Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Interpretation des Log-Files von OTLPE - GVU-Trojaner

Interpretation des Log-Files von OTLPE - GVU-Trojaner


Log-Analyse und Auswertung: Interpretation des Log-Files von OTLPE - GVU-Trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 30.01.2013, 02:42   #1
danielevery
 
Interpretation des Log-Files von OTLPE - GVU-Trojaner - Frage

Interpretation des Log-Files von OTLPE - GVU-Trojaner


Hallo liebes Trojaner-Board-Team,

ich habe hier einen Rechner, der seit gestern vom GVU Trojaner befallen ist.
  • Betriebssystem Win7
  • Benutzer mit eingeschränkter Berechtigung
  • Abgesicherter Modus läßt sich für diesen Benuzter nicht mehr starten

Ich habe bereits folgende CDs/Sticks ohne Erfolg laufen lassen, bevor ich endlich auf das erfolgreichere Trojaner-Board gestoßen bin:
  • Kaspersky
  • Norton Recovery Boot
  • Comodo Rescue
  • HitMan Pro

Ich habe eine OTLPE CD gebrannt und bin dann nach folgender Anleitung vorgegangen: (analog zu http://www.trojaner-board.de/130200-...odus-geht.html )
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.

Folgende Custom Scans habe ich in OTLPE eingefügt (später am Ende des Posts aber auch nochmal ohne Custom Scans!), laut http://www.trojaner-board.de/130271-...virus-los.html
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
Eine Extra.txt wurde nicht erstellt. Hier die OTL.txt :
Code:
ATTFilter
OTL logfile created on: 1/30/2013 1:48:08 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = H: | %SystemRoot% = H:\Windows | %ProgramFiles% = H:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.82 Mb Free Space | 75.82% Space Free | Partition Type: NTFS
Drive H: | 465.66 Gb Total Space | 385.07 Gb Free Space | 82.69% Space Free | Partition Type: NTFS
Drive I: | 1.87 Gb Total Space | 1.84 Gb Free Space | 98.55% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012/09/12 14:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand] -- H:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/09/12 14:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto] -- H:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/09/16 13:47:00 | 001,048,576 | ---- | M] ( ) [Auto] -- H:\Windows\System32\LMabcoms.exe -- (lmab_device)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- H:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- H:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV - [2013/01/09 15:40:28 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- H:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/05/30 12:25:15 | 000,040,960 | ---- | M] () [Auto] -- H:\Users\Matthias\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2012/04/04 00:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto] -- H:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/03/19 16:44:20 | 000,276,248 | ---- | M] (Intel Corporation) [On_Demand] -- H:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) Intel(R)
SRV - [2012/03/19 06:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) [Auto] -- H:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011/12/08 19:20:00 | 000,079,872 | ---- | M] (DATEV eG) [Auto] -- H:\DATEV\PROGRAMM\B0001442\PSNTServ.exe -- (DatevPrintService)
SRV - [2011/07/24 19:49:00 | 000,172,640 | ---- | M] (DATEV eG) [On_Demand] -- H:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)
SRV - [2011/02/21 23:19:12 | 002,656,280 | R--- | M] (Intel Corporation) [Auto] -- H:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2011/02/21 23:19:08 | 000,326,168 | R--- | M] (Intel Corporation) [Auto] -- H:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010/09/16 13:47:00 | 000,593,920 | ---- | M] ( ) [Auto] -- H:\Windows\SysWow64\LMabcoms.exe -- (lmab_device)
SRV - [2010/03/18 06:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- H:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- H:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/08/30 15:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- H:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/03/19 16:32:04 | 014,745,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/06/10 01:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- H:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/10/19 03:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010/09/30 14:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/09/30 14:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2009/11/17 18:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- H:\Windows\System32\drivers\MBfilt64.sys -- (MBfilt)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- H:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/04/16 07:49:34 | 000,028,416 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand] -- H:\Windows\System32\drivers\RimUsb_AMD64.sys -- (RimUsb)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\Matthias_ON_H\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
IE - HKU\Matthias_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\Matthias_ON_H\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKU\Matthias_ON_H\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - Reg Error: Key error. File not found
IE - HKU\Matthias_ON_H\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: H:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@canon.com/EPPEX: H:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: H:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: H:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: H:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: H:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: H:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: H:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: H:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: H:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - H:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - H:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - H:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - H:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - H:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKU\Matthias_ON_H\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - H:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\Matthias_ON_H\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - H:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [LMPSSDMON] H:\Program Files\Lexmark\Monitor\ACB\LMabMON.exe ()
O4:64bit: - HKLM..\Run: [MSC] H:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Ocs_SM] H:\Users\Matthias\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4:64bit: - HKLM..\Run: [RTHDVCPL] H:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [WrtMon.exe] H:\Windows\System32\spool\drivers\x64\3\WrtMon.exe ()
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] H:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [Super-Charger] H:\Program Files (x86)\MSI\Super-Charger\StartSuperCharger.exe (MSI)
O4 - HKU\LocalService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Matthias_ON_H..\Run: [LMab1err] H:\Program Files\Lexmark\ErrorApp\lmab1err.exe ( )
O4 - HKU\NetworkService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_H..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_H..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\Matthias_ON_H\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - H:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Matthias_ON_H Winlogon: Shell - (explorer.exe) - H:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\Matthias_ON_H Winlogon: Shell - (C:\Users\Matthias\AppData\Roaming\skype.dat) - H:\Users\Matthias\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - H:\Windows\System32\appmgmts.dll (Microsoft Corporation)
 
