Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Trojaner spioniert Passwörter aus ? (https://www.trojaner-board.de/89628-trojaner-spioniert-passwoerter.html)

loelli06 18.08.2010 22:47
Code:
OTL logfile created on: 8/19/2010 12:26:39 AM - Run
OTLPE by OldTimer - Version 3.1.40.0    Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
895.00 Mb Total Physical Memory | 661.00 Mb Available Physical Memory | 74.00% Memory free
807.00 Mb Paging File | 695.00 Mb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 54.83 Gb Total Space | 15.04 Gb Free Space | 27.44% Space Free | Partition Type: FAT32
Drive D: | 36.45 Gb Total Space | 28.92 Gb Free Space | 79.35% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 433.24 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/08/16 16:12:46 | 001,355,416 | ---- | M] (Lavasoft) [On_Demand] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2008/10/24 12:23:34 | 000,068,865 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe -- (AntiVirScheduler)
SRV - [2008/10/24 12:23:30 | 000,151,297 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe -- (AntiVirService)
SRV - [2008/10/01 13:06:14 | 000,116,040 | ---- | M] (Apple Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2008/09/04 15:52:00 | 000,054,784 | ---- | M] (Macrovision) [Auto] -- C:\WINDOWS\system32\drivers\CDAC11BA.EXE -- (C-DillaCdaC11BA)
SRV - [2007/06/11 10:14:52 | 000,517,040 | ---- | M] ( ) [Auto] -- C:\WINDOWS\System32\lxdicoms.exe -- (lxdi_device)
SRV - [2007/06/11 10:14:42 | 000,099,248 | ---- | M] () [Auto] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdiserv.exe -- (lxdiCATSCustConnectService)
SRV - [2007/02/22 10:38:30 | 000,028,672 | ---- | M] (Dueteoch Ltd) [Auto] -- C:\WINDOWS\Provisioning\services.exe -- (Wireless Location)
SRV - [2007/02/22 10:31:30 | 000,557,182 | ---- | M] (Fieldriemn) [Auto] -- C:\WINDOWS\system32\netcall5.exe -- (Network Managing)
SRV - [2007/01/17 11:20:10 | 000,061,440 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2006/03/28 17:11:56 | 000,036,864 | ---- | M] () [Auto] -- C:\WINDOWS\system32\acs.exe -- (ACS)
SRV - [2006/03/23 17:06:38 | 000,880,128 | ---- | M] (Nero AG) [Auto] -- C:\Programme\Ahead\InCD\InCDsrv.exe -- (InCDsrvR) InCD Helper (read only)
SRV - [2006/03/23 17:06:38 | 000,880,128 | ---- | M] (Nero AG) [Auto] -- C:\Programme\Ahead\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2006/03/20 16:40:10 | 000,304,640 | ---- | M] (XIMETA, Inc.) [Auto] -- C:\Programme\NDAS\System\ndassvc.exe -- (ndassvc)
SRV - [2005/12/12 09:55:00 | 000,656,384 | ---- | M] (ITE Tech. Inc.) [Auto] -- C:\WINDOWS\system32\RemoteControlService.exe -- (ITECIRService)
SRV - [2005/03/04 11:50:00 | 000,118,784 | ---- | M] (AVM Berlin) [Auto] -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE -- (AVM IGD CTRL Service)
SRV - [2005/03/04 11:42:08 | 000,315,392 | ---- | M] (AVM Berlin) [On_Demand] -- C:\Programme\Gemeinsame Dateien\AVM\De_serv.exe -- (de_serv)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (Tosrfcom)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - File not found [Kernel | On_Demand] -- C:\DOKUME~1\TOMMY~1.THO\LOKALE~1\Temp\catchme.sys -- (catchme)
DRV - [2010/08/16 16:12:56 | 000,015,008 | ---- | M] () [Kernel | On_Demand] -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2010/07/12 10:55:40 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot] -- C:\WINDOWS\system32\drivers\Lbd.sys -- (Lbd)
DRV - [2009/08/21 02:08:00 | 000,024,960 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2009/08/21 02:08:00 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2009/08/21 02:08:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2009/05/27 20:23:38 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/05/27 20:23:30 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys -- (avgntflt)
DRV - [2009/05/27 20:23:28 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys -- (avgio)
DRV - [2009/05/12 15:53:04 | 000,016,896 | ---- | M] (Danish Wireless Design A/S) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\FlashUsb.sys -- (FlashUSB)
DRV - [2008/11/06 17:37:30 | 000,009,464 | ---- | M] (Sonic Solutions) [Kernel | System] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2008/11/06 17:37:28 | 000,009,336 | ---- | M] (Sonic Solutions) [Kernel | System] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2008/09/04 15:51:56 | 000,012,464 | ---- | M] (Macrovision Europe Ltd) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\CdaC15BA.SYS -- (CdaC15BA)
DRV - [2008/07/09 14:49:06 | 000,819,072 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mod7700.sys -- (mod7700)
DRV - [2008/04/18 22:49:38 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/04/13 20:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)
DRV - [2008/04/13 18:36:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus)
DRV - [2007/11/01 14:38:56 | 004,620,288 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/10/19 15:32:58 | 000,013,824 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\modrc.sys -- (MODRC)
DRV - [2007/02/24 07:27:38 | 000,019,944 | ---- | M] (Ray Hinchliffe) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SIVX32.sys -- (SIVDRIVER)
DRV - [2006/11/28 22:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PDNMp50.sys -- (PDNMp50)
DRV - [2006/11/28 22:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PDNSp50.sys -- (PDNSp50)
DRV - [2006/09/08 01:53:30 | 000,071,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\StMp3Rec.sys -- (StMp3Rec)
DRV - [2006/05/09 23:27:00 | 000,043,520 | R--- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2006/04/28 23:53:20 | 000,056,792 | R--- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hcw99rc.sys -- (hcw99rc)
DRV - [2006/04/26 22:48:00 | 003,659,968 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2006/04/09 09:54:28 | 000,471,264 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2006/04/06 17:21:08 | 000,118,850 | R--- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\hcw70bda.sys -- (HCW77BDA)
DRV - [2006/03/23 17:15:58 | 000,102,016 | ---- | M] (Nero AG) [File_System | Disabled] -- C:\WINDOWS\System32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2006/03/23 17:15:56 | 000,033,536 | ---- | M] (Nero AG) [Kernel | System] -- C:\WINDOWS\System32\drivers\InCDrm.sys -- (incdrm)
DRV - [2006/03/23 17:15:56 | 000,029,440 | ---- | M] (Nero AG) [Kernel | System] -- C:\WINDOWS\system32\drivers\InCDpass.sys -- (InCDPass)
DRV - [2006/03/23 17:00:28 | 000,008,704 | ---- | M] (Nero AG) [Recognizer | System] -- C:\WINDOWS\System32\drivers\InCDrec.sys -- (InCDrec)
DRV - [2006/03/20 16:40:52 | 000,140,160 | ---- | M] (XIMETA, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\lfsfilt.sys -- (lfsfilt)
DRV - [2006/03/20 16:39:58 | 000,059,136 | ---- | M] (XIMETA, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ndasbus.sys -- (ndasbus)
DRV - [2006/03/20 16:39:58 | 000,044,288 | ---- | M] (XIMETA, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\lpx.sys -- (lpx)
DRV - [2006/03/06 16:49:36 | 000,011,136 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2005/10/21 02:13:08 | 000,191,936 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2005/10/03 10:26:36 | 000,720,470 | ---- | M] (Syntek America Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SynMini.sys -- (SynMini)
DRV - [2005/10/03 10:26:14 | 000,008,278 | ---- | M] (Syntek America Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SynScan.sys -- (SynScan)
DRV - [2005/09/29 22:34:10 | 000,310,016 | ---- | M] (REDC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2005/09/16 23:01:50 | 000,028,672 | ---- | M] (REDC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005/09/14 00:45:24 | 000,050,560 | ---- | M] (REDC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005/08/22 04:07:00 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/08/22 04:06:16 | 000,201,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/08/22 04:06:10 | 000,718,464 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005/03/03 22:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2005/02/17 10:07:48 | 000,005,632 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2005/01/07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/05/27 22:13:04 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\ATK0100\ASNDIS5.sys -- (ASNDIS5)
DRV - [2004/04/22 15:03:02 | 000,007,366 | ---- | M] (IET Tech. Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ITECIR.sys -- (ITECIR)
DRV - [2004/03/24 04:12:34 | 000,017,280 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\nsndis5.sys -- (NSNDIS5)
DRV - [2001/08/17 13:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)
DRV - [2001/08/17 13:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.asus.com
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.asus.com
 
IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.asus.com
 
 
IE - HKU\Tommy.THOMAS_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Tommy.THOMAS_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Tommy.THOMAS_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bild.de/
IE - HKU\Tommy.THOMAS_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Tommy.THOMAS_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
IE - HKU\Ute_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Ute_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\Ute_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\Ute_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.sparkasse-uelzen-luechow-dannenberg.de/inner.php?IFLBSERVERID=IF@@051@@IF
IE - HKU\Ute_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\Ute_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\Programme\Mozilla Firefox\components [2008/02/07 17:18:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2008/02/07 17:18:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Programme\Netscape\Netscape\Components [2007/06/13 13:13:14 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Programme\Netscape\Netscape\Plugins [2007/06/13 13:13:08 | 000,000,000 | ---D | M]
 
[2008/02/07 17:18:26 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010/05/29 06:54:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2008/02/07 17:18:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\inspector@mozilla.org
[2008/02/07 17:18:28 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions\talkback@mozilla.org
[2009/02/10 18:52:32 | 000,067,688 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\jar50.dll
[2009/02/10 18:52:32 | 000,054,368 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\jsd3250.dll
[2009/02/10 18:52:32 | 000,034,944 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\myspell.dll
[2009/02/10 18:52:32 | 000,046,712 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\spellchk.dll
[2009/02/10 18:52:32 | 000,172,136 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\xpinstal.dll
[2007/11/20 16:52:00 | 002,884,992 | ---- | M] () -- C:\Programme\Mozilla Firefox\plugins\NPSWF32.dll
[2010/05/29 06:53:58 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/02/10 18:52:40 | 000,001,525 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009/02/10 18:52:40 | 000,001,063 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2009/02/10 18:52:40 | 000,000,998 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2009/02/10 18:52:40 | 000,000,815 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004/08/04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKU\Tommy.THOMAS_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\Tommy.THOMAS_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\Tommy.THOMAS_ON_C\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.
O3 - HKU\Ute_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\Ute_ON_C\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.
O3 - HKU\Ute_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\Ute_ON_C\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [ACU] C:\Programme\ASUS WLAN Adapter\ACU.exe (Atheros Communications, Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATKHOTKEY] C:\Programme\ATK Hotkey\Hcontrol.exe (ATK0100)
O4 - HKLM..\Run: [bonjour1] C:\WINDOWS\System32\ftpcommander.exe File not found
O4 - HKLM..\Run: [ftpcommander1] C:\WINDOWS\system32\winrar.exe ( )
O4 - HKLM..\Run: [GUpdate] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WebAuto3\Refresh.exe (Gamblock Pty Ltd)
O4 - HKLM..\Run: [iespell1] C:\WINDOWS\System32\bonjour.exe File not found
O4 - HKLM..\Run: [lexmarkfaxsolutions1] C:\WINDOWS\System32\iespell.exe File not found
O4 - HKLM..\Run: [lxdiamon] C:\Programme\Lexmark 3500-4500 Series\lxdiamon.exe ()
O4 - HKLM..\Run: [lxdimon.exe] C:\Programme\Lexmark 3500-4500 Series\lxdimon.exe ()
O4 - HKLM..\Run: [microsoftmoney1] C:\WINDOWS\system32\microsoftmoney.exe ( )
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [winrar1] C:\WINDOWS\system32\winrar.exe ( )
O4 - HKLM..\Run: [Wireless Console 2] C:\Programme\Wireless Console 2\wcourier.exe ()
O4 - HKU\Tommy.THOMAS_ON_C..\Run: [PhotoShow Deluxe Media Manager] C:\Programme\Ahead\Nero PhotoShow\data\Xtras\mssysmgr.exe (Ahead Software)
O4 - HKU\Tommy.THOMAS_ON_C..\Run: [Uniblue RegistryBooster 2] C:\Programme\Uniblue\RegistryBooster 2\RegistryBooster.exe (Uniblue Software)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Pinnacle Streaming Server.lnk = C:\Programme\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe (Avid Development GmbH)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe (AVM Berlin)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Tommy.THOMAS_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\Tommy.THOMAS_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\Ute_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {463ED66E-431B-11D2-ADB0-0080C83DA4EB} https://w3s.webmoney.ru/WMAcceptor.dll (AcceptWM Class)
O16 - DPF: {7876E4A5-78B7-4020-B08F-C960A1ED54C9} hxxp://www.webcamcancun.com/WinWebPush.cab (WebWatch Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab (EPUImageControl Class)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/1.4/jinstall-14_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://200.79.225.92:8080/activex/AMC.cab (Reg Error: Key error.)
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} hxxp://driveragent.com/files/driveragent.cab (Driver Agent ActiveX Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/29 00:26:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010/08/18 22:50:16 | 126,853,622 | ---- | C] (Igor Pavlov) -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\OTLPENet.exe
[2010/08/18 21:44:20 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\OTH.scr
[2010/08/18 20:49:00 | 000,000,000 | --SD | C] -- C:\Combo-Fix
[2010/08/18 19:38:58 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/08/18 19:36:07 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/08/18 19:36:07 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/08/18 19:36:07 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/08/18 19:36:07 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/08/18 19:36:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/08/18 19:35:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/08/17 15:45:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Malwarebytes
[2010/08/17 15:45:31 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/08/17 15:45:29 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/08/17 15:45:29 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010/08/17 14:51:41 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Scann.exe
[2010/08/17 07:58:49 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2010/08/16 16:12:58 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/08/16 12:41:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Desktop
[2010/08/16 12:29:12 | 000,064,288 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2010/08/16 12:28:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Lokale Einstellungen\Anwendungsdaten\Sunbelt Software
[2010/08/05 00:32:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\vlc
[2010/08/05 00:31:29 | 000,000,000 | ---D | C] -- C:\Programme\VideoLAN
[2010/08/01 19:52:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Logo
[2010/08/01 13:45:54 | 000,000,000 | -HSD | C] -- C:\FOUND.001
[2010/08/01 01:02:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\reise london
[2010/07/30 19:10:00 | 000,000,000 | -HSD | C] -- C:\FOUND.000
[2010/07/30 18:55:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ute\Lokale Einstellungen\Anwendungsdaten\TowerGaming.com
[2010/07/30 18:55:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\TowerGaming.com
