Trojaner-Board - hacked by computername-da hats mich wohl auch erwischt

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - hacked by computername-da hats mich wohl auch erwischt (https://www.trojaner-board.de/91503-hacked-by-computername-hats-mich-wohl-erwischt.html)

hacked by computername-da hats mich wohl auch erwischt

.....HACKED BY COMPUTERNAME.....
hallo ihr lieben, ich probier mich hier mal.
ich habe mir die sieben regeln durchgelesen, ich versuche mich daran, bitte nicht böse sein,falls ich etwas falsch mache ist im geringsten bös gemeint.
die berichte über dieses " hacked by computername" problem findet man hier zahlreich, ich konnte aber selbstständig keinen weg finden, also trau ich mich mal was zu schreiben....

darstellung der situation.
mein computer läuft und macht soweit keine probleme.
es erscheint jedoch hacked by in der titelleiste meines internetexplorers.
antivir meldet viruswarnungen:-apfelbaum(mein computername).vbs-enthält virus silly gen
desweiteren warnung von antivir: rkit worm conficker A

ALSO WAHRSCHEINLICH IST NICHTS IN ORDNUNG..

ich habe in einigen berichten hier gelesen, dass der virus sich über usb-stick usw. verbreitet(geht auch an unserer uni rum), obwohl er ja scheinbar schon alt ist.
ich habe hijack this runtergeladen und ein logfile angehängt(zum zensieren habe ich nichts gesehen)..so ich hoffe dies ist der erste schritt
Die Anleitung von einem Teammitglied "KarlKArl" Euers Forums kann ich nicht befolgen, da sich "versteckte dateien und ordner anzeigen" bei mir immer wieder zurückstellt.

ich habe ein mac book mit einer bootcamp partition für windows xp sp3.diese partition ist befallen und wahrscheinlich auch alle bisher über usb angeschlossenen geräte.

ICH BEDANKE MICH SCHON MAL...und vielleicht helft ihr mich hier durchzufinden.
gute nacht TiM

p.s. ich habe hier unten einen hacken bei links automatisch umwandeln gesetzt

DAS HÄNGE ICH NOCH DRAN

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4749

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

06.10.2010 01:04:48
mbam-log-2010-10-06 (01-04-48).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 131297
Laufzeit: 2 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

UND DAS WAR NACH DEM LÖSCHEN
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4749

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

06.10.2010 01:15:03
mbam-log-2010-10-06 (01-15-03).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 130905
Laufzeit: 3 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

HACKED BY STEHT IN DER TITELLEISTE DES INTERNETEXPLORERS!
AVIRA MECKERT IMMER WIEDER ZUGRIFF AUF AUTORUN.
INFO WURDE BLOCKIERT.
SPYWARE_DOCTOR REDET VON MALEWARE:VBS_SOLOW
und NETWORM CONFICKER

...was die nur alle wollen, ich hoff ihr könnt damit irgendwas anfangen.
vielen dank und echt entschuldigung, falls das thema zu blöd ist...ich kenn mich halt nicht gut genug aus und komm nicht weiter.
schlaft gut
TIM

Hi,

Poste bitte ein vollständiges HJ-Log und ein OTL-Log..

Lasse MAM im FULSCAN prüfen und alles bereinigen...

Normalerweise hängt da eine INF-Datei dahinter und ein VBS-Programm...
mal sehen...

OTL
Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe

Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen

Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output

Unter Extra Registry, wähle bitte Use SafeList

Klicke nun auf Run Scan links oben

Wenn der Scan beendet wurde werden 2 Logfiles erstellt (OTL.TXT und EXTRAS.TXT)