 
========== Files/Folders - Created Within 7 Days ==========
 
[2013/01/29 23:30:45 | 000,000,000 | ---D | C] -- H:\NBRT
[2013/01/29 18:39:14 | 000,000,000 | -HSD | C] -- H:\found.000
[2013/01/29 18:11:58 | 000,000,000 | ---D | C] -- H:\ProgramData\HitmanPro
[2013/01/29 18:11:46 | 000,000,000 | ---D | C] -- H:\Windows\Minidump
[2013/01/29 16:43:28 | 000,000,000 | ---D | C] -- H:\cce_linux
[2013/01/29 13:29:38 | 000,000,000 | ---D | C] -- H:\Kaspersky Rescue Disk 10.0
[2012/12/12 14:01:23 | 001,044,480 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabserv.dll
[2012/12/12 14:01:23 | 000,802,816 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabcomc.dll
[2012/12/12 14:01:23 | 000,376,832 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabcomm.dll
[2012/12/12 14:01:23 | 000,356,352 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabhcp.dll
[2012/12/12 14:01:22 | 000,593,920 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabcoms.exe
 
========== Files - Modified Within 7 Days ==========
 
[2013/01/29 18:48:21 | 000,067,584 | --S- | M] () -- H:\Windows\bootstat.dat
[2013/01/29 18:48:08 | 000,000,004 | ---- | M] () -- H:\Users\Matthias\AppData\Roaming\skype.ini
[2013/01/29 18:45:42 | 000,001,110 | ---- | M] () -- H:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/29 18:45:29 | 3151,982,592 | -HS- | M] () -- H:\hiberfil.sys
[2013/01/29 18:39:50 | 000,003,552 | ---- | M] () -- H:\bootsqm.dat
[2013/01/29 18:27:32 | 000,026,704 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/29 18:27:32 | 000,026,704 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/29 18:19:56 | 356,086,300 | ---- | M] () -- H:\Windows\MEMORY.DMP
[2013/01/28 03:40:00 | 000,000,884 | ---- | M] () -- H:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/26 14:17:00 | 000,001,114 | ---- | M] () -- H:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/26 09:01:07 | 000,000,282 | ---- | M] () -- H:\Windows\tasks\RegClean Pro_DEFAULT.job
 
========== Files Created - No Company Name ==========
 
[2013/01/29 18:39:50 | 000,003,552 | ---- | C] () -- H:\bootsqm.dat
[2013/01/29 18:11:43 | 356,086,300 | ---- | C] () -- H:\Windows\MEMORY.DMP
[2013/01/26 14:24:28 | 000,000,004 | ---- | C] () -- H:\Users\Matthias\AppData\Roaming\skype.ini
[2012/12/12 14:03:23 | 000,028,672 | ---- | C] () -- H:\Windows\hookdllX.dll
[2012/12/12 14:03:23 | 000,011,776 | ---- | C] () -- H:\Windows\SysWow64\pmsbfn32.dll
[2012/05/15 14:48:44 | 000,000,028 | ---- | C] () -- H:\Windows\ODBC.INI
[2012/05/15 13:39:37 | 000,000,021 | ---- | C] () -- H:\Windows\DvInesKurusOleServer003.INI
[2012/05/15 13:28:39 | 000,000,111 | ---- | C] () -- H:\Windows\dvinesinstalllocation001.INI
[2012/05/15 13:26:41 | 000,000,112 | ---- | C] () -- H:\Windows\Startup.INI
[2012/05/09 11:33:42 | 001,846,516 | ---- | C] () -- H:\Windows\SysWow64\PerfStringBackup.INI
[2012/05/08 07:02:25 | 000,047,616 | ---- | C] () -- H:\Users\Matthias\AppData\Roaming\skype.dat
[2012/05/08 06:44:32 | 000,145,804 | ---- | C] () -- H:\Windows\SysWow64\igcompkrng600.bin
[2012/03/19 16:31:16 | 000,963,912 | ---- | C] () -- H:\Windows\SysWow64\igkrng600.bin
[2012/03/19 16:31:16 | 000,261,208 | ---- | C] () -- H:\Windows\SysWow64\igfcg600m.bin
[2012/03/19 16:25:58 | 000,058,880 | ---- | C] () -- H:\Windows\SysWow64\igdde32.dll
[2012/03/19 15:21:14 | 013,212,672 | ---- | C] () -- H:\Windows\SysWow64\ig4icd32.dll
[2010/11/20 22:24:49 | 000,252,928 | ---- | C] () -- H:\Windows\SysWow64\DShowRdpFilter.dll
[2009/09/30 05:05:48 | 000,290,816 | ---- | C] () -- H:\Windows\SysWow64\nsldap32v60.dll
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- H:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- H:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- H:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- H:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- H:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- H:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- H:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- H:\Windows\SysWow64\mlang.dat
[2008/10/30 11:00:22 | 000,048,640 | ---- | C] () -- H:\Windows\SysWow64\nsldapssl32v60.dll
[2008/10/30 10:59:24 | 000,025,088 | ---- | C] () -- H:\Windows\SysWow64\nsldappr32v60.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- H:\Windows\SysWow64\nsldapssl32v50.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- H:\Windows\SysWow64\nsldappr32v50.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- H:\Windows\SysWow64\nsldap32v50.dll
[2003/05/24 11:38:52 | 000,224,768 | ---- | C] () -- H:\Program Files\ToDoList2003.exe
[1999/01/19 08:18:30 | 000,110,080 | ---- | C] () -- H:\Windows\SysWow64\LFPNG60N.DLL
[1999/01/19 08:18:30 | 000,046,080 | ---- | C] () -- H:\Windows\SysWow64\LFTIF60N.DLL
[1999/01/19 08:18:30 | 000,043,008 | ---- | C] () -- H:\Windows\SysWow64\LTFIL60N.DLL
[1999/01/19 08:18:30 | 000,020,480 | ---- | C] () -- H:\Windows\SysWow64\LFPSD60N.DLL
[1999/01/19 08:18:30 | 000,019,968 | ---- | C] () -- H:\Windows\SysWow64\LFTGA60N.DLL
[1999/01/19 08:18:30 | 000,019,456 | ---- | C] () -- H:\Windows\SysWow64\LFWPG60N.DLL
[1999/01/19 08:18:30 | 000,019,456 | ---- | C] () -- H:\Windows\SysWow64\LFWMF60N.DLL
[1999/01/19 08:18:28 | 000,176,128 | ---- | C] () -- H:\Windows\SysWow64\LFFAX60N.DLL
[1999/01/19 08:18:28 | 000,141,824 | ---- | C] () -- H:\Windows\SysWow64\LFCMP60N.DLL
[1999/01/19 08:18:28 | 000,023,552 | ---- | C] () -- H:\Windows\SysWow64\LFPCX60N.DLL
[1999/01/19 08:18:28 | 000,022,528 | ---- | C] () -- H:\Windows\SysWow64\LFPCT60N.DLL
[1999/01/19 08:18:28 | 000,022,528 | ---- | C] () -- H:\Windows\SysWow64\LFEPS60N.DLL
[1999/01/19 08:18:28 | 000,022,016 | ---- | C] () -- H:\Windows\SysWow64\LFBMP60N.DLL
[1999/01/19 08:18:28 | 000,018,432 | ---- | C] () -- H:\Windows\SysWow64\LFMSP60N.DLL
[1999/01/19 08:18:28 | 000,017,920 | ---- | C] () -- H:\Windows\SysWow64\LFMAC60N.DLL
[1995/02/14 17:11:00 | 000,017,920 | ---- | C] () -- H:\Windows\SysWow64\IMPLODE.DLL
 
