Hallo
als erstes möchte ich eun Hallo hier ins Forum werfen. Habe mich eben neu angemedet und hoffe auf Hilfe da ich selbst nicht mehr weiter komme.

Ich habe heute ein Online Scan mit Symantec gemacht, Ad Aware laufen lassen und Anti Vir. Jeweils alles upgedatet. Alle drei Programme haben keine Viren gefunden. Eben schalte ich den PC ein starte den Firefox und klack Anti Vir geht auf. Meldung war das sich hier C:\WINDOWS\system32\geebb.dll ein Trojaner verbirgt. Hab die Datei dann gelöscht.

Da ich aber auf nummer sicher gehen möchte, da ich viele Dateien und Programm (für Privat als auch geschäftliche nutzen) auf dem Rechner habe und ich kein Risiko eingehnen möchte poste ich hier mal mein HijackThis Report.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:37:14, on 08.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
D:\EXT~1.HAR\SIDEWI~1\common\swtrayv4.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Ext.Hardware\Logitech Wheel\lwemon.exe
C:\Dokumente und Einstellungen\xxx\Desktop\EasyToolz.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4ss.exe
D:\Programme\3ds Max 8\mentalray\satellite\raysat_3dsmax8server.exe
D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4gui.exe
D:\Programme\3ds Max 8\plugins\Brazil\sfmgr\sfmgr.exe
D:\Programme\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4gui.exe
D:\Programme\ICQ\Icq.exe
D:\Programme\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe Reader 7\ActiveX\AcroIEHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: (no name) - {740267D5-4FD0-4E34-AEA6-740E4C68D2AA} - C:\WINDOWS\system32\efcyabx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SideWinderTrayV4] d:\EXT~1.HAR\SIDEWI~1\common\swtrayv4.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_03\bin\jusched.exe "
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "D:\Ext.Hardware\Logitech Wheel\lwemon.exe" /noui
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: EasyToolz.lnk = C:\Dokumente und Einstellungen\xxx\Desktop\EasyToolz.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = D:\Programme\Adobe Reader 7\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office 2000\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Spiele\Party Poker\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Spiele\Party Poker\PartyPokerNet\RunPF.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC398E74-4F33-422B-9881-3638C380B8CA}: NameServer = 217.237.151.142 217.237.150.188
O20 - Winlogon Notify: efcyabx - C:\WINDOWS\SYSTEM32\efcyabx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4ss.exe
O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - D:\Programme\3ds Max 8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - Service: CaReTaKeR-CT NetMgr 1.2.1 (sfmgr) - Unknown owner - D:\Programme\3ds Max 8\plugins\Brazil\sfmgr\sfmgr.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

--
End of file - 7042 bytes

Hoffe ihr könnt mir hier weiter helfen, 6 Jahre ohne Virus und Trojaner und dann das

mfg
Marco

Hi
eben wieder ein Anti Vir Pop Up bekommen.

Habe die Datei gelöscht.

Komisch finde ich das laut Dieser Seite es sich immer um Browser Helper Object (BHO) Dateien handelt.

mfg
Marco

Grüße zurück,

alles hast du noch nicht erwischt. Fixe mit HJT folgende Einträge:

O2 - BHO: (no name) - {740267D5-4FD0-4E34-AEA6-740E4C68D2AA} - C:\WINDOWS\system32\efcyabx.dll
O20 - Winlogon Notify: efcyabx - C:\WINDOWS\SYSTEM32\efcyabx.dll

Dann gehe in dem Programm HJT auf Config -> Misc Tools -> delete file on reboot: C:\windows\system32\efcyabx.dll. Noch keinen Neustart.

1.Vundofix

* Lade dir vundofix.exe
* Doppelklick VundoFix.exe
* Klicke "Scan" --> Vundo button.
* Nach dem Scannen, klicke den "Remove" Vundo button.
* Man wird nun gefragt, ob man "remove" will --> klicke YES
* Danach werden alle Desktop-Symbole verschwinden
* Dann wird man gefragt, ob der PC neustarten soll --> klicke OK.

2. Erstelle eine log mit filelist.zip und poste bitte die Einträge der letzten 30 Tage.

3. Silentrunners Logfile
-Lade dir das Tool -> Silentrunners
-Entpacke das Script in einen Ordner deiner Wahl
-Doppelklick auf -> Silent Runners -> Option Supplementary Searches auswählen
-System wird nun überprüft, nach Beendigung wird eine Log-Datei erstellt
(Dein Antiviren-Scanner könnte eine Meldung wegen „bösartigem Script“
erstellen, ignoriere dieses und arbeite weiter!)
-Dann öffne die Silent Runners xxx.txt mit einem Editor und kopiere den gesamten Inhalt ab und füge ihn in einen Beitrag ein.
(Strg+A markieren -> Strg+C kopieren -> Strg+V einfügen)

4. Lade dir autoruns runter, entpacke das zip-Archiv und kopiere die autorunsc.exe nach c:\.

Kopiere den folgenden Text, speicher ihn als autoruns.bat ab.

echo off
cd %systemdrive%
cd\
reg add HKCU\Software\Sysinternals\autoruns /f /v EulaAccepted /t REG_DWORD /d 1
autorunsc -acmv >> %temp%\autoruns.log
findstr /v (Verified) %temp%\autoruns.log >> %temp%\autoruns.txt
notepad %temp%\autoruns.txt
exit
         

Starte die autoruns.bat und poste das log. Autoruns baut eine Verbindung ins Netz zur Signaturprüfung auf, also gib bei deiner Firewall bitte grünes Licht.

Schaun mer mal...

Hi
also bin so vorgegangen
1. die zwei dateien ein häckchen gesetzt
2. auf fix checked --> yes
3. config -> Misc Tools -> delete file on reboot: C:\windows\system32\efcyabx.dll keinen neustart gemacht

4. VundoFix ausgeführt --> keine dateien gefunden worden
5. Filelist Log --> habe einfach doppelklick auf die bat gemacht und di eltzten 3ß tage abgezählt, war das richtig so ?.
----- Root -----------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\

08.12.2007 20:17 1.610.612.736 pagefile.sys
08.12.2007 20:15 210 VundoFix.txt
01.11.2006 20:21 2.824 LGSInst.Log
01.08.2006 12:01 44 01_[HTTP_1_0 200 OK] http___62_75_176_40_80_bigfm-cbr-128.wav
24.07.2006 15:27 44 01_bigFM.wav
23.05.2006 23:28 227 boot.ini
21.03.2006 15:21 34 hcwclear.txt
21.03.2006 01:48 251.712 ntldr
21.03.2006 00:41 0 MSDOS.SYS
21.03.2006 00:41 0 AUTOEXEC.BAT
21.03.2006 00:41 0 CONFIG.SYS
21.03.2006 00:41 0 IO.SYS
04.08.2004 13:00 4.952 bootfont.bin
04.08.2004 13:00 47.564 NTDETECT.COM
14 Datei(en) 1.610.920.347 Bytes
0 Verzeichnis(se), 8.082.821.120 Bytes frei

----- System32 -------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\WINDOWS\system32

08.12.2007 20:19 2.206 wpa.dbl
08.12.2007 03:25 130.096 FNTCACHE.DAT
08.12.2007 01:51 38.912 efcyabx.dll
17.11.2007 00:04 5.686 jupdate-1.6.0_03-b05.log
02.11.2007 08:12 18.238.072 MRT.exe
29.10.2007 16:07 373.760 xpsp3res.dll
28.10.2007 11:57 401.064 perfh009.dat
28.10.2007 11:57 62.344 perfc009.dat
28.10.2007 11:57 74.996 perfc007.dat
28.10.2007 11:57 415.470 perfh007.dat
28.10.2007 11:57 966.250 PerfStringBackup.INI
25.10.2007 17:42 8.501.248 shell32.dll
27.09.2007 14:43 107.888 CmdLineExt.dll
24.09.2007 23:31 69.632 javacpl.cpl
24.09.2007 23:31 139.264 javaws.exe
24.09.2007 22:30 135.168 javaw.exe
24.09.2007 22:30 135.168 java.exe
29.08.2007 19:10 249.852 TZLog.log
22.08.2007 13:56 671.232 wininet.dll
22.08.2007 13:56 620.032 urlmon.dll
22.08.2007 13:56 1.498.112 shdocvw.dll
22.08.2007 13:56 474.624 shlwapi.dll
22.08.2007 13:56 39.424 pngfilt.dll
22.08.2007 13:56 449.024 mshtmled.dll
22.08.2007 13:56 532.480 mstime.dll
22.08.2007 13:56 146.432 msrating.dll
22.08.2007 13:56 3.085.824 mshtml.dll
22.08.2007 13:56 357.888 dxtmsft.dll
22.08.2007 13:56 1.056.256 danim.dll
22.08.2007 13:56 205.824 dxtrans.dll

6.Silenntrunners Log erstellen wolle, musste aber erst das Windows script Hosting in der Regystrie aktivieren