[2010/07/30 17:53:02 | 000,000,000 | ---D | C] -- C:\Towergaming
[2010/07/30 17:37:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Lokale Einstellungen\Anwendungsdaten\TowerGaming.com
[2010/07/30 17:37:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\TowerGaming.com
[2010/07/30 17:36:34 | 000,000,000 | ---D | C] -- C:\Programme\Tower Gaming
[2010/07/29 09:54:58 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Ute\PrivacIE
[2010/07/29 09:54:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Ute\IETldCache
[2010/07/29 09:53:38 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\PrivacIE
[2010/07/29 09:53:09 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\IETldCache
[2010/07/29 09:42:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2010/07/29 09:39:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe
[2007/09/20 18:42:12 | 000,311,296 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdihcp.dll
[2007/09/20 18:42:11 | 001,187,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiserv.dll
[2007/09/20 18:42:11 | 000,942,080 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiusb1.dll
[2007/09/20 18:42:11 | 000,671,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdihbn3.dll
[2007/09/20 18:42:11 | 000,614,400 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdipmui.dll
[2007/09/20 18:42:11 | 000,532,480 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdilmpm.dll
[2007/09/20 18:42:11 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiinpa.dll
[2007/09/20 18:42:11 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiiesc.dll
[2007/09/20 18:42:11 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdiprox.dll
[2007/09/20 18:42:11 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdipplc.dll
[2007/09/20 18:42:10 | 000,765,952 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdicomc.dll
[2007/09/20 18:42:10 | 000,360,448 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdicomm.dll
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010/08/18 22:59:04 | 000,262,144 | ---- | M] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT
[2010/08/18 22:59:04 | 000,245,760 | ---- | M] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT
[2010/08/18 22:58:58 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/08/18 22:58:56 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/08/18 22:57:16 | 005,767,168 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\ntuser.dat
[2010/08/18 22:57:06 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\ntuser.ini
[2010/08/18 22:50:18 | 126,853,622 | ---- | M] (Igor Pavlov) -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\OTLPENet.exe
[2010/08/18 22:36:02 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/18 21:51:12 | 000,050,868 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/08/18 21:50:06 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/08/18 21:50:02 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/18 21:44:24 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\OTH.scr
[2010/08/18 20:47:00 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/08/18 20:29:24 | 000,000,699 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Internet Explorer Browser starten.lnk
[2010/08/18 19:39:02 | 000,000,281 | -HS- | M] () -- C:\boot.ini
[2010/08/18 19:33:00 | 003,819,088 | R--- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Combo-Fix.exe
[2010/08/18 18:01:04 | 000,037,376 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\ombudsmann.wps
[2010/08/18 00:10:38 | 002,842,624 | ---- | M] () -- C:\Dokumente und Einstellungen\Ute\ntuser.dat
[2010/08/18 00:09:22 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Ute\ntuser.ini
[2010/08/17 21:56:08 | 000,017,528 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Ausgabentabelle.ods
[2010/08/17 14:49:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Scann.exe
[2010/08/17 07:58:50 | 000,001,602 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\HijackThis.lnk
[2010/08/16 16:12:58 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/08/16 12:27:58 | 000,000,769 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/08/14 08:09:14 | 000,022,016 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\2010neu.xlr
[2010/08/14 08:09:10 | 000,021,504 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\2011neu.xlr
[2010/08/14 08:09:08 | 000,020,992 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\2012neu.xlr
[2010/08/13 14:26:08 | 000,237,552 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/13 07:02:02 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/08/13 07:00:52 | 001,000,430 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/13 07:00:52 | 000,449,966 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2010/08/13 07:00:52 | 000,433,332 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/08/13 07:00:52 | 000,080,822 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2010/08/13 07:00:52 | 000,068,096 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/08/10 17:55:44 | 000,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/08/10 17:55:36 | 000,011,264 | ---- | M] () -- C:\Dokumente und Einstellungen\Ute\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/08 16:03:32 | 000,011,670 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\.recently-used.xbel
[2010/08/08 16:02:56 | 000,019,965 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Count_Dracula_Christopher_Lee.jpg
[2010/08/05 00:28:02 | 000,000,209 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\default.pls
[2010/08/04 21:26:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/04 17:53:46 | 000,020,992 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\2013.xlr
[2010/08/04 17:53:40 | 000,020,992 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\2014.xlr
[2010/08/04 17:53:36 | 000,020,480 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\2016.xlr
[2010/08/04 17:53:16 | 000,020,480 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\2015.xlr
[2010/08/02 15:58:54 | 000,559,158 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\02.08.2010 15;58;53.jpg
[2010/08/02 15:57:50 | 000,601,220 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\02.08.2010 15;57;50.jpg
[2010/07/29 09:54:46 | 000,001,711 | ---- | M] () -- C:\Dokumente und Einstellungen\Ute\Desktop\NSSstub.lnk
[2010/07/29 09:54:46 | 000,000,699 | ---- | M] () -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Internet Explorer Browser starten.lnk
[2010/07/27 08:29:42 | 008,503,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll
[2010/07/27 08:27:16 | 000,014,588 | ---- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\Erwerbsminderugsrente__  Cröhnchen-Klub Forum.mht
[2010/07/24 05:58:34 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/07/23 14:54:26 | 000,179,276 | -H-- | M] () -- C:\Dokumente und Einstellungen\Ute\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010/07/23 14:53:48 | 000,260,564 | -H-- | M] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010/08/18 19:39:01 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/08/18 19:38:59 | 000,262,448 | ---- | C] () -- C:\cmldr
[2010/08/18 19:36:07 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/08/18 19:36:07 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/08/18 19:36:07 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/08/18 19:36:07 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/08/18 19:36:07 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/08/18 19:32:49 | 003,819,088 | R--- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Combo-Fix.exe
[2010/08/18 17:39:57 | 000,037,376 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\ombudsmann.wps
[2010/08/17 07:58:49 | 000,001,602 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\HijackThis.lnk
