Schritt 2 OTL Code:
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-1060284298-1500820517-682003330-1005\Software\Microsoft\Internet Explorer\URLSearchHooks\\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\ deleted successfully.
C:\Programme\ZoneAlarm-Sicherheit\tbZon1.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\ not found.
File Sicherheit\tbZon1.dll not found.
Registry value HKEY_USERS\S-1-5-21-1060284298-1500820517-682003330-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Administrator.VOM-AAAB1E6FBE9
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Ich
->Temp folder emptied: 1649558797 bytes
->Temporary Internet Files folder emptied: 6188919 bytes
->Java cache emptied: 36914062 bytes
->FireFox cache emptied: 96614035 bytes
->Google Chrome cache emptied: 6585898 bytes
->Flash cache emptied: 492 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 360582 bytes
->Flash cache emptied: 515 bytes
User: NetworkService
->Temp folder emptied: 1768 bytes
->Temporary Internet Files folder emptied: 737324 bytes
User: Wir
->Temp folder emptied: 2129588 bytes
->Temporary Internet Files folder emptied: 19271219 bytes
->Java cache emptied: 3288643 bytes
->FireFox cache emptied: 6968113 bytes
->Google Chrome cache emptied: 6451528 bytes
->Flash cache emptied: 831 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2148906 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 533407 bytes
RecycleBin emptied: 234848 bytes
Total Files Cleaned = 1.753,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 03142013_133711
Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\TMP00000013EBB40A9C1634991D not found!
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Schritt 3 combofix Code:
Combofix Logfile:
Code:
ComboFix 13-03-14.02 - Wir 14.03.2013 14:24:52.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.510.68 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Wir\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Wir\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-02-14 bis 2013-03-14 ))))))))))))))))))))))))))))))
.
.
2013-03-14 12:37 . 2013-03-14 12:37 -------- d-----w- C:\_OTL
2013-03-13 10:48 . 2013-03-13 10:48 -------- d-----w- c:\dokumente und einstellungen\Wir\Lokale Einstellungen\Anwendungsdaten\Identities
2013-03-13 10:09 . 2013-03-13 10:22 -------- d---a-w- C:\.Trash-999
2013-03-12 14:12 . 2013-03-12 14:12 60872 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Windows Defender\Definition Updates\{B80DFAF3-CE05-4662-B372-3F6B87E3FFD3}\offreg.dll
2013-03-02 07:44 . 2013-02-08 00:45 6954968 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Windows Defender\Definition Updates\{B80DFAF3-CE05-4662-B372-3F6B87E3FFD3}\mpengine.dll
2013-02-14 11:07 . 2013-02-14 11:07 -------- d-----w- c:\dokumente und einstellungen\Wir\Lokale Einstellungen\Anwendungsdaten\Sun
2013-02-14 11:06 . 2013-02-14 11:06 -------- d-----w- c:\dokumente und einstellungen\Wir\Downloads
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-02 21:27 . 2012-07-24 13:05 861088 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-03-02 21:27 . 2012-02-27 09:35 782240 ----a-w- c:\windows\system32\deployJava1.dll
2013-02-16 14:30 . 2012-12-30 17:29 691568 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-16 14:30 . 2011-08-03 11:43 71024 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-08 00:45 . 2006-12-08 12:20 6954968 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2013-01-26 03:55 . 2006-02-28 12:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-17 00:28 . 2009-10-15 18:49 232336 ------w- c:\windows\system32\MpSigStub.exe
2013-01-07 07:24 . 2006-02-28 12:00 2151424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-07 07:24 . 2004-08-04 00:50 2030080 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:09 . 2006-02-28 12:00 1867392 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2006-02-28 12:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2013-01-02 06:49 . 2006-02-28 12:00 1297920 ----a-w- c:\windows\system32\quartz.dll
2012-12-26 20:06 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2012-12-26 20:06 . 2006-02-28 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-12-26 20:06 . 2006-02-28 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-12-24 06:40 . 2006-02-28 12:00 385024 ----a-w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2006-02-28 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll
2012-12-14 15:49 . 2012-02-16 14:43 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2006-05-03 09:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\.Trash-999 ----
.