Sielenntrunners Log
"Silent Runners.vbs", revision 53, Silent Runners - Adware? Disinfect, don't reformat!
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Start WingMan Profiler" = ""D:\Ext.Hardware\Logitech Wheel\lwemon.exe" /noui" ["Logitech Inc."]
"Steam" = (empty string) [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"SideWinderTrayV4" = "d:\EXT~1.HAR\SIDEWI~1\common\swtrayv4.exe" [MS]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"ATICCC" = ""C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data]
"Easy-PrintToolBox" = "C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon" ["CANON INC."]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"
"SunJavaUpdateSched" = ""C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\Programme\Adobe Reader 7\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}\(Default) = "Canon Easy Web Print Helper"
-> {HKLM...CLSID} = "EWPBrowseObject Class"
\InProcServer32\(Default) = "C:\Programme\Canon\Easy-WebPrint\EWPBrowseLoader.dll" [null data]
{740267D5-4FD0-4E34-AEA6-740E4C68D2AA}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\efcyabx.dll" [null data]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{262E6512-1611-4d54-B6F5-58A6719B31EC}" = "SigmaTel MSCN PlayerShell Hook"
-> {HKLM...CLSID} = "SigmaTel MSCN PlayerShell Hook"
\InProcServer32\(Default) = "MSCNh.dll" ["SigmaTel, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "D:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{F802F260-519B-11D1-BB5D-0060974C6013}" = "ICQ Shell Extension"
-> {HKLM...CLSID} = "ICQ Shell Extension"
\InProcServer32\(Default) = "D:\Programme\ICQ\ICQShExt.dll" ["ICQ"]
"{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}" = "Bluetooth"
-> {HKLM...CLSID} = "Bluetooth-Informationsaustausch"
\InProcServer32\(Default) = "C:\WINDOWS\system32\TosBtExt.dll" [file not found]
"{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu"
-> {HKLM...CLSID} = "IZArc DragDrop Menu"
\InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data]
"{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data]
"{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview"
-> {HKLM...CLSID} = "ACDWFTHMBPRXY"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Autodesk Shared\AcDwfThmbPrxy16.dll" ["Autodesk"]
"{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension"
-> {HKLM...CLSID} = "UnlockerShellExtension"
\InProcServer32\(Default) = "D:\Programme\Unlocker\UnlockerCOM.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{740267D5-4FD0-4E34-AEA6-740E4C68D2AA}" = "*]" (unwritable string)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\efcyabx.dll" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
<<!>> efcyabx\DLLName = "efcyabx.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "D:\Programme\Adobe Reader 7\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
tosBtShllExt\(Default) = "{6BEF3D0B-53F0-4b0d-B91C-C19ED3D4C9D1}"
-> {HKLM...CLSID} = "Bluetooth File Extenstion"
\InProcServer32\(Default) = "C:\WINDOWS\system32\TosBtShell.dll" [file not found]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "D:\Programme\7z\IZArcCM.dll" [null data]
tosBtShllExt\(Default) = "{6BEF3D0B-53F0-4b0d-B91C-C19ED3D4C9D1}"
-> {HKLM...CLSID} = "Bluetooth File Extenstion"
\InProcServer32\(Default) = "C:\WINDOWS\system32\TosBtShell.dll" [file not found]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}"
-> {HKLM...CLSID} = "UnlockerShellExtension"
\InProcServer32\(Default) = "D:\Programme\Unlocker\UnlockerCOM.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programme\WinRar\rarext.dll" [null data]

HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}"
-> {HKLM...CLSID} = "UnlockerShellExtension"
\InProcServer32\(Default) = "D:\Programme\Unlocker\UnlockerCOM.dll" [null data]


Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


Startup items in "Marco" & "All Users" startup folders:
-------------------------------------------------------

C:\Dokumente und Einstellungen\Marco\Startmenü\Programme\Autostart
"Adobe Gamma" -> shortcut to: "C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"EasyToolz" -> shortcut to: "C:\Dokumente und Einstellungen\Marco\Desktop\EasyToolz.exe" [null data]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Adobe Gamma Loader" -> shortcut to: "C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
"Adobe Reader - Schnellstart" -> shortcut to: "D:\Programme\Adobe Reader 7\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Microsoft Office" -> shortcut to: "D:\Programme\Microsoft Office 2000\Office\OSA9.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint"
-> {HKLM...CLSID} = "Easy-WebPrint"
\InProcServer32\(Default) = "C:\Programme\Canon\Easy-WebPrint\Toolband.dll" [null data]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{03C1C47F-0538-4645-8372-D3109B9FC636}\(Default) = "Easy-WebPrint"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Programme\Canon\Easy-WebPrint\Toolband.dll" [null data]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."]

{6224F700-CBA3-4071-B251-47CB894244CD}\
"ButtonText" = "ICQ Pro"
"MenuText" = "ICQ"
"Exec" = "D:\PROGRA~1\ICQ\ICQ.exe" ["ICQ Inc."]

{F4430FE8-2638-42E5-B849-800749B94EED}\
"ButtonText" = "PartyPoker.net"
"MenuText" = "PartyPoker.net"
"Exec" = "D:\Spiele\Party Poker\PartyPokerNet\RunPF.exe" [empty string]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "@C:\Programme\Messenger\Msgslang.dll,-61144"
"MenuText" = "@C:\Programme\Messenger\Msgslang.dll,-61144"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Service, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["Avira GmbH"]
AntiVir Scheduler, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Autodesk Licensing Service, Autodesk Licensing Service, ""C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe"" ["Autodesk"]
C-DillaSrv, C-DillaSrv, "C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE" ["C-Dilla Ltd"]
CaReTaKeR-CT NetMgr 1.2.1, sfmgr, "D:\Programme\3ds Max 8\plugins\Brazil\sfmgr\sfmgr.exe" [null data]
Kerio Personal Firewall 4, KPF4, ""D:\Programme\Kerio Personal Firewall\Personal Firewall 4\kpf4ss.exe"" ["Kerio Technologies"]
RaySat_3dsmax8 Server, mi-raysat_3dsmax8, ""D:\Programme\3ds Max 8\mentalray\satellite\raysat_3dsmax8server.exe"" [null data]
StarWind iSCSI Service, StarWindService, "D:\Programme\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Canon BJ Language Monitor iP3300\Driver = "CNMLM84.DLL" ["CANON INC."]
CutePDF Writer Monitor\Driver = "cpwmon2k.dll" [null data]


---------- (launch time: 2007-12-08 20:28:58)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 25 seconds, including 4 seconds for message boxes)

Dann hole bitte jetzt - falls noch nicht geschehen - den Neustart nach und poste die restlichen logs.