[2010/08/16 12:49:59 | 000,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2010/08/16 12:30:41 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/08/16 12:27:57 | 000,000,769 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/08/12 19:25:58 | 000,001,685 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Microsoft Works-Tabellenkalkulation.lnk
[2010/08/08 16:03:30 | 000,011,670 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\.recently-used.xbel
[2010/08/08 16:03:15 | 000,019,965 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\Count_Dracula_Christopher_Lee.jpg
[2010/08/02 15:58:56 | 000,559,158 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\02.08.2010 15;58;53.jpg
[2010/08/02 15:57:54 | 000,601,220 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Desktop\02.08.2010 15;57;50.jpg
[2010/07/29 13:06:45 | 005,767,168 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\ntuser.dat
[2010/07/29 13:06:45 | 002,842,624 | ---- | C] () -- C:\Dokumente und Einstellungen\Ute\ntuser.dat
[2010/07/29 09:54:44 | 000,001,711 | ---- | C] () -- C:\Dokumente und Einstellungen\Ute\Desktop\NSSstub.lnk
[2010/07/29 09:39:43 | 000,000,504 | ---- | C] () -- C:\WINDOWS\tasks\NSSstub.job
[2010/07/27 08:27:10 | 000,014,588 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Eigene Dateien\Erwerbsminderugsrente__  Cröhnchen-Klub Forum.mht
[2010/03/21 16:13:40 | 000,011,264 | ---- | C] () -- C:\Dokumente und Einstellungen\Ute\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/14 23:16:09 | 000,000,032 | ---- | C] () -- C:\WINDOWS\System32\thxcfg.ini
[2010/02/05 14:03:16 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\$_hpcst$.hpc
[2010/01/19 17:32:59 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\$_hpcst$.hpc
[2010/01/18 11:33:55 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\CommonDL.dll
[2010/01/18 11:33:55 | 000,002,412 | ---- | C] () -- C:\WINDOWS\System32\lgAxconfig.ini
[2009/10/05 12:37:21 | 000,000,151 | ---- | C] () -- C:\WINDOWS\System32\ic32.ini
[2009/10/05 12:37:20 | 000,398,336 | ---- | C] () -- C:\WINDOWS\System32\Tx32.dll
[2009/08/03 12:13:49 | 000,201,488 | ---- | C] () -- C:\WINDOWS\System32\MACD32.DLL
[2009/08/03 12:13:49 | 000,144,144 | ---- | C] () -- C:\WINDOWS\System32\MASE32.DLL
[2009/08/03 12:13:49 | 000,141,584 | ---- | C] () -- C:\WINDOWS\System32\MAMC32.DLL
[2009/08/03 12:13:49 | 000,063,248 | ---- | C] () -- C:\WINDOWS\System32\MASD32.DLL
[2009/08/03 12:13:49 | 000,033,040 | ---- | C] () -- C:\WINDOWS\System32\MA32.DLL
[2009/05/26 14:45:03 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2008/12/28 12:50:54 | 000,000,470 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\guns
[2008/12/28 11:42:30 | 000,000,122 | ---- | C] () -- C:\WINDOWS\cddabase.ini
[2008/11/26 15:04:38 | 000,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll
[2008/11/06 17:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/11/06 17:34:00 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008/08/02 22:59:08 | 000,000,012 | ---- | C] () -- C:\WINDOWS\dirsaver.ini
[2008/02/26 17:19:10 | 000,000,111 | ---- | C] () -- C:\WINDOWS\telephon.ini
[2008/01/30 22:00:18 | 000,068,096 | ---- | C] () -- C:\WINDOWS\System32\lfplt11n.dll
[2008/01/30 22:00:16 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll
[2008/01/30 22:00:16 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2008/01/30 21:58:50 | 000,000,152 | ---- | C] () -- C:\WINDOWS\Missing.ini
[2008/01/17 13:09:09 | 000,000,825 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\.plugin141_02.trace
[2007/11/11 05:56:34 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2007/09/25 18:39:56 | 000,000,116 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\LuResult.txt
[2007/09/20 18:43:09 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdivs.dll
[2007/09/20 18:43:07 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\lxdicoin.dll
[2007/09/20 18:42:49 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdidrs.dll
[2007/09/20 18:42:49 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdicnv4.dll
[2007/09/20 18:42:49 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdicaps.dll
[2007/09/20 18:42:12 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\lxdiinst.dll
[2007/09/20 18:42:11 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdigrd.dll
[2007/08/23 18:10:57 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL
[2007/06/17 23:23:02 | 000,000,209 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\default.pls
[2007/04/11 15:30:59 | 000,003,282 | ---- | C] () -- C:\WINDOWS\tm.ini
[2007/02/07 23:55:11 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2007/02/04 22:10:41 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2007/01/13 22:30:49 | 000,000,936 | ---- | C] () -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\wklnhst.dat
[2006/11/28 08:44:46 | 000,033,807 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2006/11/28 08:44:25 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\dmcrypto.dll
[2006/11/28 08:44:04 | 000,000,135 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/11/28 08:44:03 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\hcwChDB.dll
[2006/11/28 08:43:19 | 000,010,344 | ---- | C] () -- C:\WINDOWS\HCWPNP.INI
[2006/11/28 08:40:58 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2006/11/25 13:30:30 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2006/11/22 23:52:00 | 000,071,680 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/22 23:39:06 | 000,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006/11/22 23:34:45 | 000,024,844 | ---- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\wklnhst.dat
[2006/11/22 20:30:57 | 000,008,192 | -H-- | C] () -- C:\Dokumente und Einstellungen\Ute\ntuser.dat.LOG
[2006/11/22 20:30:57 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\Ute\ntuser.ini
[2006/11/22 19:58:33 | 000,008,192 | -H-- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\ntuser.dat.LOG
[2006/11/22 19:58:33 | 000,000,190 | -HS- | C] () -- C:\Dokumente und Einstellungen\Tommy.THOMAS\ntuser.ini
[2006/08/29 01:29:49 | 000,262,144 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT
[2006/08/29 01:29:48 | 000,245,760 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT
[2006/08/29 00:54:37 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2006/08/29 00:30:03 | 000,000,941 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2006/08/29 00:29:49 | 000,090,112 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\ntuser.dat.LOG
[2006/08/29 00:29:49 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\LocalService\ntuser.ini
[2006/08/29 00:29:48 | 000,008,192 | -H-- | C] () -- C:\Dokumente und Einstellungen\NetworkService\ntuser.dat.LOG
[2006/08/29 00:29:48 | 000,000,020 | -HS- | C] () -- C:\Dokumente und Einstellungen\NetworkService\ntuser.ini
[2006/08/28 18:58:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/04/26 22:48:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/04/26 22:48:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/04/26 22:48:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/04/26 22:48:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/04/26 22:48:00 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2005/05/06 06:06:00 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll
[2005/02/17 10:07:48 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\ATKACPI.sys
[2004/10/11 12:19:00 | 000,092,672 | ---- | C] () -- C:\WINDOWS\System32\ASUSASV2.DLL
[2004/09/07 16:34:59 | 000,007,424 | ---- | C] () -- C:\WINDOWS\System32\drivers\MMIOPORT.SYS
[2004/09/07 16:34:59 | 000,002,524 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2002/05/16 14:05:54 | 000,098,304 | ---- | C] () -- C:\WINDOWS\System32\CddbLangIT.dll
[2002/05/10 10:58:10 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\CddbLangFR.dll
 