========== LOP Check ==========
 
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Application Data
[2012/12/12 03:16:45 | 000,000,000 | ---D | M] -- H:\ProgramData\Ask
[2012/05/09 11:51:26 | 000,000,000 | ---D | M] -- H:\ProgramData\Canneverbe Limited
[2012/05/09 12:42:30 | 000,000,000 | -H-D | M] -- H:\ProgramData\CanonBJ
[2012/06/10 02:58:05 | 000,000,000 | -H-D | M] -- H:\ProgramData\CanonEPP
[2012/06/10 02:58:05 | 000,000,000 | -H-D | M] -- H:\ProgramData\CanonIJEPPEX2
[2012/05/15 13:59:14 | 000,000,000 | ---D | M] -- H:\ProgramData\DATEV
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Documents
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Dokumente
[2012/05/20 12:58:04 | 000,000,000 | ---D | M] -- H:\ProgramData\elsterformular
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favorites
[2013/01/29 18:11:58 | 000,000,000 | ---D | M] -- H:\ProgramData\HitmanPro
[2012/10/19 04:57:36 | 000,000,000 | ---D | M] -- H:\ProgramData\PDF Writer
[2012/05/15 13:55:41 | 000,000,000 | ---D | M] -- H:\ProgramData\SkyCom
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Start Menu
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Startmenü
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Templates
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Vorlagen
[2013/01/26 09:01:07 | 000,000,282 | ---- | M] () -- H:\Windows\Tasks\RegClean Pro_DEFAULT.job
[2012/12/26 13:27:08 | 000,000,290 | ---- | M] () -- H:\Windows\Tasks\RegClean Pro_UPDATES.job
[2012/12/08 10:30:16 | 000,032,640 | ---- | M] () -- H:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2012/11/27 15:15:17 | 000,000,000 | -HSD | M] -- H:\$Recycle.Bin
[2013/01/29 16:51:19 | 000,000,000 | ---D | M] -- H:\cce_linux
[2013/01/09 07:29:32 | 000,000,000 | -HSD | M] -- H:\Config.Msi
[2012/05/15 14:43:56 | 000,000,000 | ---D | M] -- H:\DASSDVS
[2012/08/14 04:08:50 | 000,000,000 | ---D | M] -- H:\Daten
[2012/05/15 13:39:34 | 000,000,000 | ---D | M] -- H:\DATEV
[2012/05/15 14:07:43 | 000,000,000 | ---D | M] -- H:\DDS
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\Documents and Settings
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\Dokumente und Einstellungen
[2012/05/08 16:33:16 | 000,000,000 | ---D | M] -- H:\Drivers
[2012/12/12 03:26:53 | 000,000,000 | ---D | M] -- H:\Firefox
[2013/01/29 18:39:14 | 000,000,000 | -HSD | M] -- H:\found.000
[2012/05/08 16:33:16 | 000,000,000 | ---D | M] -- H:\Hotfix
[2012/12/04 04:57:29 | 000,000,000 | ---D | M] -- H:\I.S.Bau_outluck
[2012/05/08 06:44:18 | 000,000,000 | ---D | M] -- H:\Intel
[2013/01/29 15:19:44 | 000,000,000 | ---D | M] -- H:\Kaspersky Rescue Disk 10.0
[2012/05/08 07:35:54 | 000,000,000 | RH-D | M] -- H:\MSOCache
[2013/01/29 23:30:45 | 000,000,000 | ---D | M] -- H:\NBRT
[2009/07/13 22:20:08 | 000,000,000 | ---D | M] -- H:\PerfLogs
[2012/12/12 14:06:10 | 000,000,000 | R--D | M] -- H:\Program Files
[2012/12/12 14:03:10 | 000,000,000 | R--D | M] -- H:\Program Files (x86)
[2013/01/29 18:15:23 | 000,000,000 | -H-D | M] -- H:\ProgramData
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\Programme
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\Recovery
[2013/01/24 10:34:45 | 000,000,000 | -HSD | M] -- H:\System Volume Information
[2012/05/08 06:40:27 | 000,000,000 | R--D | M] -- H:\Users
[2013/01/29 18:19:56 | 000,000,000 | ---D | M] -- H:\Windows
[2012/05/08 06:47:23 | 000,000,000 | ---D | M] -- H:\winki
 