6. autoruns log
Entry Location,Entry,Enabled,Description,Publisher,Image Path
HKLM\System\CurrentControlSet\Services,AntiVirScheduler,enabled,"Dienst zur Planung und Steuerung von Prüf- und Updateaufgaben der AntiVir PersonalEdition Classic.","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\sched.exe"
HKLM\System\CurrentControlSet\Services,AntiVirService,enabled,"Echtzeit Virenschutz durch H+BEDV AntiVir Engine","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avguard.exe"
HKLM\System\CurrentControlSet\Services,Autodesk Licensing Service,enabled,"Anchor service for Autodesk products licensed with SafeCast","(Not verified) Autodesk","c:\programme\gemeinsame dateien\autodesk shared\service\adskscsrv.exe"
HKLM\System\CurrentControlSet\Services,C-DillaSrv,enabled,"C-Dilla RTS Service","(Not verified) C-Dilla Ltd","c:\windows\system32\drivers\cdantsrv.exe"
HKLM\System\CurrentControlSet\Services,KPF4,enabled,"Kerio Personal Firewall-Engine","(Not verified) Kerio Technologies","d:\programme\kerio personal firewall\personal firewall 4\kpf4ss.exe"
HKLM\System\CurrentControlSet\Services,mi-raysat_3dsmax8,enabled,"mental ray 3.4 Satellite",,"d:\programme\3ds max 8\mentalray\satellite\raysat_3dsmax8server.exe"
HKLM\System\CurrentControlSet\Services,sfmgr,enabled,"",,"d:\programme\3ds max 8\plugins\brazil\sfmgr\sfmgr.exe"
HKLM\System\CurrentControlSet\Services,StarWindService,enabled,"Enables network access to local devices via iSCSI protocol.","(Not verified) Rocket Division Software","d:\programme\alcohol 120%\alcohol 120\starwind\starwindservice.exe"
HKLM\System\CurrentControlSet\Services,as6eio,enabled,"",,"c:\windows\system32\drivers\as6eio.sys"
HKLM\System\CurrentControlSet\Services,Changer,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\Changer.sys"
HKLM\System\CurrentControlSet\Services,CO_Mon,enabled,"",,"c:\windows\system32\drivers\co_mon.sys"
HKLM\System\CurrentControlSet\Services,fwdrv,enabled,"","(Not verified) Kerio Technologies","c:\windows\system32\drivers\fwdrv.sys"
HKLM\System\CurrentControlSet\Services,i2omgmt,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys"
HKLM\System\CurrentControlSet\Services,khips,enabled,"Kerio Host Intrusion Prevention Driver",,"c:\windows\system32\drivers\khips.sys"
HKLM\System\CurrentControlSet\Services,lbrtfdc,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys"
HKLM\System\CurrentControlSet\Services,NuVision,enabled,"USBVision Streaming Class Driver","(Not verified) Hauppauge Computer Works","c:\windows\system32\drivers\nuvision.sys"
HKLM\System\CurrentControlSet\Services,papycpu2,enabled,"",,"c:\windows\system32\drivers\papycpu2.sys"
HKLM\System\CurrentControlSet\Services,papyjoy,enabled,"",,"c:\windows\system32\drivers\papyjoy.sys"
HKLM\System\CurrentControlSet\Services,PCIDump,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys"
HKLM\System\CurrentControlSet\Services,PDCOMP,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys"
HKLM\System\CurrentControlSet\Services,PDFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys"
HKLM\System\CurrentControlSet\Services,PDRELI,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys"
HKLM\System\CurrentControlSet\Services,PDRFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys"
HKLM\System\CurrentControlSet\Services,PxHelp20,enabled,"Px Engine Device Driver for Windows 2000/XP","(Not verified) Sonic Solutions","c:\windows\system32\drivers\pxhelp20.sys"
HKLM\System\CurrentControlSet\Services,toshidpt,enabled,"Toshiba Bluetooth HID mini port driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\toshidpt.sys"
HKLM\System\CurrentControlSet\ServicesEntry Location,Entry,Enabled,Description,Publisher,Image Path
HKLM\System\CurrentControlSet\Services,AntiVirScheduler,enabled,"Dienst zur Planung und Steuerung von Prüf- und Updateaufgaben der AntiVir PersonalEdition Classic.","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\sched.exe"
HKLM\System\CurrentControlSet\Services,AntiVirService,enabled,"Echtzeit Virenschutz durch H+BEDV AntiVir Engine","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avguard.exe"
HKLM\System\CurrentControlSet\Services,Autodesk Licensing Service,enabled,"Anchor service for Autodesk products licensed with SafeCast","(Not verified) Autodesk","c:\programme\gemeinsame dateien\autodesk shared\service\adskscsrv.exe"
HKLM\System\CurrentControlSet\Services,C-DillaSrv,enabled,"C-Dilla RTS Service","(Not verified) C-Dilla Ltd","c:\windows\system32\drivers\cdantsrv.exe"
HKLM\System\CurrentControlSet\Services,KPF4,enabled,"Kerio Personal Firewall-Engine","(Not verified) Kerio Technologies","d:\programme\kerio personal firewall\personal firewall 4\kpf4ss.exe"
HKLM\System\CurrentControlSet\Services,mi-raysat_3dsmax8,enabled,"mental ray 3.4 Satellite",,"d:\programme\3ds max 8\mentalray\satellite\raysat_3dsmax8server.exe"
HKLM\System\CurrentControlSet\Services,sfmgr,enabled,"",,"d:\programme\3ds max 8\plugins\brazil\sfmgr\sfmgr.exe"
HKLM\System\CurrentControlSet\Services,StarWindService,enabled,"Enables network access to local devices via iSCSI protocol.","(Not verified) Rocket Division Software","d:\programme\alcohol 120%\alcohol 120\starwind\starwindservice.exe"
HKLM\System\CurrentControlSet\Services,as6eio,enabled,"",,"c:\windows\system32\drivers\as6eio.sys"
HKLM\System\CurrentControlSet\Services,Changer,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\Changer.sys"
HKLM\System\CurrentControlSet\Services,CO_Mon,enabled,"",,"c:\windows\system32\drivers\co_mon.sys"
HKLM\System\CurrentControlSet\Services,fwdrv,enabled,"","(Not verified) Kerio Technologies","c:\windows\system32\drivers\fwdrv.sys"
HKLM\System\CurrentControlSet\Services,i2omgmt,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys"
HKLM\System\CurrentControlSet\Services,khips,enabled,"Kerio Host Intrusion Prevention Driver",,"c:\windows\system32\drivers\khips.sys"
HKLM\System\CurrentControlSet\Services,lbrtfdc,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys"
HKLM\System\CurrentControlSet\Services,NuVision,enabled,"USBVision Streaming Class Driver","(Not verified) Hauppauge Computer Works","c:\windows\system32\drivers\nuvision.sys"
HKLM\System\CurrentControlSet\Services,papycpu2,enabled,"",,"c:\windows\system32\drivers\papycpu2.sys"
HKLM\System\CurrentControlSet\Services,papyjoy,enabled,"",,"c:\windows\system32\drivers\papyjoy.sys"
HKLM\System\CurrentControlSet\Services,PCIDump,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys"
HKLM\System\CurrentControlSet\Services,PDCOMP,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys"
HKLM\System\CurrentControlSet\Services,PDFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys"
HKLM\System\CurrentControlSet\Services,PDRELI,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys"
HKLM\System\CurrentControlSet\Services,PDRFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys"
HKLM\System\CurrentControlSet\Services,PxHelp20,enabled,"Px Engine Device Driver for Windows 2000/XP","(Not verified) Sonic Solutions","c:\windows\system32\drivers\pxhelp20.sys"
HKLM\System\CurrentControlSet\Services,toshidpt,enabled,"Toshiba Bluetooth HID mini port driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\toshidpt.sys"
HKLM\System\CurrentControlSet\ServicesEntry Location,Entry,Enabled,Description,Publisher,Image Path
HKLM\System\CurrentControlSet\Services,AntiVirScheduler,enabled,"Dienst zur Planung und Steuerung von Prüf- und Updateaufgaben der AntiVir PersonalEdition Classic.","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\sched.exe"
HKLM\System\CurrentControlSet\Services,AntiVirService,enabled,"Echtzeit Virenschutz durch H+BEDV AntiVir Engine","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avguard.exe"
HKLM\System\CurrentControlSet\Services,Autodesk Licensing Service,enabled,"Anchor service for Autodesk products licensed with SafeCast","(Not verified) Autodesk","c:\programme\gemeinsame dateien\autodesk shared\service\adskscsrv.exe"
HKLM\System\CurrentControlSet\Services,C-DillaSrv,enabled,"C-Dilla RTS Service","(Not verified) C-Dilla Ltd","c:\windows\system32\drivers\cdantsrv.exe"
HKLM\System\CurrentControlSet\Services,KPF4,enabled,"Kerio Personal Firewall-Engine","(Not verified) Kerio Technologies","d:\programme\kerio personal firewall\personal firewall 4\kpf4ss.exe"
HKLM\System\CurrentControlSet\Services,mi-raysat_3dsmax8,enabled,"mental ray 3.4 Satellite",,"d:\programme\3ds max 8\mentalray\satellite\raysat_3dsmax8server.exe"
HKLM\System\CurrentControlSet\Services,sfmgr,enabled,"",,"d:\programme\3ds max 8\plugins\brazil\sfmgr\sfmgr.exe"
HKLM\System\CurrentControlSet\Services,StarWindService,enabled,"Enables network access to local devices via iSCSI protocol.","(Not verified) Rocket Division Software","d:\programme\alcohol 120%\alcohol 120\starwind\starwindservice.exe"
HKLM\System\CurrentControlSet\Services,as6eio,enabled,"",,"c:\windows\system32\drivers\as6eio.sys"
HKLM\System\CurrentControlSet\Services,Changer,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\Changer.sys"
HKLM\System\CurrentControlSet\Services,CO_Mon,enabled,"",,"c:\windows\system32\drivers\co_mon.sys"
HKLM\System\CurrentControlSet\Services,fwdrv,enabled,"","(Not verified) Kerio Technologies","c:\windows\system32\drivers\fwdrv.sys"
HKLM\System\CurrentControlSet\Services,i2omgmt,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys"
HKLM\System\CurrentControlSet\Services,khips,enabled,"Kerio Host Intrusion Prevention Driver",,"c:\windows\system32\drivers\khips.sys"
HKLM\System\CurrentControlSet\Services,lbrtfdc,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys"
HKLM\System\CurrentControlSet\Services,NuVision,enabled,"USBVision Streaming Class Driver","(Not verified) Hauppauge Computer Works","c:\windows\system32\drivers\nuvision.sys"
HKLM\System\CurrentControlSet\Services,papycpu2,enabled,"",,"c:\windows\system32\drivers\papycpu2.sys"
HKLM\System\CurrentControlSet\Services,papyjoy,enabled,"",,"c:\windows\system32\drivers\papyjoy.sys"
HKLM\System\CurrentControlSet\Services,PCIDump,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys"
HKLM\System\CurrentControlSet\Services,PDCOMP,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys"
HKLM\System\CurrentControlSet\Services,PDFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys"
HKLM\System\CurrentControlSet\Services,PDRELI,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys"
HKLM\System\CurrentControlSet\Services,PDRFRAME,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys"
HKLM\System\CurrentControlSet\Services,PxHelp20,enabled,"Px Engine Device Driver for Windows 2000/XP","(Not verified) Sonic Solutions","c:\windows\system32\drivers\pxhelp20.sys"
HKLM\System\CurrentControlSet\Services,toshidpt,enabled,"Toshiba Bluetooth HID mini port driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\toshidpt.sys"
HKLM\System\CurrentControlSet\Services,tosporte,enabled,"TOSHIBA Bluetooth Port Emulation Driver","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosporte.sys"
HKLM\System\CurrentControlSet\Services,Tosrfbd,enabled,"Bluetooth RF Bus Driver","(Not verified) TOSHIBA CORPORATION","c:\windows\system32\drivers\tosrfbd.sys"
HKLM\System\CurrentControlSet\Services,Tosrfbnp,enabled,"Bluetooth RFBNEP Driver","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosrfbnp.sys"
HKLM\System\CurrentControlSet\Services,Tosrfcom,enabled,"Bluetooth RFCOMM Driver","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosrfcom.sys"
HKLM\System\CurrentControlSet\Services,Tosrfhid,enabled,"Bluetooth HID Driver from TOSHIBA","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\tosrfhid.sys"
HKLM\System\CurrentControlSet\Services,tosrfnds,enabled,"Bluetooth BNEP Driver","(Not verified) TOSHIBA Corporation.","c:\windows\system32\drivers\tosrfnds.sys"
HKLM\System\CurrentControlSet\Services,TosRfSnd,enabled,"Bluetooth Audio Driver (WDM)","(Not verified) TOSHIBA Corporation","c:\windows\system32\drivers\tosrfsnd.sys"
HKLM\System\CurrentControlSet\Services,Tosrfusb,enabled,"Bluetooth USB Miniport Driver","(Not verified) TOSHIBA CORPORATION","c:\windows\system32\drivers\tosrfusb.sys"
HKLM\System\CurrentControlSet\Services,Vax347b,enabled,"Plug and Play BIOS Extension","(Not verified) ","c:\windows\system32\drivers\vax347b.sys"
HKLM\System\CurrentControlSet\Services,Vax347s,enabled,"SCSI miniport","(Not verified) ","c:\windows\system32\drivers\vax347s.sys"
HKLM\System\CurrentControlSet\Services,WDICA,enabled,"",,"File not found: C:\WINDOWS\System32\Drivers\WDICA.sys"
HKLM\System\CurrentControlSet\Services,xlink,enabled,"USBIO Driver","(Not verified) Thesycon GmbH, Germany","c:\windows\system32\drivers\xlink.sys"
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify,efcyabx,enabled,"",,"c:\windows\system32\efcyabx.dll"
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors,CutePDF Writer Monitor,enabled,"",,"c:\windows\system32\cpwmon2k.dll"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,SideWinderTrayV4,enabled,"MS SideWinder Tray Application","(Not verified) Microsoft Corporation","d:\ext.hardware\sidewinder precision racing wheel\common\swtrayv4.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,NeroFilterCheck,enabled,"NeroCheck","(Not verified) Ahead Software Gmbh","c:\windows\system32\nerocheck.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,avgnt,enabled,"Antivirus System Tray Tool","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\avgnt.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ATICCC,enabled,"CLI Application (Command Line Interface)","(Not verified) ATI Technologies Inc.","c:\programme\ati technologies\ati.ace\cli.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Easy-PrintToolBox,enabled,"BJPSMAIN","(Not verified) CANON INC.","c:\programme\canon\easy-printtoolbox\bjpsmain.exe"
HKLM\SOFTWARE\Classes\Protocols\Filter,application/octet-stream,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll"
HKLM\SOFTWARE\Classes\Protocols\Filter,application/x-complus,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll"
HKLM\SOFTWARE\Classes\Protocols\Filter,application/x-msdownload,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll"
HKCU\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components,0,enabled,"",,"File not found: About:Home"
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components,n/a,enabled,"Microsoft .NET IE SECURITY REGISTRATION","(Not verified) Microsoft Corporation","c:\windows\system32\mscories.dll"
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart,Adobe Gamma Loader.lnk,enabled,"Adobe Gamma Loader","(Not verified) Adobe Systems, Inc.","c:\programme\gemeinsame dateien\adobe\calibration\adobe gamma loader.exe"
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart,Adobe Reader - Schnellstart.lnk,enabled,"Adobe Acrobat SpeedLauncher","(Not verified) Adobe Systems Incorporated","d:\programme\adobe reader 7\reader\reader_sl.exe"
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart,Microsoft Office.lnk,enabled,"Microsoft Office 2000 component","(Not verified) Microsoft Corporation","d:\programme\microsoft office 2000\office\osa9.exe"
C:\Dokumente und Einstellungen\Marco\Startmenü\Programme\Autostart,Adobe Gamma.lnk,enabled,"Adobe Gamma Loader","(Not verified) Adobe Systems, Inc.","c:\programme\gemeinsame dateien\adobe\calibration\adobe gamma loader.exe"
C:\Dokumente und Einstellungen\Marco\Startmenü\Programme\Autostart,EasyToolz.lnk,enabled,"",,"c:\dokumente und einstellungen\marco\desktop\easytoolz.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run,Start WingMan Profiler,enabled,"Logitech WingMan Event Monitor","(Not verified) Logitech Inc.","d:\ext.hardware\logitech wheel\lwemon.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects,EWPBrowseObject Class,enabled,"Easy-WebPrint EWPBrowseLoader Module",,"c:\programme\canon\easy-webprint\ewpbrowseloader.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects,{740267D5-4FD0-4E34-AEA6-740E4C68D2AA},enabled,"",,"c:\windows\system32\efcyabx.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks,efcyabx.dll,enabled,"",,"c:\windows\system32\efcyabx.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,CPL-Erweiterung für Anzeigeverschiebung,enabled,"",,"File not found: deskpan.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Fusion Cache,enabled,"Microsoft .NET Runtime Execution Engine","(Not verified) Microsoft Corporation","c:\windows\system32\mscoree.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,ShellLink for Application References,enabled,"Application Deployment Support Library","(Not verified) Microsoft Corporation","c:\windows\system32\dfshim.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Shell Icon Handler for Application References,enabled,"Application Deployment Support Library","(Not verified) Microsoft Corporation","c:\windows\system32\dfshim.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Catalyst Context Menu extension,enabled,"ACE Context Menu",,"c:\programme\ati technologies\ati.ace\atiacmxx.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,SigmaTel MSCN PlayerShell Hook,enabled,"SigmaTel MSCN Audio Player Shell Extension","(Not verified) SigmaTel, Inc.","c:\windows\system32\mscnh.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,WinRAR shell extension,enabled,"",,"d:\programme\winrar\rarext.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Shell Extension for Malware scanning,enabled,"ShlExt.dll","(Not verified) Avira GmbH","c:\programme\antivir personaledition classic\shlext.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,AlcoholShellEx,enabled,"AXShlEx.dll","(Not verified) Alcohol Soft Development Team","d:\programme\alcohol 120%\alcohol 120\axshlex.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,ICQ Shell Extension,enabled,"ICQ Shell Extension","(Not verified) ICQ","d:\programme\icq\icqshext.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,Bluetooth,enabled,"",,"File not found: C:\WINDOWS\system32\TosBtExt.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,IZArc DragDrop Menu,enabled,"",,"d:\programme\7z\izarccm.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,IZArc Shell Context Menu,enabled,"",,"d:\programme\7z\izarccm.dll"
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved,UnlockerShellExtension,enabled,"",,"d:\programme\unlocker\unlockercom.dll"
HKLM\Software\Classes\Folder\Shellex\ColumnHandlers,PDF Shell Extension,enabled,"PDF Shell Extension","(Not verified) Adobe Systems, Inc.","d:\programme\adobe reader 7\activex\pdfshell.dll"
HKLM\Software\Microsoft\Internet Explorer\Toolbar,Easy-WebPrint,enabled,"Easy-WebPrint",,"c:\programme\canon\easy-webprint\toolband.dll"
HKLM\Software\Microsoft\Internet Explorer\Extensions,ICQ,enabled,"ICQ","(Not verified) ICQ Inc.","d:\programme\icq\icq.exe"
HKLM\Software\Microsoft\Internet Explorer\Extensions,PartyPoker.net,enabled,"RunApp MFC Application",,"d:\spiele\party poker\partypokernet\runpf.exe"