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vspdfprsrv.exe"="c:\programme\eXPert PDF\vspdfprsrv.exe" [2006-05-04 998912]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2009-01-05 413696]
"WD Drive Manager"="c:\programme\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2008-07-24 450560]
"HP Software Update"="c:\programme\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"Microsoft Default Manager"="c:\programme\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2013-02-12 385248]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Microsoft-Indexerstellung.lnk - c:\programme\Microsoft Office\Office\FINDFAST.EXE [1997-9-4 111376]
Office-Start.lnk - c:\programme\Microsoft Office\Office\OSA.EXE [1997-9-4 51984]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^ImageMixer 3 SE Camera Monitor Ver.4.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\ImageMixer 3 SE Camera Monitor Ver.4.lnk
backup=c:\windows\pss\ImageMixer 3 SE Camera Monitor Ver.4.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]
2006-07-05 13:46 679936 ----a-r- c:\programme\VIAudioi\HDADeck\HDeck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
2003-05-08 11:00 49152 ----a-w- c:\programme\ScanSoft\OmniPageSE2.0\opwareSE2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [06.11.2012 22:12 36552]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [06.11.2012 22:12 86752]
R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [24.07.2008 14:22 102400]
R2 WinDefend;Windows Defender;c:\programme\Windows Defender\MsMpEng.exe [03.11.2006 18:19 13592]
R3 AVMWAN;AVM NDIS WAN CAPI-Treiber;c:\windows\system32\drivers\avmwan.sys [08.12.2006 12:03 37568]
R3 fpcibase;AVM ISDN-Controller FRITZ!Card PCI;c:\windows\system32\drivers\fpcibase.sys [08.12.2006 12:03 444416]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [22.10.2012 19:20 73216]
S2 HWDeviceService.exe;HWDeviceService.exe;c:\dokumente und einstellungen\All Users\Anwendungsdaten\DatacardService\HWDeviceService.exe [14.03.2011 16:27 271712]
S2 Mobile Partner. RunOuc;Mobile Partner. OUC;c:\programme\Mobile Partner\UpdateDog\ouc.exe [22.10.2012 19:20 239968]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [22.10.2012 19:20 102784]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [22.10.2012 19:20 235392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-03-13 15:49 1629648 ----a-w- c:\programme\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
2013-03-03 c:\windows\Tasks\At1.job
- c:\programme\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-11-16 19:12]
.
2013-03-03 c:\windows\Tasks\At2.job
- c:\programme\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-11-16 19:12]
.
2013-03-03 c:\windows\Tasks\At3.job
- c:\programme\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-11-16 19:12]
.
2013-03-14 c:\windows\Tasks\At4.job
- c:\programme\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-11-16 19:12]
.
2013-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-12-30 17:30]
.
2013-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-12-30 17:30]
.
2013-03-14 c:\windows\Tasks\MP Scheduled Scan.job
- c:\programme\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
TCP: DhcpNameServer = 192.168.178.1
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - c:\programme\WEB.DE Toolbar\IE\uitb.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-03-14 14:39
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,79,3d,63,60,8e,d4,57,46,99,bd,3d,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,79,3d,63,60,8e,d4,57,46,99,bd,3d,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,79,3d,63,60,8e,d4,57,46,99,bd,3d,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_168_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(636)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(4076)
c:\windows\system32\webcheck.dll
.
Zeit der Fertigstellung: 2013-03-14 14:43:10
ComboFix-quarantined-files.txt 2013-03-14 13:43
ComboFix2.txt 2013-03-13 16:43
.
Vor Suchlauf: 8 Verzeichnis(se), 16.368.664.576 Bytes frei
Nach Suchlauf: 9 Verzeichnis(se), 16.355.315.712 Bytes frei
.