< %PROGRAMFILES%\*.exe >
[2003/05/24 11:38:52 | 000,224,768 | ---- | M] () -- H:\Program Files\ToDoList2003.exe
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- H:\Windows\System32\drivers\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- H:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- H:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- H:\Windows\System32\drivers\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- H:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- H:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- H:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- H:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- H:\Windows\System32\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- H:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 00:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- H:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- H:\Windows\explorer.exe
[2011/02/25 01:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- H:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 01:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- H:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 22:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- H:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- H:\Windows\SysWOW64\explorer.exe
[2011/02/25 00:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- H:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 22:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- H:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 22:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- H:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 22:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- H:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 01:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- H:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- H:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- H:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- H:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 22:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- H:\Windows\System32\netlogon.dll
[2010/11/20 22:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- H:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 22:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- H:\Windows\SysWOW64\netlogon.dll
[2010/11/20 22:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- H:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 01:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- H:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- H:\Windows\System32\drivers\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- H:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- H:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 22:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- H:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 22:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- H:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010/11/20 22:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- H:\Windows\SysWOW64\scecli.dll
[2010/11/20 22:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- H:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 22:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- H:\Windows\System32\scecli.dll
[2010/11/20 22:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- H:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 22:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- H:\Windows\SysWOW64\user32.dll
[2010/11/20 22:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- H:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010/11/20 22:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- H:\Windows\System32\user32.dll
[2010/11/20 22:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- H:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 22:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- H:\Windows\SysWOW64\userinit.exe
[2010/11/20 22:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- H:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 22:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- H:\Windows\System32\userinit.exe
[2010/11/20 22:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- H:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 22:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- H:\Windows\System32\winlogon.exe
[2010/11/20 22:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- H:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- H:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 19:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- H:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
Dann habe ich dummerweise (verbunden mit starkem Schlafmangel) folgenden Fix geladen und erst anschließend gesehen, dass die Fixes nicht allgemein gültig sind. Es dürfte aber (laut Log) kein Schaden entstanden sein. Ein Full-Backup hatte ich vor allen Aktionen sowieso angelegt. http://www.trojaner-board.de/130196-...otl-clean.html

Code:
ATTFilter
:OTL
O4 -  HKCU..\Run: [AdobeBridge] File not found 
O6 -  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:  HonorAutoRunSetting = 1 
O6 -  HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:  NoDriveTypeAutoRun = 181 
O20 - HKCU Winlogon: Shell - (C:\Dokumente und  Einstellungen\*****\Anwendungsdaten\skype.dat) - File not found 

:Files   C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Dokumente  und Einstellungen\All Users\Anwendungsdaten\*.exe
C:\Dokumente und  Einstellungen\*****\Anwendungsdaten\*.exe
C:\Dokumente und  Einstellungen\*****\Lokale Einstellungen\Anwendungsdaten\*.exe
C:\Dokumente  und Einstellungen\*****\Lokale  Einstellungen\Anwendungsdaten\*.tmp
C:\Dokumente und  Einstellungen\*****\Lokale Einstellungen\Temp\*.exe
C:\Dokumente und  Einstellungen\*****\*.exe
C:\Dokumente und  Einstellungen\*****\Startmenü\Programme\Autostart\ctfmon.lnk
C:\Dokumente und  Einstellungen\All Users\Startmenü\Programme\Autostart\ctfmon.lnk
C:\Dokumente  und Einstellungen\*****\Lokale  Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\
ipconfig /flushdns  /c
:Commands
[emptytemp]
Das Ergebnis war natürlich fehlerhaft:
Code:
ATTFilter
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Dokumente und  Einstellungen\Matthias\Anwendungsdaten\skype.dat deleted successfully.
Error: Unable to interpret <:Files   C:\ProgramData\*.exe> in the current context!
Error: Unable to interpret <C:\ProgramData\*.dll> in the current context!
Error: Unable to interpret <C:\ProgramData\*.tmp> in the current context!
Error: Unable to interpret <C:\ProgramData\TEMP> in the current context!
Error: Unable to interpret <C:\Dokumente  und Einstellungen\All Users\Anwendungsdaten\*.exe> in the current context!
Error: Unable to interpret <C:\Dokumente und  Einstellungen\Matthias\Anwendungsdaten\*.exe> in the current context!
Error: Unable to interpret <C:\Dokumente und  Einstellungen\Matthias\Lokale Einstellungen\Anwendungsdaten\*.exe> in the current context!
Error: Unable to interpret <C:\Dokumente  und Einstellungen\Matthias\Lokale  Einstellungen\Anwendungsdaten\*.tmp> in the current context!
Error: Unable to interpret <C:\Dokumente und  Einstellungen\Matthias\Lokale Einstellungen\Temp\*.exe> in the current context!
Error: Unable to interpret <C:\Dokumente und  Einstellungen\Matthias\*.exe> in the current context!
Error: Unable to interpret <C:\Dokumente und  Einstellungen\Matthias\Startmenü\Programme\Autostart\ctfmon.lnk> in the current context!
Error: Unable to interpret <C:\Dokumente und  Einstellungen\All Users\Startmenü\Programme\Autostart\ctfmon.lnk> in the current context!
Error: Unable to interpret <C:\Dokumente  und Einstellungen\Matthias\Lokale  Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\> in the current context!
Error: Unable to interpret <ipconfig /flushdns  /c> in the current context!
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
 
User: Matthias
->Temp folder emptied: 239735100 bytes
->Temporary Internet Files folder emptied: 797974491 bytes
->Java cache emptied: 1238094 bytes
->Flash cache emptied: 18417 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 367831411 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36029979 bytes
 