Brauchst du noch einen log etwas anderes ?.

mfg
Marco

Hi
jetzt bekomme ich auch von Anti Vir die Meldung das die Datei
C:\Windows\system32\jkkjk.dll den Trojaner TR/Vundo.Gen
enthält.

mfg
Marco

Hi
mh ich habe jetzt festgestellt das meinTry Icon von dem Catalyst Control Center verschwunden ist, obwohl das in den Treibern aktiviert ist.
Ich glaube da hat sich schon einiges verabschiedet !?.

mfg
Marco

Hm, okay. Hab in deinen logs erst mal nichts weltbewegendes gefunden.

1. Anleitung Avenger:

a.) Lade dir das Tool Avenger und speichere es auf dem Desktop:



b.) Klicke nun auf die Option „Input Script manually“ -> klicke jetzt auf die Lupe und kopiere folgenden Text rein:

Files to delete:
c:\windows\system32\efcyabx.dll
C:\Windows\system32\jkkjk.dll

Registry keys to delete:
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA}"
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll
         

c.) Klicke nun auf die „grüne Ampel“, das Script fängt an zu arbeiten.



d.) Danach das System unverzüglich neu starten lassen
e.) Poste den Inhalt der C:\avenger.txt Datei.


2. Nach dem Neustart erstelle bitte noch mal ein Log der filelist. Poste bitte die Einträge der letzten 30 Tage, das Datum findest du in der linken Spalte.

Dies sind die Verzeichnisse von denen wir jeweils die letzten 30 Tage sehen wollen:
Verzeichnis von C:\
Verzeichnis von C:\WINDOWS\system32
Verzeichnis von C:\WINDOWS
Verzeichnis von C:\WINDOWS\Prefetch
Verzeichnis von C:\WINDOWS\tasks
Verzeichnis von C:\WINDOWS\Temp
Verzeichnis von C:\DOCUME~1\Name\LOCALS~1\Temp

Nachtrag: Nutzt XP Pro oder Home?