Poste die Logfiles hier in den Thread

chris

hallo chris,
vielen dank für die antwort.
leider ist das alles nicht so meine materie, ich habe die anweisungen versucht zu befolgen, bin mir aber nicht sicher, ob dies ein vollständiges logfile des hijack this programmes ist.ich schick ma alles.
wie oben, beschrieben, meckert avira über die datei apfelbaum.vbs, ich kann diese datei unter meinem computer in windows nicht finden, wahrscheinlich weil ich "versteckte dateien und ordner anzeigen" irgendwie unter windows nicht aktivieren kann,
von meiner mac partition aus kann ich die datei apfelbaum.vbs sehen und öffnen, sie enthält auch, ein trojaner script, soweit mein laien-auge das erkennt.
ich hatte diese datei auch früher schon mal von mac aus gelöscht, scheint sich aber wieder zurückzuschreiben, als ich das früher gelöscht hatte, stand unter windows immer noch hacked by in der titelleiste des internetexplorers.
Soll ich sie jetzt löschen?Darf ich den Inhalt der apfelbaum.vbs hier in den thread kopieren? oder kann ich in dieser datei was über die verbreitung erkennen?
apfelbaum.vbs ist eine dreamweaver datei, also eines der programme der cs3-suite.
desweiteren habe ich auch keine ahnungen, was die virusprogrammwarnungen vor malware.vbs-solow oder rkit conficker bedeuten..
so , i hope i dont bring you down....danke!
TiM

HiJackthis Logfile:

Code:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:55:16, on 06.10.2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\IRW.exe

C:\Programme\Boot Camp\KbdMgr.exe

C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe

C:\Programme\Lexmark X1100 Series\lxbkbmon.exe

C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\Programme\Spyware Doctor\pctsTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\DAEMON Tools Lite\daemon.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\AppleOSSMgr.exe

C:\WINDOWS\system32\AppleTimeSrv.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Programme\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Programme\Spyware Doctor\pctsAuxs.exe

C:\Programme\Spyware Doctor\pctsSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Verbindungsassistent\WTGService.exe

C:\WINDOWS\System32\alg.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Trend Micro\HiJackThis\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by APFELBAUM

R3 - URLSearchHook: ArchiBar Toolbar - {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: ArchiBar Toolbar - {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll

O3 - Toolbar: ArchiBar Toolbar - {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll

O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [IRW] C:\WINDOWS\system32\IRW.exe

O4 - HKLM\..\Run: [Apple_KbdMgr] C:\Programme\Boot Camp\KbdMgr.exe

O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\GEMEIN~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programme\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{6E129F0C-5053-4321-9BBE-E49C1C3ED185}: NameServer = 213.191.74.19 62.109.123.196

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple OS Switch Manager (AppleOSSMgr) - Unknown owner - C:\WINDOWS\system32\AppleOSSMgr.exe

O23 - Service: Apple-Time-Server (AppleTimeSrv) - Apple Inc. - C:\WINDOWS\system32\AppleTimeSrv.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: Browser Defender Update Service - Unknown owner - C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallShield Licensing Service - Macrovision                                                     - C:\Programme\Gemeinsame Dateien\InstallShield Shared\Service\InstallShield Licensing Service.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe

O23 - Service: WTGService - Unknown owner - C:\Programme\Verbindungsassistent\WTGService.exe
 

--

End of file - 8902 bytes

--- --- ---
OTL Logfile:

Code:

OTL Extras logfile created on: 06.10.2010 11:47:28 - Run 1

OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\bill gates\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 83,00% Memory free

5,00 Gb Paging File | 4,00 Gb Available in Paging File | 87,00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 25,68 Gb Total Space | 2,94 Gb Free Space | 11,45% Space Free | Partition Type: FAT32

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: APFELBAUM

Current User Name: bill gates

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.js [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

.txt [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"5447:TCP" = 5447:TCP:*:Enabled:tkoorzg

"3703:TCP" = 3703:TCP:*:Enabled:Adobe Version Cue CS4 Server

"3704:TCP" = 3704:TCP:*:Enabled:Adobe Version Cue CS4 Server

"51000:TCP" = 51000:TCP:*:Enabled:Adobe Version Cue CS4 Server

"51001:TCP" = 51001:TCP:*:Enabled:Adobe Version Cue CS4 Server

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" = C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:*:Enabled:Adobe Version Cue CS4 Server -- (Adobe Systems Incorporated)

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update

"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3

"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4

"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting

"{111366C8-E22F-4188-9A82-35AB4C818665}" = RuckZuck

"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4

"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin

"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR

"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3

"{342F5437-C87D-4BB5-89B9-B23E16C6A395}" = Microsoft VC80 Support DLLs

"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player

"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3

"{4393DE35-AD67-4F37-95E4-30F06EA0FDB2}" = Adobe Creative Suite 3 Design Premium

"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis

"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3

"{54DBAF71-635A-45CB-A7DD-7EAB60F5C460}" = V-Ray for Rhinoceros 4.0

"{5518E08A-2053-4A3E-85B2-F912D4666C9F}" = Adobe Setup

"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)