- - End Of File - - 5A6374CD6B3A6248B2D32E4EEAD8C7CD
--- --- ---
Schritt 4 FSS Code:
Farbar Service Scanner Version: 03-03-2013
Ran by Wir (administrator) on 14-03-2013 at 14:51:43
Running from "C:\Dokumente und Einstellungen\Wir\Desktop"
Microsoft Windows XP Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Security Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll
[2006-02-28 13:00] - [2008-04-14 03:22] - 0127488 ____A (Microsoft Corporation) C29A1C9B75BA38FA37F8C44405DEC360
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll
[2006-02-28 13:00] - [2009-04-20 18:17] - 0045568 ____A (Microsoft Corporation) 407F3227AC618FD1CA54B335B083DE07
C:\WINDOWS\system32\ipnathlp.dll
[2006-02-28 13:00] - [2008-04-14 03:22] - 0334336 ____A (Microsoft Corporation) CAD058D5F8B889A87CA3EB3CF624DCEF
C:\WINDOWS\system32\netman.dll
[2006-02-28 13:00] - [2008-04-14 03:22] - 0198144 ____A (Microsoft Corporation) E6D88F1F6745BF00B57E7855A2AB696C
C:\WINDOWS\system32\wbem\WMIsvc.dll
[2006-12-08 12:22] - [2008-04-14 03:22] - 0145408 ____A (Microsoft Corporation) 6F3F3973D97714CC5F906A19FE883729
C:\WINDOWS\system32\srsvc.dll
[2006-12-08 12:24] - [2008-04-14 03:22] - 0171520 ____A (Microsoft Corporation) FE77A85495065F3AD59C5C65B6C54182
C:\WINDOWS\system32\Drivers\sr.sys
[2006-12-08 12:24] - [2008-04-14 03:02] - 0073472 ____A (Microsoft Corporation) 50FA898F8C032796D3B1B9951BB5A90F
C:\WINDOWS\system32\wscsvc.dll
[2006-02-28 13:00] - [2008-04-14 03:22] - 0080896 ____A (Microsoft Corporation) 300B3E84FAF1A5C1F791C159BA28035D
C:\WINDOWS\system32\wbem\WMIsvc.dll
[2006-12-08 12:22] - [2008-04-14 03:22] - 0145408 ____A (Microsoft Corporation) 6F3F3973D97714CC5F906A19FE883729
C:\WINDOWS\system32\wuauserv.dll
[2006-12-08 12:25] - [2008-04-14 03:22] - 0006656 ____A (Microsoft Corporation) 7B4FE05202AA6BF9F4DFD0E6A0D8A085
C:\WINDOWS\system32\qmgr.dll
[2006-12-08 12:25] - [2008-04-14 03:22] - 0409088 ____A (Microsoft Corporation) D6F603772A789BB3228F310D650B8BD1
C:\WINDOWS\system32\es.dll
[2006-02-28 13:00] - [2008-07-07 21:26] - 0253952 ____A (Microsoft Corporation) AF4F6B5739D18CA7972AB53E091CBC74
C:\WINDOWS\system32\cryptsvc.dll
[2006-02-28 13:00] - [2008-04-14 03:22] - 0062464 ____A (Microsoft Corporation) 611F824E5C703A5A899F84C5F1699E4D
C:\WINDOWS\system32\svchost.exe
[2006-02-28 13:00] - [2008-04-14 03:23] - 0014336 ____A (Microsoft Corporation) 4FBC75B74479C7A6F829E0CA19DF3366
C:\WINDOWS\system32\rpcss.dll
[2006-02-28 13:00] - [2009-02-09 11:51] - 0401408 ____A (Microsoft Corporation) 3127AFBF2C1ED0AB14A1BBB7AAECB85B
C:\WINDOWS\system32\services.exe
[2006-02-28 13:00] - [2009-02-09 12:21] - 0111104 ____A (Microsoft Corporation) A3EDBE9053889FB24AB22492472B39DC
Extra List:
=======
Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x0700000005000000010000000200000003000000040000000600000007000000
IpSec Tag value is correct.
**** End of log ****
Hast du eigentlich weitere "Seuche" auf dem PC entdeckt?
Muss los, viele Grüße, Dave. |