Aveneger Log

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ihindscs

*******************

Script file located at: \??\C:\mgujjwgt.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File c:\windows\system32\efcyabx.dll deleted successfully.


File C:\Windows\system32\jkkjk.dll not found!
Deletion of file C:\Windows\system32\jkkjk.dll failed!

Could not process line:
C:\Windows\system32\jkkjk.dll
Status: 0xc0000034

Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} deleted successfully.


Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} not found!
Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} failed!
Status: 0xc0000034



Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll not found!
Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

Fileleist Log
Ich hab einfach mal alles kopiert :-)
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ihindscs

*******************

Script file located at: \??\C:\mgujjwgt.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File c:\windows\system32\efcyabx.dll deleted successfully.


File C:\Windows\system32\jkkjk.dll not found!
Deletion of file C:\Windows\system32\jkkjk.dll failed!

Could not process line:
C:\Windows\system32\jkkjk.dll
Status: 0xc0000034

Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} deleted successfully.


Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} not found!
Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{740267D5-4FD0-4E34-AEA6-740E4C68D2AA} failed!
Status: 0xc0000034



Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll not found!
Deletion of registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\efcyabx.dll failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

Filelist Log
Ich habe einfach mal alles kopiert :-)

----- Root -----------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\

08.12.2007 22:11 2.878 avenger.txt
08.12.2007 22:11 1.610.612.736 pagefile.sys
08.12.2007 20:15 210 VundoFix.txt
19.08.2007 21:40 456.064 autorunsc.exe
23.03.2007 03:07 2.478 filelist.bat
01.11.2006 20:21 2.824 LGSInst.Log
01.08.2006 12:01 44 01_[HTTP_1_0 200 OK] http___62_75_176_40_80_bigfm-cbr-128.wav
24.07.2006 15:27 44 01_bigFM.wav
23.05.2006 23:28 227 boot.ini
21.03.2006 15:21 34 hcwclear.txt
21.03.2006 01:48 251.712 ntldr
21.03.2006 00:41 0 MSDOS.SYS
21.03.2006 00:41 0 CONFIG.SYS
21.03.2006 00:41 0 IO.SYS
21.03.2006 00:41 0 AUTOEXEC.BAT
04.08.2004 13:00 4.952 bootfont.bin
04.08.2004 13:00 47.564 NTDETECT.COM
17 Datei(en) 1.611.381.767 Bytes
0 Verzeichnis(se), 8.078.340.096 Bytes frei

----- System32 -------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\WINDOWS\system32

08.12.2007 22:13 2.206 wpa.dbl
08.12.2007 03:25 130.096 FNTCACHE.DAT
17.11.2007 00:04 5.686 jupdate-1.6.0_03-b05.log
02.11.2007 08:12 18.238.072 MRT.exe
29.10.2007 16:07 373.760 xpsp3res.dll
28.10.2007 11:57 74.996 perfc007.dat
28.10.2007 11:57 62.344 perfc009.dat
28.10.2007 11:57 415.470 perfh007.dat
28.10.2007 11:57 401.064 perfh009.dat
28.10.2007 11:57 966.250 PerfStringBackup.INI
25.10.2007 17:42 8.501.248 shell32.dll
27.09.2007 14:43 107.888 CmdLineExt.dll
24.09.2007 23:31 69.632 javacpl.cpl
24.09.2007 23:31 139.264 javaws.exe
24.09.2007 22:30 135.168 javaw.exe
24.09.2007 22:30 135.168 java.exe
29.08.2007 19:10 249.852 TZLog.log
22.08.2007 13:56 671.232 wininet.dll
22.08.2007 13:56 620.032 urlmon.dll
22.08.2007 13:56 1.498.112 shdocvw.dll
22.08.2007 13:56 474.624 shlwapi.dll
22.08.2007 13:56 39.424 pngfilt.dll
22.08.2007 13:56 532.480 mstime.dll
22.08.2007 13:56 146.432 msrating.dll
22.08.2007 13:56 449.024 mshtmled.dll
22.08.2007 13:56 3.085.824 mshtml.dll
22.08.2007 13:56 357.888 dxtmsft.dll
22.08.2007 13:56 205.824 dxtrans.dll
22.08.2007 13:56 96.768 inseng.dll
22.08.2007 13:56 55.808 extmgr.dll
22.08.2007 13:56 251.904 iepeers.dll
22.08.2007 13:56 1.056.256 danim.dll
22.08.2007 13:56 16.384 jsproxy.dll
22.08.2007 13:56 1.022.976 browseui.dll
22.08.2007 13:56 152.064 cdfview.dll
21.08.2007 07:16 683.520 inetcomm.dll
30.07.2007 18:20 30.040 wuaucpl.cpl.mui
30.07.2007 18:20 30.040 wuapi.dll.mui
30.07.2007 18:19 1.712.984 wuaueng.dll
30.07.2007 18:19 549.720 wuapi.dll
30.07.2007 18:19 325.976 wucltui.dll
30.07.2007 18:19 216.408 wuaucpl.cpl
30.07.2007 18:19 203.096 wuweb.dll
30.07.2007 18:19 92.504 cdm.dll
30.07.2007 18:19 53.080 wuauclt.exe
30.07.2007 18:19 43.352 wups2.dll
30.07.2007 18:18 34.136 wucltui.dll.mui
30.07.2007 18:18 33.624 wups.dll
30.07.2007 18:18 20.824 wuaueng.dll.mui
18.07.2007 13:42 60.416 tzchange.exe
16.07.2007 20:38 5.214 jupdate-1.6.0_02-b06.log
09.07.2007 14:11 584.192 rpcrt4.dll
26.06.2007 07:08 1.104.896 msxml3.dll
19.06.2007 14:31 282.112 gdi32.dll
17.05.2007 12:28 549.376 oleaut32.dll
30.04.2007 07:20 5.537.792 wmp.dll
25.04.2007 15:22 144.896 schannel.dll
18.04.2007 17:13 2.854.400 msi.dll
16.04.2007 19:20 4.254 jupdate-1.6.0_01-b06.log
16.04.2007 16:53 1.058.304 kernel32.dll
13.04.2007 02:21 271.360 mscoree.dll
17.03.2007 14:44 293.376 winsrv.dll
08.03.2007 16:36 40.960 mf3216.dll
08.03.2007 16:36 579.072 user32.dll
08.03.2007 16:32 1.843.712 win32k.sys
28.02.2007 17:06 2.140.160 ntoskrnl.exe
28.02.2007 17:06 2.019.840 ntkrnlpa.exe
16.02.2007 20:50 9.857 jupdate-1.5.0_11-b03.log
15.02.2007 18:01 337.280 WgaTray.exe
15.02.2007 18:01 1.476.992 LegitCheckControl.dll
15.02.2007 18:00 236.928 WgaLogon.dll
05.02.2007 21:18 185.856 upnphost.dll
23.01.2007 20:30 546.304 hhctrl.ocx

----- Prefetch -------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\WINDOWS\Prefetch