========== LOP Check ==========
 
[2008/03/04 10:56:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\FRITZ!
[2006/11/22 20:09:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Opera
[2006/11/22 23:22:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Simple Star
[2006/11/22 23:28:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Snapfish
[2006/11/22 23:35:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Template
[2008/03/04 11:06:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\FRITZ!fax für FRITZ!Box
[2008/03/19 16:28:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Microgaming
[2008/07/29 14:53:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Uniblue
[2008/07/29 15:11:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\System Tweaker
[2008/08/06 23:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Betfair
[2010/05/04 21:49:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\UB
[2008/11/08 13:26:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\OpenOffice.org
[2008/11/26 17:50:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\TrojanHunter
[2008/12/15 19:16:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\PacificPoker
[2009/01/25 23:00:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\KaLoMa
[2009/08/11 14:47:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\TomTom
[2009/12/25 08:21:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\LG Electronics
[2010/01/21 12:47:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\elsterformular
[2010/02/28 16:46:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\TuneUp Software
[2010/05/22 17:07:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\gtk-2.0
[2010/07/30 17:37:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\TowerGaming.com
[2006/12/10 13:21:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\DeepBurner
[2006/12/10 14:23:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Pegasys Inc
[2006/12/25 21:38:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Mp3tag
[2007/01/29 07:55:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\ieSpell
[2007/08/23 19:02:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Lexmark Productivity Studio
[2007/10/28 22:13:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\POPFile
[2007/12/04 17:32:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Orbit
[2007/12/13 13:17:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\MSNInstaller
[2008/02/21 22:58:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tommy.THOMAS\Anwendungsdaten\Leadertech
[2010/04/02 10:20:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\FRITZ!
[2007/01/13 22:31:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\Template
[2008/08/28 21:44:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\FRITZ!
[2009/09/24 18:11:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\OpenOffice.org
[2010/01/29 10:38:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\elsterformular
[2010/02/28 21:36:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\TuneUp Software
[2010/07/30 18:55:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ute\Anwendungsdaten\TowerGaming.com
[2009/08/03 12:09:06 | 000,000,504 | ---- | M] () -- C:\WINDOWS\Tasks\NSSstub.job
[2010/08/18 20:47:00 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
 