"{5545EEE4-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2701.01)

"{5783F2D7-6004-0407-0002-0060B0CE6BBA}" = AutoCAD Architecture 2008 - Deutsch

"{5C2CBFFD-FC3B-4AA9-993B-CE2B8DA25B87}" = Rhinoceros 4.0

"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection

"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All

"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files

"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash

"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3

"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings

"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3

"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4

"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4

"{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}" = Adobe Flash Player 9 Plugin

"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU

"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3

"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3

"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9A346205-EA92-4406-B1AB-50379DA3F057}" = Autodesk DWF Viewer 7

"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3

"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific

"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings

"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch

"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch

"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser

"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0

"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3

"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3

"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3

"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4

"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3

"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2

"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3

"{C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}" = Acrobat.com

"{C8D7A672-F697-4572-AC62-C856053A8DBC}" = Adobe Illustrator CS3

"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw

"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client

"{D1696920-9794-4BBC-8A30-7A88763DE5A2}" = ABBYY FineReader 5.0 Sprint

"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3

"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings

"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings

"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3

"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup

"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler

"{F0E45628-1218-4865-A516-8E8A54272ADC}" = Boot Camp-Dienste

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools

"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4

"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings

"02FEC2FAAA7DED51CAF15F06DB8B63E735EE735C" = Windows-Treiberpaket - Apple Inc. (applebt) Bluetooth  (04/06/2008 2.1.0.1)

"144A90A8644F24BDCA0607CBAE7F90C2F5427DA4" = Windows-Treiberpaket - Apple Inc. Apple Multitouch (12/18/2007 2.0.1.10)

"18BB9B0552BA675902E31409A34F929D9C9AD56C" = Windows-Treiberpaket - Intel (e1express) Net  (04/03/2006 9.3.39.0)

"2CA2C2712E3120F27F44A38A6FA5540D9A93CA01" = Windows-Treiberpaket - Apple Inc. Apple IR Receiver (11/01/2007 2.0.1.1)

"5F8BE32FAE3D6BC77B512F7B0624D7B6C8A26EFB" = Windows-Treiberpaket - Apple Inc. Apple Bluetooth Enabler (06/27/2007 2.0.0.1)

"6AB59209597E0F6B986EC8E976521FDF0A696C9D" = Windows-Treiberpaket - Marvell (yukonwxp) Net  (03/23/2007 10.12.7.3)

"80087CDF19A4CE2FBB535E7DC99A0E50FFA25589" = Windows-Treiberpaket - Intel (E1000) Net  (01/06/2006 8.6.17.0)

"82BE89CA9B7493FA05D2D4D32B415CF07EA08B47" = Windows-Treiberpaket - Intel System  (07/20/2007 1.2.76.0)

"9324ED54E32F5399037F87E076CA01C6CEB92830" = Windows-Treiberpaket - Apple Inc. Apple Built-in iSight (10/25/2007 2.0.1.0)

"992615C0D0002C27AA3BB336C66D1E7764047A51" = Windows-Treiberpaket - Apple Inc. Apple Trackpad (10/09/2007 2.0.1.5)

"AD3493E108434977125BBF78F47699626F8AF64B" = Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net  (01/11/2008 3.4.3.18)

"AD3F97DB12E1CE21FA0120AB7CE80FADD54FC0AB" = Windows-Treiberpaket - Apple Inc. Apple Keyboard (03/10/2008 2.1.0.0)

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe_061850775b1c6d22bf2a145678e05e0" = Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen

"Adobe_b2d6abde968e6f277ddbfd501383e02" = Adobe Creative Suite 4 Master Collection

"ArchiBar Toolbar" = ArchiBar Toolbar

"AutoCAD Architecture 2008 - Deutsch" = AutoCAD Architecture 2008 - Deutsch

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Beamex" = Beamex

"Browser Defender_is1" = Browser Defender 2.0.6.15

"C71CD722DD357F78301EAEA028431241C2D91890" = Windows-Treiberpaket - Apple Inc. System  (09/12/2007 2.0.1.1)

"CE031DF97C704035E8B6E570362ABD337ACA4BA5" = Windows-Treiberpaket - Atheros (AR5211) Net  (04/05/2007 5.3.0.35)