08.12.2007 22:33 21.744 CMD.EXE-087B4001.pf
08.12.2007 22:30 15.518 NOTEPAD.EXE-336351A9.pf
08.12.2007 22:26 45.006 WMIPRVSE.EXE-28F301A9.pf
08.12.2007 22:26 28.842 RUNDLL32.EXE-147710F4.pf
08.12.2007 22:23 34.816 WINRAR.EXE-1A0EFB18.pf
08.12.2007 22:20 107.854 FIREFOX.EXE-28BE8AE1.pf
08.12.2007 22:15 8.554 VERCLSID.EXE-3667BD89.pf
08.12.2007 22:15 13.214 RUNDLL32.EXE-451FC2C0.pf
08.12.2007 22:14 23.190 ICQSRP.EXE-39F52848.pf
08.12.2007 22:14 23.832 DBADMIN.EXE-3114FE5A.pf
08.12.2007 22:14 50.080 ICQ.EXE-12D03E8D.pf
08.12.2007 22:13 90.696 WUAUCLT.EXE-399A8E72.pf
08.12.2007 22:13 60.782 WGATRAY.EXE-0ED38BED.pf
08.12.2007 22:13 15.396 ALG.EXE-0F138680.pf
08.12.2007 22:13 18.204 WMIAPSRV.EXE-1E2270A5.pf
08.12.2007 22:13 45.364 KPF4GUI.EXE-15C10A26.pf
08.12.2007 22:13 51.044 IMAPI.EXE-0BF740A4.pf
08.12.2007 22:13 7.138 WDFMGR.EXE-2CF4013B.pf
08.12.2007 22:13 19.922 STARWINDSERVICE.EXE-08BAA24A.pf
08.12.2007 22:13 13.262 SFMGR.EXE-19B27493.pf
08.12.2007 22:12 5.604 RAYSAT_3DSMAX8SERVER.EXE-277B3C21.pf
08.12.2007 22:12 56.736 KPF4SS.EXE-1113FC5E.pf
08.12.2007 22:12 4.956 CDANTSRV.EXE-199606CD.pf
08.12.2007 22:12 10.696 ADSKSCSRV.EXE-162256D2.pf
08.12.2007 22:12 32.600 SCHED.EXE-236A886F.pf
08.12.2007 22:12 49.390 AVGUARD.EXE-3490B18B.pf
08.12.2007 22:12 643.312 NTOSBOOT-B00DFAAD.pf
08.12.2007 21:46 87.262 THUNDERBIRD.EXE-05833C98.pf
08.12.2007 21:42 32.804 TASKMGR.EXE-20256C55.pf
08.12.2007 21:25 87.106 CLI.EXE-02B0DB56.pf
08.12.2007 21:04 34.690 GUARDGUI.EXE-1BD45C30.pf
08.12.2007 20:41 35.596 NET.EXE-01A53C2F.pf
08.12.2007 20:41 13.470 NET1.EXE-029B9DB4.pf
08.12.2007 20:16 67.784 LOGONUI.EXE-0AF22957.pf
08.12.2007 19:59 8.992 ADOBELM_CLEANUP.0001-235018B4.pf
08.12.2007 19:59 21.470 ADOBELMSVC.EXE-0665217B.pf
08.12.2007 19:58 17.844 RUNDLL32.EXE-27680499.pf
08.12.2007 19:58 52.118 PHOTOSHOP.EXE-2913E2C2.pf
08.12.2007 19:44 31.606 NRASSISTANT.EXE-28801A1F.pf
08.12.2007 19:44 19.364 NR2003.EXE-14CED467.pf
08.12.2007 19:25 8.016 FZSFTP.EXE-01F0F415.pf
08.12.2007 19:25 51.262 FILEZILLA.EXE-23D4BC5B.pf
08.12.2007 19:24 19.116 SVCHOST.EXE-3530F672.pf
08.12.2007 16:29 35.978 RUNDLL32.EXE-14A3110C.pf
08.12.2007 16:29 50.276 PHOTOSHOP.EXE-075B1321.pf
08.12.2007 16:20 75.956 IEXPLORE.EXE-2CA9778D.pf
08.12.2007 16:07 69.576 AD-AWARE.EXE-2AD0F08E.pf
08.12.2007 15:39 47.200 AVSCAN.EXE-05AECC0E.pf
08.12.2007 15:38 36.318 UPDATE.EXE-13D57D76.pf
08.12.2007 15:38 14.708 PREUPD.EXE-358AA1C1.pf
08.12.2007 15:38 54.400 AVCENTER.EXE-37584419.pf
08.12.2007 03:06 26.674 ACRORD32INFO.EXE-30E2C0D7.pf
08.12.2007 02:46 121.692 FIREFOX.EXE-2A1B96AB.pf
08.12.2007 02:25 64.188 AVNOTIFY.EXE-22AE9451.pf
08.12.2007 02:07 83.886 WINWORD.EXE-2BCF0340.pf
08.12.2007 02:01 60.368 NERO.EXE-03DF656C.pf
08.12.2007 01:56 40.536 NEROSTARTSMART.EXE-3ABC3EBB.pf
08.12.2007 01:35 11.336 KEYGEN.EXE-2339A7FA.pf
08.12.2007 01:31 25.324 ADOBEUPDATER.EXE-0A2E1E73.pf
08.12.2007 01:29 50.094 MSIEXEC.EXE-2F8A8CAE.pf
08.12.2007 01:29 125.898 AHC.EXE-1FB51FFF.pf
08.12.2007 01:29 44.200 MSI55.TMP-1A81A3AE.pf
08.12.2007 01:28 41.096 IMAGEREADY.EXE-26C1446A.pf
08.12.2007 01:26 6.976 KEYGEN.EXE-251A93E3.pf
08.12.2007 01:25 14.554 SETUP.EXE-3339E875.pf
08.12.2007 01:24 19.046 SETUP.EXE-0F40F254.pf
08.12.2007 01:24 36.078 ALCOHOL.EXE-0E83AC57.pf
07.12.2007 23:26 56.764 MPTH.EXE-2065D98C.pf
07.12.2007 23:25 18.052 IS-QQ045.TMP-16829C08.pf
07.12.2007 23:25 10.100 MPTH_15010.EXE-2A6C6F68.pf
07.12.2007 23:24 39.156 PS2SAVE-BUILDER.EXE-077FB7F0.pf
07.12.2007 19:21 48.318 HELPSVC.EXE-2878DDA2.pf
07.12.2007 19:21 477.374 Layout.ini
07.12.2007 19:00 70.156 AZUREUS.EXE-2AFB9441.pf
07.12.2007 18:48 75.136 IMAGEREADY.EXE-1EBE47C6.pf
07.12.2007 18:28 32.386 OSADOBEPHOTOSHOPCS2TRYOUTTOFU-34ACCCB6.pf
07.12.2007 17:52 35.542 MSI3EC.TMP-2E12BD7C.pf
07.12.2007 17:51 51.264 RUNDLL32.EXE-13404D23.pf
07.12.2007 17:45 12.408 KEYGEN.EXE-391C3DE2.pf
07.12.2007 17:19 16.014 PHOTOSHOP CS2 KEYGEN WORKING!-1177B4E7.pf
07.12.2007 17:17 43.014 MSI59.TMP-0FE4FB36.pf
07.12.2007 17:15 15.674 SETUP.EXE-14CA2A53.pf
07.12.2007 16:55 16.006 PHOTOSHOP CS2 KEYGEN WORKING!-00DD69E2.pf
07.12.2007 15:05 42.452 ADSKCLEANUP.0001-101BA35C.pf
07.12.2007 15:05 60.012 3DSMAX.EXE-078D9D50.pf
07.12.2007 15:04 69.888 WINAMP.EXE-065B55C4.pf
07.12.2007 14:07 59.258 DFRGNTFS.EXE-269967DF.pf
07.12.2007 13:58 30.692 MMC.EXE-1EF9AA05.pf
07.12.2007 13:12 23.408 EASYTOOLZ.EXE-0CF2EA37.pf
07.12.2007 13:12 10.554 READER_SL.EXE-33DE7F37.pf
07.12.2007 13:12 10.414 ADOBE GAMMA LOADER.EXE-1FD09C3A.pf
07.12.2007 13:12 13.036 OSA9.EXE-329C204E.pf
07.12.2007 13:12 14.738 SWTRAYV4.EXE-0E72E912.pf
07.12.2007 13:12 9.998 SOUNDMAN.EXE-19745A34.pf
07.12.2007 13:12 16.374 USERINIT.EXE-30B18140.pf
07.12.2007 13:12 51.698 ATI2EVXX.EXE-19D16EB9.pf
07.12.2007 13:12 57.548 EXPLORER.EXE-082F38A9.pf
07.12.2007 13:10 61.672 JAVAW.EXE-2826389B.pf
07.12.2007 13:10 6.616 JAVACPL.EXE-1B4C9006.pf
07.12.2007 13:10 14.584 RUNDLL32.EXE-3001C307.pf
07.12.2007 13:10 21.310 RUNDLL32.EXE-29A2BA7C.pf
07.12.2007 13:10 16.790 SNDVOL32.EXE-383480B7.pf
07.12.2007 13:09 31.334 RUNDLL32.EXE-2576181F.pf
07.12.2007 13:06 55.384 AVGNT.EXE-36CA4640.pf
07.12.2007 12:59 15.854 MAX8KEYGEN.EXE-04A63A5C.pf
07.12.2007 12:32 19.068 RUNDLL32.EXE-2341BBC5.pf
07.12.2007 12:32 19.700 CONTROL.EXE-013DBFB5.pf
07.12.2007 12:16 13.880 AZUREUS_2.5.0.4_WIN32.SETUP.E-013945A7.pf
07.12.2007 11:50 18.018 MAX8KEYGEN.EXE-0BC40921.pf
07.12.2007 11:16 22.790 RUNDLL32.EXE-14BE42EE.pf
07.12.2007 11:15 49.590 I_VIEW32.EXE-3680CA15.pf
07.12.2007 11:14 20.418 WINMIP2.EXE-204E679C.pf
07.12.2007 11:04 10.598 RUNONCE.EXE-2803F297.pf
07.12.2007 11:03 20.706 RUNDLL32.EXE-16BBAF5D.pf
07.12.2007 10:59 32.376 MMC.EXE-39071BCC.pf
07.12.2007 10:59 29.126 RUNDLL32.EXE-31EBBE5F.pf
07.12.2007 09:09 19.238 RUNDLL32.EXE-188DF14E.pf
07.12.2007 08:54 59.844 3DSMAX.EXE-11777381.pf
07.12.2007 08:46 8.012 BRAZIL??.EXE-27FE9DFB.pf
07.12.2007 08:46 8.368 BRAZIL??.EXE-308BBF13.pf
07.12.2007 08:22 13.816 NTVDM.EXE-1A10A423.pf
07.12.2007 08:15 17.986 MAX8KEYGEN.EXE-08C84B33.pf
07.12.2007 08:10 7.014 REGCLEANER.EXE-296199B0.pf
07.12.2007 08:10 49.260 DWFVIEWERSETUP.EXE-3208D4AD.pf
07.12.2007 08:10 26.920 AUTORUN.EXE-21898424.pf
07.12.2007 08:10 39.490 SETUP.EXE-1C2DF0DE.pf
07.12.2007 08:10 52.710 DXSETUP.EXE-18483C9E.pf
07.12.2007 03:06 17.976 DEFRAG.EXE-273F131E.pf
07.12.2007 01:02 46.608 TEAMSPEAK.EXE-16AE4E70.pf
06.12.2007 22:03 20.736 REGSVR32.EXE-25EEFE2F.pf
130 Datei(en) 5.597.836 Bytes
0 Verzeichnis(se), 8.078.229.504 Bytes frei