========== Purity Check ==========
 
 
< End of report >
Code:
OTL Extras logfile created on: 8/19/2010 12:26:39 AM - Run
OTLPE by OldTimer - Version 3.1.40.0    Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
895.00 Mb Total Physical Memory | 661.00 Mb Available Physical Memory | 74.00% Memory free
807.00 Mb Paging File | 695.00 Mb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 54.83 Gb Total Space | 15.04 Gb Free Space | 27.44% Space Free | Partition Type: FAT32
Drive D: | 36.45 Gb Total Space | 28.92 Gb Free Space | 79.35% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 433.24 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
Using ControlSet: ControlSet003
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Lexmark 3500-4500 Series\app4r.exe" = C:\Programme\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Lexmark 3500-4500 Series\LXDIAMON.EXE" = C:\Programme\Lexmark 3500-4500 Series\LXDIAMON.EXE:*:Disabled:Device Monitor Application -- ()
"C:\Programme\Lexmark 3500-4500 Series\LXDIMON.EXE" = C:\Programme\Lexmark 3500-4500 Series\LXDIMON.EXE:*:Disabled:Device Monitor -- ()
"C:\Programme\Lexmark 3500-4500 Series\Wireless\lxdiwpss.exe" = C:\Programme\Lexmark 3500-4500 Series\Wireless\lxdiwpss.exe:*:Enabled:  -- ()
"C:\Programme\Zattoo\zattood.exe" = C:\Programme\Zattoo\zattood.exe:*:Enabled:zattood -- ()
"C:\Programme\Zattoo\Zattoo2.exe" = C:\Programme\Zattoo\Zattoo2.exe:*:Enabled:  -- ()
"C:\Programme\Lexmark 3500-4500 Series\App4R.exe" = C:\Programme\Lexmark 3500-4500 Series\App4R.exe:*:Enabled:Printing Application -- ()
"C:\WINDOWS\System32\SPOOL\DRIVERS\W32X86\3\lxdiPSWX.EXE" = C:\WINDOWS\System32\SPOOL\DRIVERS\W32X86\3\lxdiPSWX.EXE:*:Enabled:Printer Status Window Interface -- ()
"C:\Programme\SmartFTP Client\SmartFTP.exe" = C:\Programme\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5 -- (SmartSoft Ltd.)
"C:\WINDOWS\System32\lxdiih.exe" = C:\WINDOWS\System32\lxdiih.exe:*:Enabled:Printer Communication System -- ( )
"C:\Programme\FRITZ!DSL\IGDCTRL.EXE" = C:\Programme\FRITZ!DSL\IGDCTRL.EXE:*:Enabled:FRITZ!DSL - igdctrl.exe -- (AVM Berlin)
"C:\Programme\Zattoo\Zattoo.exe" = C:\Programme\Zattoo\Zattoo.exe:*:Enabled:  -- ()
"C:\Programme\FRITZ!fax\FriFax32.exe" = C:\Programme\FRITZ!fax\FriFax32.exe:*:Enabled:FRITZ!fax -- (AVM Berlin)
"C:\Programme\FRITZ!DSL\FBOXUPD.EXE" = C:\Programme\FRITZ!DSL\FBOXUPD.EXE:*:Enabled:AVM FRITZ!Box Firmware-Update -- (AVM Berlin)
"F:\Programme\PuzzleOnline\PuzzleOnline.exe" = F:\Programme\PuzzleOnline\PuzzleOnline.exe:*:Disabled:PuzzleOnline -- File not found
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Programme\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe" = C:\Programme\Pinnacle\Shared Files\Programs\StrmServer\StrmServer.exe:LocalSubNet:Enabled:Pinnacle Streaming Server -- (Avid Development GmbH)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{065D5505-3821-4C2E-BB6C-FE66A7E7CB4F}" = USB Flash Port Driver
"{06604771-5346-492A-93C1-486B6CCD10AD}" = MP3 Player
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}" = LG PC Suite II
"{169E414A-37C7-434E-9021-27A03AE087CD}" = ASUS VideoSecurity Online
"{21BBAD12-C75F-4F06-A9B0-6F8BEEAF3846}" = Moorhuhn X - XS
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = ASUS Client Installation Program
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{4462AD13-F2AA-4CBD-9F95-293C38EED870}" = Power4 Gear
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5E0C9350-250A-45B1-B77A-C18F27E256FE}" = Roxio WinOnCD 6 Power Edition
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = ASUSDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7C7AC2D4-1077-45C8-826A-16445B5E0DB7}" = Pinnacle DistanTV Server
"{7EC19307-7C22-47A8-922B-3FA965291260}" = OpenOffice.org 3.0
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{89DDBCD4-B326-4545-9A05-26C7B16C1DEB}" = PowerForPhone
"{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour
"{8DC42D05-680B-41B0-8878-6C14D24602DB}" = QuickTime
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}" = Apple Mobile Device Support
"{A12A36D3-ACB7-11D9-8E75-000D614181EB}" = NDAS Software 3.11.1327
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe® Photoshop® Album Starter Edition 3.2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.5 - Deutsch
"{AC76BA86-7AD7-1031-7B44-A81300000003}_814" = KB408682
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B480BD2A-F1BA-4FE6-8C8E-34C6111B72C9}" = ElsterFormular 2007/2008
"{BCA09E3E-34A6-4444-BE77-F4FBD0F26188}" = TMPGEnc 4.0 XPress Testversion
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology
"{C169D3BB-9A27-43F5-9979-09A0D65FE95C}" = SmartFTP Client
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem Driver
"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery
"{CBBCBE04-EA5E-4201-A924-E7ED3E8686AE}" = ElsterFormular 2006/2007
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}" = iTunes
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EF5B1E83-1403-4F0E-A8E6-C169DF0CCE8C}" = LG PC Suite II
"{EFCE5837-FC21-11D6-9D24-00010240CE95}" = Java 2 Runtime Environment, SE v1.4.1_02
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}" = Pinnacle TVCenter Pro
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"7D6D030B3D73FCCA3D4E45319380F315DFBE7A54" = Windows-Treiberpaket - Infineon Technologies (FlashUSB) USB  (04/16/2009 1.0.0.6)
"Ad-Aware" = Ad-Aware
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe® Photoshop® Album Starter Edition 3.2" = Adobe® Photoshop® Album Starter Edition 3.2
"AntiVir PersonalEdition Classic" = Avira AntiVir Personal - Free Antivirus
"Asus_A_Series_ScreenSaver" = Asus_A_Series_ScreenSaver
"AVMFBox" = FRITZ!Box
"Backgammon!" = Backgammon!
"CdaC13Ba" = SafeCast Shared Components
"DATA BECKER - 3.333 Bewerbungen" = DATA BECKER - 3.333 Bewerbungen
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"ElsterFormular 11.1.0 11.1.0.***unknown variable buildnummer***" = ElsterFormular 11.1.0
"FLVPlayer" = FLV Player 1.3.3
"FRITZ!DSL" = AVM FRITZ!DSL
"FRITZ!fax" = AVM FRITZ!fax
"FTP Commander" = FTP Commander
"Generic USB Card Reader Driver" = Generic USB Card Reader Driver v2.2f
"getPlus(R)_ocx" = getPlus(R)_ocx
"Google Chrome" = Google Chrome
"HControl" = ATK0100 ACPI UTILITY
"HijackThis" = HijackThis 2.0.2
"hsv_screensaver_07-2008.scr" = hsv_screensaver_07-2008
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell
"Infineon USB driver_is1" = Infineon USB driver 1.0.0.6
"InstallShield_{169E414A-37C7-434E-9021-27A03AE087CD}" = ASUS VideoSecurity Online
"Java Web Start" = Java Web Start
"KaloMa_is1" = KaloMa 5.00alpha20080914
"Lexmark 3500-4500 Series" = Lexmark 3500-4500 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaShow" = Medi@Show
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (2.0.0.20)" = Mozilla Firefox (2.0.0.20)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSMONEYV70" = Microsoft Money 99
"MSNINST" = MSN
"Nero PhotoShow Express" = Nero PhotoShow Express
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Netscape (7.1)" = Netscape (7.1)
"Network Stumbler" = Network Stumbler 0.4.0 (remove only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Phototool 1.8" = Phototool 1.8
"RegistryBooster 2_is1" = Uniblue RegistryBooster 2
"Screen Clean Screensaver" = Screen Clean Screensaver
"Security Task Manager" = Security Task Manager 1.7h
"SmartFTP Client 2.5 Setup Files" = SmartFTP Client 2.5 Setup Files (remove only)
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"System Tweaker_is1" = Uniblue System Tweaker
"SystemRequirementsLab" = System Requirements Lab
"Tower Gaming_is1" = Tower Gaming
"TrojanHunter_is1" = TrojanHunter 5.0
"TVgenial" = TVgenial
"ViewpointMediaPlayer" = Viewpoint Media Player (Remove Only)
"Visitenkarten in 2 Minuten" = Visitenkarten in 2 Minuten
"VLC media player" = VLC media player 1.1.2
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Zattoo" = Zattoo 3.3.4 Beta
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\Tommy.THOMAS_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\Ute_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
 
< End of report >
Bei Select User Profile waren mehrere Auswahlmöglichkeiten, ich habe dann das erste makiert:

LocalService

Swisstreasure 19.08.2010 06:56
Sehr gut. Ein Zwischenerfolg :)

Werde mir die Logs am Abend noch anschauen.

loelli06 19.08.2010 07:34
OK bin heute Abend zuhause. Vielen Dank für die Mühe.