Total Files Cleaned = 1,376.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 01302013_020558
Während ich diesen Post verfasst habe, habe ich nochmal einen OTLPE Scan ohne Custom Fixes laufen lassen, um den aktuellen Stand zu zeigen:
Code:
ATTFilter
OTL logfile created on: 1/30/2013 2:26:05 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 85.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = H: | %SystemRoot% = H:\Windows | %ProgramFiles% = H:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.82 Mb Free Space | 75.82% Space Free | Partition Type: NTFS
Drive H: | 465.66 Gb Total Space | 386.45 Gb Free Space | 82.99% Space Free | Partition Type: NTFS
Drive I: | 1.87 Gb Total Space | 1.84 Gb Free Space | 98.54% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012/09/12 14:21:48 | 000,368,896 | ---- | M] (Microsoft Corporation) [On_Demand] -- H:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012/09/12 14:21:48 | 000,022,072 | ---- | M] (Microsoft Corporation) [Auto] -- H:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/09/16 13:47:00 | 001,048,576 | ---- | M] ( ) [Auto] -- H:\Windows\System32\LMabcoms.exe -- (lmab_device)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- H:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- H:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV - [2013/01/09 15:40:28 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- H:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/05/30 12:25:15 | 000,040,960 | ---- | M] () [Auto] -- H:\Users\Matthias\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2012/04/04 00:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto] -- H:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/03/19 16:44:20 | 000,276,248 | ---- | M] (Intel Corporation) [On_Demand] -- H:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) Intel(R)
SRV - [2012/03/19 06:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) [Auto] -- H:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011/12/08 19:20:00 | 000,079,872 | ---- | M] (DATEV eG) [Auto] -- H:\DATEV\PROGRAMM\B0001442\PSNTServ.exe -- (DatevPrintService)
SRV - [2011/07/24 19:49:00 | 000,172,640 | ---- | M] (DATEV eG) [On_Demand] -- H:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)
SRV - [2011/02/21 23:19:12 | 002,656,280 | R--- | M] (Intel Corporation) [Auto] -- H:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2011/02/21 23:19:08 | 000,326,168 | R--- | M] (Intel Corporation) [Auto] -- H:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010/09/16 13:47:00 | 000,593,920 | ---- | M] ( ) [Auto] -- H:\Windows\SysWow64\LMabcoms.exe -- (lmab_device)
SRV - [2010/03/18 06:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- H:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- H:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/08/30 15:03:48 | 000,128,456 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- H:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012/03/19 16:32:04 | 014,745,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/06/10 01:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- H:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/10/19 03:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010/09/30 14:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/09/30 14:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2009/11/17 18:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- H:\Windows\System32\drivers\MBfilt64.sys -- (MBfilt)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- H:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/04/16 07:49:34 | 000,028,416 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand] -- H:\Windows\System32\drivers\RimUsb_AMD64.sys -- (RimUsb)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\Matthias_ON_H\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
IE - HKU\Matthias_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\Matthias_ON_H\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKU\Matthias_ON_H\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - Reg Error: Key error. File not found
IE - HKU\Matthias_ON_H\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: H:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@canon.com/EPPEX: H:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: H:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: H:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: H:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: H:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: H:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: H:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: H:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: H:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - H:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - H:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - H:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - H:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - H:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - H:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKU\Matthias_ON_H\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - H:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\Matthias_ON_H\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - H:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [LMPSSDMON] H:\Program Files\Lexmark\Monitor\ACB\LMabMON.exe ()
O4:64bit: - HKLM..\Run: [MSC] H:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Ocs_SM] H:\Users\Matthias\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4:64bit: - HKLM..\Run: [RTHDVCPL] H:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [WrtMon.exe] H:\Windows\System32\spool\drivers\x64\3\WrtMon.exe ()
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] H:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [Super-Charger] H:\Program Files (x86)\MSI\Super-Charger\StartSuperCharger.exe (MSI)
O4 - HKU\LocalService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Matthias_ON_H..\Run: [LMab1err] H:\Program Files\Lexmark\ErrorApp\lmab1err.exe ( )
O4 - HKU\NetworkService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_H..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_H..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\Matthias_ON_H\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - H:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Matthias_ON_H Winlogon: Shell - (explorer.exe) - H:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\Matthias_ON_H Winlogon: Shell - (C:\Users\Matthias\AppData\Roaming\skype.dat) - H:\Users\Matthias\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/30 02:05:58 | 000,000,000 | ---D | C] -- H:\_OTL
[2013/01/29 23:30:45 | 000,000,000 | ---D | C] -- H:\NBRT
[2013/01/29 18:39:14 | 000,000,000 | -HSD | C] -- H:\found.000
[2013/01/29 18:11:58 | 000,000,000 | ---D | C] -- H:\ProgramData\HitmanPro
[2013/01/29 18:11:46 | 000,000,000 | ---D | C] -- H:\Windows\Minidump
[2013/01/29 16:43:28 | 000,000,000 | ---D | C] -- H:\cce_linux
[2013/01/29 13:29:38 | 000,000,000 | ---D | C] -- H:\Kaspersky Rescue Disk 10.0
[2013/01/09 07:09:45 | 000,750,592 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\win32spl.dll
[2013/01/09 07:09:45 | 000,492,032 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\win32spl.dll
[2013/01/09 07:09:32 | 000,307,200 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\ncrypt.dll
[2013/01/09 07:09:31 | 000,800,768 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\usp10.dll
[2013/01/09 07:09:31 | 000,220,160 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\ncrypt.dll
[2013/01/09 07:09:28 | 002,746,368 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\gameux.dll
[2013/01/09 07:09:28 | 002,576,384 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\gameux.dll