----- Windows --------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\WINDOWS

08.12.2007 22:12 0 0.log
08.12.2007 22:12 1.371.005 WindowsUpdate.log
08.12.2007 22:11 2.048 bootstat.dat
08.12.2007 22:10 32.618 SchedLgU.Txt
08.12.2007 21:18 864.846 setupapi.log
08.12.2007 20:16 506 wiadebug.log
08.12.2007 19:24 50 wiaservc.log
07.12.2007 08:10 9.566 DirectX.log
05.12.2007 15:13 1.537 AS6E32.INI
05.12.2007 15:13 543 SUPMINI.INI
05.12.2007 15:11 7.650 aWhite.dat
05.12.2007 15:11 4 aError.dat
05.12.2007 15:11 7.650 aDark.dat
05.12.2007 15:11 12 aExpo.dat
20.11.2007 21:56 51.028 wmsetup.log
19.11.2007 22:41 13.771 Car of Tomorrow Mod Setup Log.txt
14.11.2007 17:05 146.159 iis6.log
14.11.2007 17:05 355.099 tsoc.log
14.11.2007 17:05 50.817 ocmsn.log
14.11.2007 17:05 189.587 ntdtcsetup.log
14.11.2007 17:05 315.499 comsetup.log
14.11.2007 17:05 1.393 imsins.log
14.11.2007 17:05 10.699 KB943460.log
14.11.2007 17:05 443.337 ocgen.log
14.11.2007 17:05 46.294 msgsocm.log
14.11.2007 17:05 920.373 FaxSetup.log
14.11.2007 17:05 57.722 updspapi.log
06.11.2007 00:33 69 NeroDigital.ini
10.10.2007 21:58 1.393 imsins.BAK
10.10.2007 21:58 38.634 KB939653.log
09.10.2007 21:49 9.759 KB933729.log
09.10.2007 21:48 13.882 KB941202.log
29.08.2007 19:10 25.266 KB933360.log
15.08.2007 21:07 5.048 spupdsvc.log
15.08.2007 20:57 19.710 KB936021.log
15.08.2007 20:57 24.419 KB938828.log
15.08.2007 20:57 18.792 KB921503.log
15.08.2007 20:57 18.393 KB938829.log
15.08.2007 20:56 18.221 KB938127.log
15.08.2007 20:56 38.610 KB937143.log
15.08.2007 20:56 7.054 KB936782.log
13.06.2007 15:47 38.280 KB933566.log
13.06.2007 15:46 15.053 KB929123.log
13.06.2007 15:46 14.357 KB935840.log
13.06.2007 15:45 14.283 KB935839.log
13.06.2007 14:10 1.036.288 explorer.exe
08.06.2007 21:59 68 3doEd.INI
25.05.2007 15:50 9.116 KB927891.log
10.05.2007 18:33 13.604 KB930916.log
09.05.2007 21:52 19.483 KB931768.log
11.04.2007 11:47 24.907 KB931784.log
11.04.2007 11:47 15.080 KB931261.log
11.04.2007 11:47 15.389 KB930178.log
11.04.2007 11:47 19.616 KB932168.log
04.04.2007 13:36 15.002 KB925902.log
02.04.2007 23:25 1.073.303.552 MEMORY.DMP
02.04.2007 18:12 0 tosOBEX.INI
02.04.2007 18:11 188.682 setupact.log
24.03.2007 16:37 1.785 vtplus32.ini
15.03.2007 13:32 20.476 KB929338.log
01.03.2007 23:10 29.406 WgaNotify.log
14.02.2007 00:44 21.505 KB927779.log
14.02.2007 00:44 18.203 KB927802.log
14.02.2007 00:43 18.709 KB928255.log
14.02.2007 00:43 15.228 KB924667.log
14.02.2007 00:43 27.778 KB931836.log
14.02.2007 00:43 17.169 KB926436.log
14.02.2007 00:43 17.694 KB918118.log
14.02.2007 00:43 36.703 KB928090.log
14.02.2007 00:43 12.956 KB928843.log
13.01.2007 22:00 720.896 iun6002ev.exe
11.01.2007 19:30 16.720 KB929969.log
17.12.2006 18:48 35.542 KB925454.log
17.12.2006 18:47 13.348 KB926255.log
17.12.2006 18:47 13.120 KB923694.log
17.12.2006 11:39 7.006 KB925398.log
17.12.2006 11:38 8.377 KB923689.log
05.12.2006 20:03 1.173 ie7_main.log
02.12.2006 22:18 354 HPSETLOG.TXT
18.11.2006 12:54 17.999 KB923980.log
18.11.2006 12:54 21.116 KB924270.log
18.11.2006 12:54 20.755 KB920213.log
18.11.2006 12:54 33.777 KB922760.log
27.10.2006 20:50 32 wininit.ini
16.10.2006 18:13 6.443 mozver.dat

----- Tasks ----------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\WINDOWS\tasks

08.12.2007 22:11 6 SA.DAT
04.08.2004 13:00 65 desktop.ini
2 Datei(en) 71 Bytes
0 Verzeichnis(se), 8.078.225.408 Bytes frei

----- Wintemp --------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\WINDOWS\temp

08.12.2007 22:13 409 WGANotify.settings
08.12.2007 22:11 255 WGAErrLog.txt
16.09.2007 12:26 0 Upd3F.tmp
26.08.2007 18:00 0 Upd43.tmp
26.08.2007 17:58 0 Upd42.tmp
26.08.2007 17:57 0 Upd41.tmp
19.08.2007 14:46 0 Upd38.tmp
19.08.2007 14:43 0 Upd37.tmp
12.08.2007 13:21 0 Upd36.tmp
12.08.2007 13:17 0 Upd32.tmp
05.08.2007 12:46 0 Upd31.tmp
05.08.2007 12:44 0 Upd30.tmp
29.07.2007 13:56 0 Upd35.tmp
29.07.2007 13:55 0 Upd34.tmp
29.07.2007 13:54 0 Upd33.tmp
15.07.2007 12:32 0 Upd2F.tmp
15.07.2007 12:26 0 Upd16.tmp
15.07.2007 12:03 0 Upd13.tmp
15.07.2007 12:01 0 Upd12.tmp
11.07.2007 16:05 6.019 NetFxUpdate_v1.1.4322.log
08.07.2007 12:47 0 Upd15.tmp
08.07.2007 12:47 0 Upd14.tmp
01.07.2007 12:48 0 Upd2E.tmp
01.07.2007 12:46 0 Upd2D.tmp
01.07.2007 12:45 0 Upd2C.tmp
01.07.2007 12:44 0 Upd2B.tmp
01.07.2007 12:43 0 Upd2A.tmp
01.07.2007 12:43 0 Upd29.tmp
01.07.2007 12:42 0 Upd28.tmp
01.07.2007 12:41 0 Upd27.tmp
01.07.2007 12:41 0 Upd26.tmp
01.07.2007 12:40 0 Upd25.tmp
01.07.2007 12:40 0 Upd24.tmp
25.06.2007 14:08 0 Upd21.tmp
25.06.2007 14:07 0 Upd20.tmp
25.06.2007 14:07 0 Upd1F.tmp
25.06.2007 14:07 0 Upd1C.tmp
17.06.2007 11:11 0 Upd11.tmp
17.06.2007 11:08 0 Upd10.tmp
17.06.2007 11:06 0 UpdF.tmp
17.06.2007 11:06 0 UpdE.tmp
10.06.2007 16:16 0 Upd23.tmp
10.06.2007 16:15 0 Upd22.tmp
04.06.2007 13:29 0 UpdD.tmp
04.06.2007 13:28 0 Upd5.tmp
28.05.2007 14:11 0 Upd4.tmp
28.05.2007 14:10 0 Upd3.tmp
12.05.2007 17:48 0 UpdC.tmp
12.05.2007 17:48 0 UpdB.tmp
12.05.2007 17:48 0 UpdA.tmp
12.05.2007 17:47 0 Upd9.tmp
06.05.2007 12:01 0 Upd1E.tmp
06.05.2007 12:00 0 Upd1D.tmp
28.04.2007 22:14 0 Upd1B.tmp
28.04.2007 22:13 0 Upd1A.tmp
28.04.2007 22:13 0 Upd19.tmp
28.04.2007 22:12 0 Upd18.tmp
28.04.2007 22:11 0 Upd17.tmp
22.04.2007 14:39 0 Upd6.tmp
22.04.2007 12:27 0 Upd2.tmp
22.04.2007 12:24 0 Upd8.tmp
22.04.2007 12:24 0 Upd7.tmp
04.04.2006 16:10 16.384 Perflib_Perfdata_d50.dat
04.04.2006 01:12 16.384 Perflib_Perfdata_c14.dat
23.03.2006 00:38 16.384 Perflib_Perfdata_338.dat
21.03.2006 17:22 16.384 Perflib_Perfdata_6c4.dat
21.03.2006 00:43 402 java_install_reg.log
21.03.2006 00:43 25.619 java_install.log
21.03.2006 00:42 7.320 ASPNETSetup.log
24.04.2005 06:33 190.976 keygen2.exe
70 Datei(en) 296.536 Bytes
0 Verzeichnis(se), 8.078.221.312 Bytes frei