Swisstreasure 19.08.2010 20:08
Schritt 1

Programme deinstallieren

Da einige Programme und Anti-Spy-Programme uns u. U. bei der Bereinigung behindern (z. B. durch ständig laufende Hintergrundwächter), unnötig oder schädlich sind oder einfach nicht mehr gebraucht werden, bitte ich darum, die folgenden Programme über Systemsteuerung => Software komplett zu deinstallieren.
Code:
iespell
Berichte mir, falls sich ein Programm nicht deinstallieren lässt. Nach Beendigung der Bereinigung können wir schauen, welche davon Du wieder installieren kannst/sollest.

Schritt 2

Du musst diesen Schritt auch wieder über OTLPE machen so wie du das Log erstellt hast.

Fixen mit OTL
  • Starte das unbootbare System neu und boote von der CD, die Du gerade erstellt hast.
  • Anmerkung: Wenn Du nicht weißt, wie Du Deinen Computer dazu bringst, von CD zu booten, dann folge diesen Schritten hier.
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • Kopiere folgendes Skript:
Code:
:OTL
O4 - HKLM..\Run: [bonjour1] C:\WINDOWS\System32\ftpcommander.exe File not found
O4 - HKLM..\Run: [ftpcommander1] C:\WINDOWS\system32\winrar.exe ( )
O4 - HKLM..\Run: [iespell1] C:\WINDOWS\System32\bonjour.exe File not found
O4 - HKLM..\Run: [lexmarkfaxsolutions1] C:\WINDOWS\System32\iespell.exe File not found
O4 - HKLM..\Run: [microsoftmoney1] C:\WINDOWS\system32\microsoftmoney.exe ( )
O4 - HKLM..\Run: [GUpdate] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WebAuto3\Refresh.exe (Gamblock Pty Ltd)
O4 - HKLM..\Run: [winrar1] C:\WINDOWS\system32\winrar.exe ( )
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
:Commands
[purity]
[emptytemp]

Schritt 3

Rootkit-Suche mit Gmer

Was sind Rootkits?

Wichtig: Bei jedem Rootkit-Scans soll/en:
  • Deaktiviere zunächst nach dieser Anleitung evtl. vorhandene CD-Emulatoren wie Alcohol, Daemon-Tools oder ähnliche.
  • Alle anderen Programme gegen Viren, Spyware, usw. deaktiviert sein,
  • keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen),
  • nichts am Rechner getan werden,
  • nach jedem Scan der Rechner neu gestartet werden.
  • Nicht vergessen, nach dem Rootkit-Scan die Security-Programme wieder einzuschalten!

Lade Dir Gmer von dieser Seite herunter
(auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
  • Alle anderen Programme sollen geschlossen sein.
  • Starte gmer.exe (hat einen willkürlichen Programm-Namen).
  • Vista-User mit Rechtsklick und als Administrator starten.
  • Gmer startet automatisch einen ersten Scan.
  • Sollte sich ein Fenster mit folgender Warnung öffnen:
    Code:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system?
  • Unbedingt auf "No" klicken,
    in dem Fall über den Save-Button das bisherige Resultat auf dem Desktop als gmer_first.log speichern.

    .
  • Falls das nicht der Fall war, wähle nun den Reiter "Rootkit/Malware",
  • Hake an: System, Sections, Devices, Modules, Processes, Threads, Libraries, Services, Registry und Files.
  • Wichtig: "Show all" darf nicht angehakt sein!
  • Starte den Scan durch Drücken des Buttons "Scan".
    Mache nichts am Computer während der Scan läuft (unten links wird angezeigt, was gerade gescannt wird).
  • Wenn der Scan fertig ist, bleibt die Zeile leer.
    Kllicke auf "Save" und speichere das Logfile als gmer.log auf dem Desktop.
    Mit "Ok" wird Gmer beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Nun das Logfile in Code-Tags posten.

Schritt 4

Poste mit bitte C:\ComboFix.txt

loelli06 19.08.2010 20:58
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:29 on 19/08/2010 (Tommy)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-08-19 22:44:05
Windows 5.1.2600 Service Pack 3
Running: pe8cd2gb.exe; Driver: C:\DOKUME~1\TOMMY~1.THO\LOKALE~1\Temp\uwtdipoc.sys


---- System - GMER 1.0.15 ----

SSDT            Lbd.sys (Boot Driver/Lavasoft AB)                                                                                  ZwCreateKey [0xF750C87E]
SSDT            F7AFEA04                                                                                                            ZwCreateThread
SSDT            F7AFE9F0                                                                                                            ZwOpenProcess
SSDT            F7AFE9F5                                                                                                            ZwOpenThread
SSDT            Lbd.sys (Boot Driver/Lavasoft AB)                                                                                  ZwSetValueKey [0xF750CBFE]
SSDT            F7AFE9FF                                                                                                            ZwTerminateProcess
SSDT            F7AFE9FA                                                                                                            ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwCallbackReturn + 2CB8                                                                                80504554 4 Bytes  JMP 6646F7AF
.text          ntkrnlpa.exe!ZwCallbackReturn + 2DCC                                                                                80504668 4 Bytes  JMP 57573E1C
.text          ntkrnlpa.exe!ZwCallbackReturn + 2DE4                                                                                80504680 4 Bytes  JMP 57753E34
.text          ntkrnlpa.exe!ZwCallbackReturn + 2FE8                                                                                80504884 4 Bytes  JMP ABCD4038
.text          ntkrnlpa.exe!ZwCallbackReturn + 3038                                                                                805048D4 4 Bytes  JMP CB594088
.text          C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                            section is writeable [0xF6DEB360, 0x2217AD, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                          Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xC8 0x28 0x51 0xAF ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x6A 0x9C 0xD6 0x61 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0xFF 0x7C 0x85 0xE0 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x3E 0x1E 0x9E 0xE0 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xF5 0x1D 0x4D 0x73 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xDF 0x20 0x58 0x62 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0x31 0x77 0xE1 0xBA ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0x01 0x3A 0x48 0xFC ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0xF6 0x0F 0x4E 0x58 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0xB1 0xCD 0x45 0x5A ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0xE3 0x0E 0x66 0xD5 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0xFA 0xEA 0x66 0x7F ...