[2013/01/09 07:09:28 | 000,441,856 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\Wpc.dll
[2013/01/09 07:09:28 | 000,046,592 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\fpb.rs
[2013/01/09 07:09:28 | 000,046,592 | ---- | C] (Microsoft) -- H:\Windows\System32\fpb.rs
[2013/01/09 07:09:28 | 000,045,568 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\oflc-nz.rs
[2013/01/09 07:09:28 | 000,045,568 | ---- | C] (Microsoft) -- H:\Windows\System32\oflc-nz.rs
[2013/01/09 07:09:28 | 000,044,544 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\pegibbfc.rs
[2013/01/09 07:09:28 | 000,044,544 | ---- | C] (Microsoft) -- H:\Windows\System32\pegibbfc.rs
[2013/01/09 07:09:28 | 000,043,520 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\csrr.rs
[2013/01/09 07:09:28 | 000,043,520 | ---- | C] (Microsoft) -- H:\Windows\System32\csrr.rs
[2013/01/09 07:09:28 | 000,040,960 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\cob-au.rs
[2013/01/09 07:09:28 | 000,040,960 | ---- | C] (Microsoft) -- H:\Windows\System32\cob-au.rs
[2013/01/09 07:09:28 | 000,030,720 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\usk.rs
[2013/01/09 07:09:28 | 000,030,720 | ---- | C] (Microsoft) -- H:\Windows\System32\usk.rs
[2013/01/09 07:09:28 | 000,021,504 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\grb.rs
[2013/01/09 07:09:28 | 000,021,504 | ---- | C] (Microsoft) -- H:\Windows\System32\grb.rs
[2013/01/09 07:09:28 | 000,020,480 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\pegi-pt.rs
[2013/01/09 07:09:28 | 000,020,480 | ---- | C] (Microsoft) -- H:\Windows\System32\pegi-pt.rs
[2013/01/09 07:09:28 | 000,020,480 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\pegi.rs
[2013/01/09 07:09:28 | 000,020,480 | ---- | C] (Microsoft) -- H:\Windows\System32\pegi.rs
[2013/01/09 07:09:28 | 000,015,360 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\djctq.rs
[2013/01/09 07:09:28 | 000,015,360 | ---- | C] (Microsoft) -- H:\Windows\System32\djctq.rs
[2013/01/09 07:09:27 | 000,308,736 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\Wpc.dll
[2013/01/09 07:09:27 | 000,055,296 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\cero.rs
[2013/01/09 07:09:27 | 000,055,296 | ---- | C] (Microsoft) -- H:\Windows\System32\cero.rs
[2013/01/09 07:09:27 | 000,051,712 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\esrb.rs
[2013/01/09 07:09:27 | 000,051,712 | ---- | C] (Microsoft) -- H:\Windows\System32\esrb.rs
[2013/01/09 07:09:27 | 000,023,552 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\oflc.rs
[2013/01/09 07:09:27 | 000,023,552 | ---- | C] (Microsoft) -- H:\Windows\System32\oflc.rs
[2013/01/09 07:09:27 | 000,020,480 | ---- | C] (Microsoft) -- H:\Windows\SysWow64\pegi-fi.rs
[2013/01/09 07:09:27 | 000,020,480 | ---- | C] (Microsoft) -- H:\Windows\System32\pegi-fi.rs
[2013/01/09 07:09:09 | 000,424,448 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\KernelBase.dll
[2013/01/09 07:09:07 | 001,161,216 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\kernel32.dll
[2013/01/09 07:09:07 | 000,362,496 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\wow64win.dll
[2013/01/09 07:09:07 | 000,338,432 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\conhost.exe
[2013/01/09 07:09:07 | 000,243,200 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\wow64.dll
[2013/01/09 07:09:07 | 000,215,040 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\winsrv.dll
[2013/01/09 07:09:07 | 000,016,384 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\ntvdm64.dll
[2013/01/09 07:09:07 | 000,014,336 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\ntvdm64.dll
[2013/01/09 07:09:07 | 000,013,312 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\wow64cpu.dll
[2013/01/09 07:09:07 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 07:09:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 07:09:07 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013/01/09 07:09:07 | 000,005,120 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\wow32.dll
[2013/01/09 07:09:07 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 07:09:07 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 07:09:07 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013/01/09 07:09:07 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 07:09:07 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/01/09 07:09:07 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 07:09:07 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 07:09:07 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013/01/09 07:09:06 | 000,025,600 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\setup16.exe
[2013/01/09 07:09:06 | 000,007,680 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\instnm.exe
[2013/01/09 07:09:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/01/09 07:09:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/01/09 07:09:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 07:09:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 07:09:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013/01/09 07:09:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 07:09:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 07:09:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- H:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013/01/09 07:09:06 | 000,002,048 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\user.exe
[2013/01/09 07:08:57 | 000,068,608 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\taskhost.exe
[2012/12/12 14:01:23 | 001,044,480 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabserv.dll
[2012/12/12 14:01:23 | 000,802,816 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabcomc.dll
[2012/12/12 14:01:23 | 000,376,832 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabcomm.dll
[2012/12/12 14:01:23 | 000,356,352 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabhcp.dll
[2012/12/12 14:01:22 | 000,593,920 | ---- | C] ( ) -- H:\Windows\SysWow64\lmabcoms.exe
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/29 18:48:21 | 000,067,584 | --S- | M] () -- H:\Windows\bootstat.dat
[2013/01/29 18:48:08 | 000,000,004 | ---- | M] () -- H:\Users\Matthias\AppData\Roaming\skype.ini
[2013/01/29 18:45:42 | 000,001,110 | ---- | M] () -- H:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/01/29 18:45:29 | 3151,982,592 | -HS- | M] () -- H:\hiberfil.sys
[2013/01/29 18:39:50 | 000,003,552 | ---- | M] () -- H:\bootsqm.dat
[2013/01/29 18:27:32 | 000,026,704 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/29 18:27:32 | 000,026,704 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/29 18:19:56 | 356,086,300 | ---- | M] () -- H:\Windows\MEMORY.DMP
[2013/01/28 03:40:00 | 000,000,884 | ---- | M] () -- H:\Windows\tasks\Adobe Flash Player Updater.job
[2013/01/26 14:17:00 | 000,001,114 | ---- | M] () -- H:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/01/26 09:01:07 | 000,000,282 | ---- | M] () -- H:\Windows\tasks\RegClean Pro_DEFAULT.job
[2013/01/09 15:40:26 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- H:\Windows\SysWow64\FlashPlayerApp.exe
[2013/01/09 15:40:26 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- H:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/01/09 15:04:34 | 000,484,736 | ---- | M] () -- H:\Windows\System32\FNTCACHE.DAT
[2013/01/09 07:29:24 | 001,846,516 | ---- | M] () -- H:\Windows\SysWow64\PerfStringBackup.INI
[2013/01/09 07:29:24 | 000,798,090 | ---- | M] () -- H:\Windows\System32\perfh007.dat
[2013/01/09 07:29:24 | 000,736,168 | ---- | M] () -- H:\Windows\System32\perfh009.dat
[2013/01/09 07:29:24 | 000,185,996 | ---- | M] () -- H:\Windows\System32\perfc007.dat
[2013/01/09 07:29:24 | 000,149,068 | ---- | M] () -- H:\Windows\System32\perfc009.dat
[2013/01/06 16:55:19 | 000,001,160 | ---- | M] () -- H:\Users\Matthias\Desktop\AR_2013 - Verknüpfung.lnk
 