"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"D1E46C4F35C591B14E31349A9EDA8227C5F0E966" = Windows-Treiberpaket - Apple Inc. Apple Trackpad Enabler (10/09/2007 2.0.1.5)

"D3BCC671821E117ACD653C1AA146540791143F25" = Windows-Treiberpaket - Apple Inc. Apple Display (12/19/2007 2.0.2.0)

"D66D0ACEFE4E32CCDF30362ACBB3EAEFB97E9FDE" = Windows-Treiberpaket - Atheros (AR5416) Net  (06/26/2007 6.0.3.94)

"D922ADD1498E7464ED76231D79D703FC1320C80C" = Windows-Treiberpaket - Broadcom (BCM43XX) Net  (09/20/2007 4.170.25.12)

"DAEMON Tools Toolbar" = DAEMON Tools Toolbar

"F5A89004299B5282B8B5D7D9F7253FF13C58628F" = Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (12/18/2007 2.0.1.10)

"Lexmark X1100 Series" = Lexmark X1100 Series

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0

"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU

"NVIDIA Drivers" = NVIDIA Drivers

"RarZilla Free Unrar" = RarZilla Free Unrar

"Rhino RDK" = Rhino RDK

"Spyware Doctor" = Spyware Doctor 7.0

"Stab2D" = Stab2D

"ToolBook II 6.1 Runtime Dateien" = ToolBook II 6.1 Runtime Dateien

"Tragkonstruktionen" = Tragkonstruktionen

"Verbindungsassistent" = Verbindungsassistent

"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

"WinRAR archiver" = WinRAR

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 17.12.2009 12:51:43 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Der Servername oder die Serveradresse konnte

 nicht verarbeitet werden.  .

 

Error - 17.12.2009 12:51:43 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 17.12.2009 12:51:48 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 17.12.2009 12:51:50 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 17.12.2009 13:07:07 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Der Servername oder die Serveradresse konnte

 nicht verarbeitet werden.  .

 

Error - 17.12.2009 13:07:07 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 17.12.2009 13:07:15 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 17.12.2009 13:07:18 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Diese Netzwerkverbindung ist nicht vorhanden.

.

 

Error - 17.12.2009 13:07:22 | Computer Name = APFELBAUM | Source = crypt32 | ID = 131080

Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer

 von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>

 ist fehlgeschlagen mit dem Fehler: Der Servername oder die Serveradresse konnte

 nicht verarbeitet werden.  .

 

[ System Events ]

Error - 05.10.2010 12:19:53 | Computer Name = APFELBAUM | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Monitor Center" wurde mit folgendem Fehler beendet:   %%126

 

Error - 05.10.2010 12:20:34 | Computer Name = APFELBAUM | Source = DCOM | ID = 10005

Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"

 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {4991D34B-80A1-4291-83B6-3328366B9097}

 

Error - 05.10.2010 19:08:30 | Computer Name = APFELBAUM | Source = Service Control Manager | ID = 7000

Description = Der Dienst "adfs" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 05.10.2010 19:08:30 | Computer Name = APFELBAUM | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Config Server" wurde mit folgendem Fehler beendet:   %%126

 

Error - 05.10.2010 19:08:30 | Computer Name = APFELBAUM | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Monitor Center" wurde mit folgendem Fehler beendet:   %%126

 

Error - 05.10.2010 19:09:04 | Computer Name = APFELBAUM | Source = DCOM | ID = 10005

Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"

 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {4991D34B-80A1-4291-83B6-3328366B9097}

 

Error - 06.10.2010 05:40:13 | Computer Name = APFELBAUM | Source = Service Control Manager | ID = 7000

Description = Der Dienst "adfs" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%2

 

Error - 06.10.2010 05:40:13 | Computer Name = APFELBAUM | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Config Server" wurde mit folgendem Fehler beendet:   %%126

 

Error - 06.10.2010 05:40:13 | Computer Name = APFELBAUM | Source = Service Control Manager | ID = 7023

Description = Der Dienst "Monitor Center" wurde mit folgendem Fehler beendet:   %%126

 

Error - 06.10.2010 05:40:35 | Computer Name = APFELBAUM | Source = DCOM | ID = 10005

Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "BITS"

 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {4991D34B-80A1-4291-83B6-3328366B9097}

 

 

< End of report >

--- --- ---
OTL Logfile:

Code:

