LOP Check ========== [2011/09/18 10:25:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\UpdatusUser\Anwendungsdaten\TightVNC [2007/10/07 13:09:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\Ashampoo [2011/06/03 11:25:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\BSW [2011/07/30 05:01:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\DVDVideoSoft [2011/07/30 05:01:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\DVDVideoSoftIEHelpers [2012/05/11 19:48:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\ICQ [2008/04/13 10:59:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\InterVideo [2011/10/13 09:33:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\MicroST [2010/05/23 19:43:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\mquadr.at [2009/05/27 08:27:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\PCenter [2012/02/28 13:48:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\Philips [2008/01/20 07:48:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\RouterControl [2011/12/24 17:46:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\Stereoscopic Player [2011/06/04 12:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\TightVNC [2012/07/17 17:30:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\Tinn-R [2008/09/26 10:02:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\TuneUp Software [2012/04/15 04:28:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Cetnick\Anwendungsdaten\uTorrent [2011/06/04 12:30:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\TightVNC [2011/08/10 22:38:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ant.com [2007/10/07 13:09:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo [2011/06/18 07:39:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2010/08/18 12:23:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations [2010/05/23 19:43:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\m2backup [2010/05/23 19:43:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mquadr.at [2009/08/18 13:34:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Drivers HeadQuarters [2008/04/26 13:42:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite [2008/09/26 10:02:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software [2010/05/23 19:43:15 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{7FDC9DDA-8828-4A49-A615-2E0A4EE0F0E2} [2012/07/25 17:39:40 | 000,000,496 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job [2012/07/25 17:39:41 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job ========== Purity Check ========== < End of report > |
| Themen zu Virus mit dem Titel: "Cyber Crime Investigation Departement" |
| .com, bho, browser, computer, converter, crime, ctfmon.lnk, cyber crime, desktop, einstellungen, error, firefox, flash player, format, gesperrt, homepage, investigation, langs, logfile, mozilla, mp3, netgear, plug-in, registry, rundll, scan, server, software, tvnserver, virus, windows, windows xp |
Baum-Darstellung