========== Files Created - No Company Name ==========
 
[2013/01/29 18:39:50 | 000,003,552 | ---- | C] () -- H:\bootsqm.dat
[2013/01/29 18:11:43 | 356,086,300 | ---- | C] () -- H:\Windows\MEMORY.DMP
[2013/01/26 14:24:28 | 000,000,004 | ---- | C] () -- H:\Users\Matthias\AppData\Roaming\skype.ini
[2013/01/06 16:55:19 | 000,001,160 | ---- | C] () -- H:\Users\Matthias\Desktop\AR_2013 - Verknüpfung.lnk
[2012/12/12 14:03:23 | 000,028,672 | ---- | C] () -- H:\Windows\hookdllX.dll
[2012/12/12 14:03:23 | 000,011,776 | ---- | C] () -- H:\Windows\SysWow64\pmsbfn32.dll
[2012/05/15 14:48:44 | 000,000,028 | ---- | C] () -- H:\Windows\ODBC.INI
[2012/05/15 13:39:37 | 000,000,021 | ---- | C] () -- H:\Windows\DvInesKurusOleServer003.INI
[2012/05/15 13:28:39 | 000,000,111 | ---- | C] () -- H:\Windows\dvinesinstalllocation001.INI
[2012/05/15 13:26:41 | 000,000,112 | ---- | C] () -- H:\Windows\Startup.INI
[2012/05/09 11:33:42 | 001,846,516 | ---- | C] () -- H:\Windows\SysWow64\PerfStringBackup.INI
[2012/05/08 07:02:25 | 000,047,616 | ---- | C] () -- H:\Users\Matthias\AppData\Roaming\skype.dat
[2012/05/08 06:44:32 | 000,145,804 | ---- | C] () -- H:\Windows\SysWow64\igcompkrng600.bin
[2012/03/19 16:31:16 | 000,963,912 | ---- | C] () -- H:\Windows\SysWow64\igkrng600.bin
[2012/03/19 16:31:16 | 000,261,208 | ---- | C] () -- H:\Windows\SysWow64\igfcg600m.bin
[2012/03/19 16:25:58 | 000,058,880 | ---- | C] () -- H:\Windows\SysWow64\igdde32.dll
[2012/03/19 15:21:14 | 013,212,672 | ---- | C] () -- H:\Windows\SysWow64\ig4icd32.dll
[2010/11/20 22:24:49 | 000,252,928 | ---- | C] () -- H:\Windows\SysWow64\DShowRdpFilter.dll
[2009/09/30 05:05:48 | 000,290,816 | ---- | C] () -- H:\Windows\SysWow64\nsldap32v60.dll
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- H:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- H:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- H:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- H:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- H:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- H:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- H:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- H:\Windows\SysWow64\mlang.dat
[2008/10/30 11:00:22 | 000,048,640 | ---- | C] () -- H:\Windows\SysWow64\nsldapssl32v60.dll
[2008/10/30 10:59:24 | 000,025,088 | ---- | C] () -- H:\Windows\SysWow64\nsldappr32v60.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- H:\Windows\SysWow64\nsldapssl32v50.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- H:\Windows\SysWow64\nsldappr32v50.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- H:\Windows\SysWow64\nsldap32v50.dll
[2003/05/24 11:38:52 | 000,224,768 | ---- | C] () -- H:\Program Files\ToDoList2003.exe
[1999/01/19 08:18:30 | 000,110,080 | ---- | C] () -- H:\Windows\SysWow64\LFPNG60N.DLL
[1999/01/19 08:18:30 | 000,046,080 | ---- | C] () -- H:\Windows\SysWow64\LFTIF60N.DLL
[1999/01/19 08:18:30 | 000,043,008 | ---- | C] () -- H:\Windows\SysWow64\LTFIL60N.DLL
[1999/01/19 08:18:30 | 000,020,480 | ---- | C] () -- H:\Windows\SysWow64\LFPSD60N.DLL
[1999/01/19 08:18:30 | 000,019,968 | ---- | C] () -- H:\Windows\SysWow64\LFTGA60N.DLL
[1999/01/19 08:18:30 | 000,019,456 | ---- | C] () -- H:\Windows\SysWow64\LFWPG60N.DLL
[1999/01/19 08:18:30 | 000,019,456 | ---- | C] () -- H:\Windows\SysWow64\LFWMF60N.DLL
[1999/01/19 08:18:28 | 000,176,128 | ---- | C] () -- H:\Windows\SysWow64\LFFAX60N.DLL
[1999/01/19 08:18:28 | 000,141,824 | ---- | C] () -- H:\Windows\SysWow64\LFCMP60N.DLL
[1999/01/19 08:18:28 | 000,023,552 | ---- | C] () -- H:\Windows\SysWow64\LFPCX60N.DLL
[1999/01/19 08:18:28 | 000,022,528 | ---- | C] () -- H:\Windows\SysWow64\LFPCT60N.DLL
[1999/01/19 08:18:28 | 000,022,528 | ---- | C] () -- H:\Windows\SysWow64\LFEPS60N.DLL
[1999/01/19 08:18:28 | 000,022,016 | ---- | C] () -- H:\Windows\SysWow64\LFBMP60N.DLL
[1999/01/19 08:18:28 | 000,018,432 | ---- | C] () -- H:\Windows\SysWow64\LFMSP60N.DLL
[1999/01/19 08:18:28 | 000,017,920 | ---- | C] () -- H:\Windows\SysWow64\LFMAC60N.DLL
[1995/02/14 17:11:00 | 000,017,920 | ---- | C] () -- H:\Windows\SysWow64\IMPLODE.DLL
 