----- Temp -----------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 7495-4187

Verzeichnis von C:\DOKUME~1\Marco\LOKALE~1\Temp

08.12.2007 22:33 122.148 filelist.txt
08.12.2007 22:16 473.282 jusched.log
08.12.2007 20:38 20.218 autoruns.txt
08.12.2007 20:38 22.072 autoruns.log
08.12.2007 19:59 59.964 Adobelm_Cleanup.0001
08.12.2007 19:58 4.305 TWAIN.LOG
08.12.2007 19:58 5 Twain001.Mtx
08.12.2007 19:58 156 Twunk001.MTX
08.12.2007 19:53 114.688 ~DF7312.tmp
08.12.2007 19:44 4.592 SIntfIcn.ani
08.12.2007 19:44 24.740 SIntfNT.dll
08.12.2007 19:44 20.020 SIntf32.dll
08.12.2007 19:44 12.305 SIntf16.dll
08.12.2007 01:51 43 removalfile.bat
07.12.2007 19:00 0 AZ_49409.rar
07.12.2007 18:54 0 AZ_49407.iso
07.12.2007 18:53 0 AZ_49403.exe
07.12.2007 18:37 0 AZ_42778.exe
07.12.2007 18:04 0 AZ_11738.rar
07.12.2007 17:29 0 AZ_49129.EXE
07.12.2007 17:26 0 AZ_49127.rar
07.12.2007 16:28 0 AZ_33993.rar
07.12.2007 15:39 0 AZ_54943.rar
07.12.2007 15:22 153 prof.log
07.12.2007 15:22 153 events.log
07.12.2007 15:05 59.964 AdskCleanup.0001
07.12.2007 13:10 158.367 java_install_reg.log
07.12.2007 10:49 0 AZ_36923.iso
07.12.2007 10:45 0 AZ_48883.rar
07.12.2007 08:14 2.222 3dsMax8.log
07.12.2007 08:14 12.322.260 3dsMax8.0Install.log
07.12.2007 08:14 285.860 bb3_install.log
07.12.2007 08:14 3.603 Install-log.txt
07.12.2007 02:33 0 1e026.tmp
07.12.2007 02:30 0 ywk25.tmp
07.12.2007 02:21 0 2w11D.tmp
07.12.2007 02:17 0 ing1B.tmp
07.12.2007 01:31 0 AZ_23951.iso
06.12.2007 23:31 63 cmd.php.uin
06.12.2007 13:27 90.112 CmdLineExt03.dll
04.12.2007 16:11 16.384 ~DFC8EB.tmp
04.12.2007 16:11 16.384 ~DFBEA4.tmp
04.12.2007 16:11 16.384 ~DFBDFA.tmp
04.12.2007 16:11 16.384 ~DFBD90.tmp
04.12.2007 16:11 16.384 ~DFBBD9.tmp
04.12.2007 16:11 16.384 ~DF892D.tmp
04.12.2007 00:39 0 pjl14.tmp
04.12.2007 00:36 0 lqq12.tmp
02.12.2007 01:48 0 pdk42.tmp
30.11.2007 22:19 69 316C7B88.TMP
28.11.2007 00:18 0 0kh12.tmp
28.11.2007 00:15 0 d2311.tmp
24.11.2007 21:08 0 s2aE.tmp
24.11.2007 21:08 0 jvoD.tmp
22.11.2007 23:58 53.728 830b_appcompat.txt
22.11.2007 22:20 81.920 ~DFFF1D.tmp
22.11.2007 22:10 131.072 ~DF4402.tmp
22.11.2007 19:26 53.728 99e3_appcompat.txt
20.11.2007 21:58 0 xlrD.tmp
20.11.2007 21:56 12.818 control.xml
20.11.2007 21:55 0 n0vB.tmp
17.11.2007 00:02 1.302 jinstall.cfg
16.11.2007 23:51 16.384 ~DF6D0D.tmp
16.11.2007 23:50 16.384 ~DF20B1.tmp
14.11.2007 23:12 0 dwb6E.tmp
14.11.2007 23:06 0 6oa6A.tmp
13.11.2007 00:34 0 zi015.tmp
11.11.2007 22:15 16.384 ~DF3452.tmp
11.11.2007 22:14 16.384 ~DFC9FE.tmp
11.11.2007 17:11 8.207.180 nsmail-2.eml
11.11.2007 17:10 8.207.180 nsmail-1.eml
11.11.2007 14:05 16.384 ~DF5D9E.tmp
11.11.2007 14:01 16.384 ~DF3DA1.tmp
10.11.2007 00:29 0 gcx55.tmp
10.11.2007 00:18 0 4m453.tmp
10.11.2007 00:18 0 5ny50.tmp
10.11.2007 00:13 0 6r74A.tmp
10.11.2007 00:13 0 o2q49.tmp
10.11.2007 00:12 0 6ce45.tmp
10.11.2007 00:06 0 n5r35.tmp
10.11.2007 00:03 0 tvc32.tmp
06.11.2007 00:36 0 bl08A.tmp
06.11.2007 00:35 0 i4o87.tmp
06.11.2007 00:33 0 cuz7C.tmp
06.11.2007 00:33 0 mts79.tmp
06.11.2007 00:28 0 6y974.tmp
01.11.2007 16:33 16.384 ~DF6ED9.tmp
01.11.2007 16:32 16.384 ~DFC1BF.tmp
30.10.2007 21:25 16.384 ~DF1DEF.tmp
29.10.2007 13:05 16.384 ~DFC6BB.tmp
29.10.2007 13:05 16.384 ~DFC611.tmp
29.10.2007 13:05 16.384 ~DFC5B4.tmp
29.10.2007 13:05 16.384 ~DFC424.tmp
29.10.2007 12:55 16.384 ~DF34C2.tmp
29.10.2007 12:54 16.384 ~DF5E77.tmp
29.10.2007 11:10 65.536 ~DF8F59.tmp
29.10.2007 10:23 16.384 ~DF97D6.tmp
29.10.2007 10:23 512 ~DF97E4.tmp
29.10.2007 10:23 512 ~DF9070.tmp
29.10.2007 10:23 16.384 ~DF9062.tmp
29.10.2007 10:23 16.384 ~DF8FB8.tmp
29.10.2007 10:23 512 ~DF8FC6.tmp
29.10.2007 10:23 16.384 ~DF8F4B.tmp
29.10.2007 10:23 512 ~DF8DA1.tmp
29.10.2007 10:23 16.384 ~DF8D93.tmp
29.10.2007 10:21 16.384 ~DFBE39.tmp
29.10.2007 10:21 512 ~DFBE47.tmp
28.10.2007 18:50 575 TVU2B.tmp
28.10.2007 18:49 575 TVU28.tmp
27.10.2007 22:19 0 pqp2F.tmp
27.10.2007 22:19 0 b3o2E.tmp
27.10.2007 22:15 0 woz27.tmp
27.10.2007 22:14 0 3pw26.tmp
27.10.2007 16:21 16.384 ~DF9EB2.tmp
27.10.2007 00:00 20.409 sop_ad.jpg
26.10.2007 23:52 575 TVUC.tmp
24.10.2007 21:23 244.432 Office 2000 Premium Setup(0014)_MsiExec.txt
24.10.2007 21:21 1.606 Office 2000 Premium Setup(0014).txt
24.10.2007 21:21 1.458 Office 2000 Premium Setup(0012).txt
24.10.2007 21:16 241.792 Office 2000 Premium Setup(0010)_MsiExec.txt
24.10.2007 21:15 1.606 Office 2000 Premium Setup(0010).txt
24.10.2007 21:15 1.554 Office 2000 Premium Setup(0008).txt
24.10.2007 21:14 1.554 Office 2000 Premium Setup(0006).txt
24.10.2007 21:14 1.554 Office 2000 Premium Setup(0004).txt
14.10.2007 17:40 16.384 ~DF82BA.tmp
14.10.2007 17:36 16.384 ~DFA1E9.tmp
07.10.2007 23:17 0 ljl1F.tmp
07.10.2007 23:16 0 0e61B.tmp
07.10.2007 23:16 0 hcs1A.tmp
07.10.2007 23:15 0 g0418.tmp
07.10.2007 23:13 0 xkxE.tmp
07.10.2007 23:12 0 r41C.tmp
07.10.2007 14:55 0 rx715.tmp
29.09.2007 12:02 13.592 temp.ani
29.09.2007 12:02 212.992 drm_dyndata_7330014.dll
28.09.2007 19:01 355 5.tmp
28.09.2007 17:06 65.536 drm_dialogs.dll
27.09.2007 17:50 0 7eu18.tmp
27.09.2007 17:49 0 8fy14.tmp
27.09.2007 17:43 0 nj53.tmp
17.09.2007 11:41 696 jar_cache11057.tmp
17.09.2007 11:39 642 jar_cache11052.tmp
17.09.2007 11:39 697 jar_cache11048.tmp
17.09.2007 11:39 699 jar_cache11047.tmp
17.09.2007 11:39 696 jar_cache11044.tmp

Ich benutze Windows XP Home

mfg
Marco