---- EOF - GMER 1.0.15 ----
Anmerkung:

1. Ich habe den Haken bei ADS rausgenommen da in deiner Beschreibung nicht aufgeführt

2. Nach den Scan habe ich den Computer runtergefahren, da neustart nicht funktioniert (liegt an Überspannung Mainboard)

Swisstreasure 19.08.2010 21:00
Hast Du Schritt 1 auch gemacht?

loelli06 19.08.2010 21:03
Oh sorry hatte das völlig überlesen bin gleich mit Rootkit angefangen. Soll ich nochmal von vorne anfangen mit Schritt 1 ??

Swisstreasure 19.08.2010 21:08
Mach einfach jetzt mal Schritt 1

loelli06 19.08.2010 21:15
Ok Schrit eins habe ich gemacht iespell wurde deinstalliert.

Frage: Fall ich jetzt mit Schritt 2 weiter machen soll kann ich die CD von Reatago nehmen die ich gestern erstellt habe

2. Der zu makierende Text den ich einfügen soll, steht doch dann bei ausführung von OTLPE ??? Oder muss ich den vorher aus den Thread kopieren

Swisstreasure 19.08.2010 21:21
Ja Du musst wieder mit der gleichen CD booten und dann einfach diesen Text reinkopieren:
Zitat:
:OTL
O4 - HKLM..\Run: [bonjour1] C:\WINDOWS\System32\ftpcommander.exe File not found
O4 - HKLM..\Run: [ftpcommander1] C:\WINDOWS\system32\winrar.exe ( )
O4 - HKLM..\Run: [iespell1] C:\WINDOWS\System32\bonjour.exe File not found
O4 - HKLM..\Run: [lexmarkfaxsolutions1] C:\WINDOWS\System32\iespell.exe File not found
O4 - HKLM..\Run: [microsoftmoney1] C:\WINDOWS\system32\microsoftmoney.exe ( )
O4 - HKLM..\Run: [GUpdate] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WebAuto3\Refresh.exe (Gamblock Pty Ltd)
O4 - HKLM..\Run: [winrar1] C:\WINDOWS\system32\winrar.exe ( )
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Programme\ieSpell\iespell.dll (Red Egg Software)
:Commands
[purity]
[emptytemp]

loelli06 19.08.2010 21:27
Also soll ich jetzt nochmal OTLPE ausführen und eine CD erstellen, oder soll ich die CD nehmen die ich gestern bei der ersten Ausführung von OTLPE bereits erstellt habe.

Wie soll ich den Text reinkopieren, da ich bei starten von REATAGO ja kein Internetverbindung habe und dann auch nicht in mein Thread reinkomme um deinen Text zu kopieren.

loelli06 20.08.2010 00:17
Habe jetzt Schritt 2 durchgeführt, deine angegebenen Dateien wurden gefixt.
Danach konnte ich mein PC nicht mehr neu starten, jedes mal meldete er sich sofort wieder ab. Nach 2 Stunden rumprobieren habe ich es geschaft kurz vor den erneuten runterfahren schnell den Systemwiederherstellungsmodos aufzurufen und konnte danach den PC wieder normal hochfahren, hatte mir ganz schön "Schweisperlen auf die Stirn getrieben" war kurz davor Windows neu zu installieren. Ich glaube das hängt alles mit GamBlock zusammen, löscht man dort bestimmte Dateien, dann fährt der PC sofort runter. Meinst du es hat noch Sinn weiter zu probieren ???? Ich poste dir hier nochmal das Textdokument nach Ausführung von OTLPE danch ging nichts mehr mit den PC.

Code:
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\bonjour1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ftpcommander1 deleted successfully.
C:\WINDOWS\system32\winrar.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\iespell1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\lexmarkfaxsolutions1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\microsoftmoney1 deleted successfully.
C:\WINDOWS\system32\microsoftmoney.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\GUpdate deleted successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WebAuto3\Refresh.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\winrar1 deleted successfully.
File C:\WINDOWS\system32\winrar.exe not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8}\ not found.
File C:\Programme\ieSpell\iespell.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8}\ not found.
File C:\Programme\ieSpell\iespell.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1606D6F9-9D3B-4aea-A025-ED5B2FD488E7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1606D6F9-9D3B-4aea-A025-ED5B2FD488E7}\ not found.
File C:\Programme\ieSpell\iespell.dll not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Default User
->Temp folder emptied: 93844944 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 75 bytes
 
User: All Users
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 27992589 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Tommy
->Temp folder emptied: 18072468 bytes
->Temporary Internet Files folder emptied: 2565067 bytes
->Flash cache emptied: 268 bytes
 
User: Tommy.THOMAS
->Temp folder emptied: 2827404 bytes
->Temporary Internet Files folder emptied: 256082652 bytes
->Java cache emptied: 40983121 bytes
->FireFox cache emptied: 16190210 bytes
->Google Chrome cache emptied: 105444553 bytes
->Flash cache emptied: 86170 bytes
 
User: Ute
->Temp folder emptied: 123179815 bytes
->Temporary Internet Files folder emptied: 254127367 bytes
->Java cache emptied: 2746593 bytes
->FireFox cache emptied: 5059969 bytes
->Google Chrome cache emptied: 6341430 bytes
->Flash cache emptied: 35281 bytes
 
User: TOMMY~1~THO
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2713024 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 33432 bytes
 
Total Files Cleaned = 914.00 mb
 
 
OTLPE by OldTimer - Version 3.1.40.0 log created on 08202010_023408

Swisstreasure 20.08.2010 07:40
Doch das sehe ich leider genau so. Alles andere wäre ein gebastel. So bist Du nachher wieder glücklich und auf der sicheren Seite.

loelli06 20.08.2010 08:17
Also soll ich jetzt nichts mehr machen oder ist der PC so infiziert, dass ich lieber die Festplatte formatieren sollte und Windows dann neu raufspielen soll.

Swisstreasure 20.08.2010 22:03
Halte Dich an diese Anleitung und setzte die Kiste neu auf.


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:39 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131