========== LOP Check ==========
 
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Application Data
[2012/12/12 03:16:45 | 000,000,000 | ---D | M] -- H:\ProgramData\Ask
[2012/05/09 11:51:26 | 000,000,000 | ---D | M] -- H:\ProgramData\Canneverbe Limited
[2012/05/09 12:42:30 | 000,000,000 | -H-D | M] -- H:\ProgramData\CanonBJ
[2012/06/10 02:58:05 | 000,000,000 | -H-D | M] -- H:\ProgramData\CanonEPP
[2012/06/10 02:58:05 | 000,000,000 | -H-D | M] -- H:\ProgramData\CanonIJEPPEX2
[2012/05/15 13:59:14 | 000,000,000 | ---D | M] -- H:\ProgramData\DATEV
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Documents
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Dokumente
[2012/05/20 12:58:04 | 000,000,000 | ---D | M] -- H:\ProgramData\elsterformular
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favorites
[2013/01/29 18:11:58 | 000,000,000 | ---D | M] -- H:\ProgramData\HitmanPro
[2012/10/19 04:57:36 | 000,000,000 | ---D | M] -- H:\ProgramData\PDF Writer
[2012/05/15 13:55:41 | 000,000,000 | ---D | M] -- H:\ProgramData\SkyCom
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Start Menu
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Startmenü
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Templates
[2012/05/08 06:40:19 | 000,000,000 | -HSD | M] -- H:\ProgramData\Vorlagen
[2013/01/26 09:01:07 | 000,000,282 | ---- | M] () -- H:\Windows\Tasks\RegClean Pro_DEFAULT.job
[2012/12/26 13:27:08 | 000,000,290 | ---- | M] () -- H:\Windows\Tasks\RegClean Pro_UPDATES.job
[2012/12/08 10:30:16 | 000,032,640 | ---- | M] () -- H:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
Ich wäre euch verdammt dankbar für einen passenden Fix für diesen Fall! Mein erster Eindruck von dem Trojaner-Board ist echt genial, ohne euch wäre die Windows-Welt aufgeschmissen!

Viele Grüße,
Daniel

 

Themen zu Interpretation des Log-Files von OTLPE - GVU-Trojaner
adobe, adobe flash player, autorun, bho, dateien, defender, error, fehler, flash player, format, logfile, logfile otlpe gvu trojaner fix, microsoft, monitor, msn, nvidia, plug-in, programm, realtek, regclean, regclean pro, registry, remote user, rundll, scan, security, software, temp, windows, windows media player


« Log Files von OTL, Malewarebytes und Kaspersky nach GVU Trojaner | GVU Trojaner auf Windows Vista Rechner »


Ähnliche Themen: Interpretation des Log-Files von OTLPE - GVU-Trojaner


  1. Log Files Beurteilung: insb. Vorgehen bei Meldung in Log Files "Files to move or delete:..."
    Log-Analyse und Auswertung - 20.05.2014 (15)
  2. BKA Trojaner OTLPE File
    Plagegeister aller Art und deren Bekämpfung - 10.05.2014 (8)
  3. Spybot 2 Ergebnis Interpretation user agent, google url
    Plagegeister aller Art und deren Bekämpfung - 31.01.2014 (3)
  4. Trojaner Bundespolizei und OTLPE
    Plagegeister aller Art und deren Bekämpfung - 31.08.2013 (11)
  5. BKA Trojaner: Otlpe fix.txt
    Log-Analyse und Auswertung - 09.04.2013 (8)
  6. GVU Trojaner entfernen - Interpretation der Logfiles für OTL clean
    Log-Analyse und Auswertung - 05.02.2013 (19)
  7. AKM-Trojaner, OTLPE
    Log-Analyse und Auswertung - 31.05.2012 (20)
  8. GVU Trojaner, OTLPE von Cd
    Plagegeister aller Art und deren Bekämpfung - 28.03.2012 (17)
  9. (2x) GVU Trojaner, OTLPE von Cd
    Mülltonne - 26.03.2012 (3)
  10. BKA und GEMA Virus auf dem Laptop. Mit OTLPE gebootet,hier die Log Files bzw OTL.txt
    Log-Analyse und Auswertung - 24.03.2012 (1)
  11. BKA-Trojaner - mit OTLPE von CD gebootet - was nun?
    Plagegeister aller Art und deren Bekämpfung - 24.08.2011 (19)
  12. BKA-Trojaner - Probleme mit OTLPE
    Plagegeister aller Art und deren Bekämpfung - 08.08.2011 (4)
  13. OTLPE log bei BKA-Trojaner
    Log-Analyse und Auswertung - 15.07.2011 (7)
  14. BKA-Trojaner OTLPE-Log-Auswertung
    Log-Analyse und Auswertung - 03.07.2011 (37)
  15. Interpretation des Logfiles.
    Log-Analyse und Auswertung - 01.02.2010 (1)
  16. Neue HiJackThis File und die Bitte um deren Interpretation
    Mülltonne - 07.02.2009 (0)
  17. bitte um logfile interpretation
    Plagegeister aller Art und deren Bekämpfung - 03.02.2009 (5)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Interpretation des Log-Files von OTLPE - GVU-Trojaner - Hallo liebes Trojaner-Board-Team, ich habe hier einen Rechner, der seit gestern vom GVU Trojaner befallen ist. Betriebssystem Win7 Benutzer mit eingeschränkter Berechtigung Abgesicherter Modus läßt sich für diesen Benuzter nicht - Interpretation des Log-Files von OTLPE - GVU-Trojaner...
Archiv
Du betrachtest: Interpretation des Log-Files von OTLPE - GVU-Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131