OTL logfile created on: 06.10.2010 11:47:28 - Run 1

OTL by OldTimer - Version 3.2.14.1     Folder = C:\Dokumente und Einstellungen\bill gates\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.5512)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 83,00% Memory free

5,00 Gb Paging File | 4,00 Gb Available in Paging File | 87,00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 25,68 Gb Total Space | 2,94 Gb Free Space | 11,45% Space Free | Partition Type: FAT32

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: APFELBAUM

Current User Name: bill gates

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Dokumente und Einstellungen\bill gates\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Spyware Doctor\pctsTray.exe (PC Tools)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)

PRC - C:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Programme\Verbindungsassistent\WTGService.exe ()

PRC - C:\Programme\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)

PRC - C:\Programme\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)

PRC - C:\Programme\Boot Camp\KbdMgr.exe (Apple Inc.)

PRC - C:\WINDOWS\system32\AppleTimeSrv.exe (Apple Inc.)

PRC - C:\WINDOWS\system32\AppleOSSMgr.exe ()

PRC - C:\WINDOWS\system32\IRW.exe (Apple Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Lexmark X1100 Series\lxbkbmon.exe (Lexmark International, Inc.)

PRC - C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Dokumente und Einstellungen\bill gates\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\Programme\Spyware Doctor\smum32.dll (PC Tools)

MOD - C:\Programme\Spyware Doctor\PCTGMhk.dll (PC Tools)

MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (InstallShield Licensing Service) -- C:\Programme\Gemeinsame Dateien\InstallShield Shared\Service\InstallShield Licensing Service.exe (Macrovision                                                    )

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (sdCoreService) -- C:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)

SRV - (sdAuxService) -- C:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)

SRV - (Autodesk Licensing Service) -- C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)

SRV - (Browser Defender Update Service) -- C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)

SRV - (WTGService) -- C:\Programme\Verbindungsassistent\WTGService.exe ()

SRV - (Adobe Version Cue CS4) -- C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)

SRV - (AppleTimeSrv) -- C:\WINDOWS\system32\AppleTimeSrv.exe (Apple Inc.)

SRV - (AppleOSSMgr) -- C:\WINDOWS\system32\AppleOSSMgr.exe ()

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (PCTCore) -- C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)

DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)

DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()

DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)

DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)

DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)

DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)

DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corp.)

DRV - (KeyAgent) -- C:\WINDOWS\system32\drivers\KeyAgent.sys (Apple Inc.)

DRV - (IRRemoteFlt) -- C:\WINDOWS\system32\drivers\IRFilter.sys (Apple Inc.)

DRV - (applemtp) -- C:\WINDOWS\system32\drivers\applemtp.sys (Apple Inc.)

DRV - (applemtm) -- C:\WINDOWS\system32\drivers\applemtm.sys (Apple Inc.)

DRV - (KeyMagic) -- C:\WINDOWS\system32\drivers\KeyMagic.sys (Apple Inc.)

DRV - (MacHALDriver) -- C:\WINDOWS\system32\drivers\MacHALDriver.sys (Apple Inc.)

DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKCU\..\URLSearchHook: {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

O1 HOSTS File: ([2008.04.14 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (ArchiBar Toolbar) - {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (ArchiBar Toolbar) - {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()

O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (ArchiBar Toolbar) - {24CC1362-11C6-4918-A2C0-B9EE5A563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()

O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [Apple_KbdMgr] C:\Programme\Boot Camp\KbdMgr.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)

O4 - HKLM..\Run: [IRW] C:\WINDOWS\system32\IRW.exe (Apple Inc.)

O4 - HKLM..\Run: [ISTray] C:\Programme\Spyware Doctor\pctsTray.exe (PC Tools)

O4 - HKLM..\Run: [KernelFaultCheck]  File not found

O4 - HKLM..\Run: [Lexmark X1100 Series] C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKCU..\Run: [AdobeBridge]  File not found

O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Programme\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.01.06 13:10:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]

O32 - Unable to obtain root file information for disk C:\

O33 - MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found

O33 - MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\Shell\AutoRun - "" = Auto&Play

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.10.06 11:45:18 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\bill gates\Desktop\OTL.exe

[2010.10.05 23:10:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Anwendungsdaten\Malwarebytes

[2010.10.05 23:09:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010.10.05 23:09:17 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010.10.05 23:09:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2010.10.05 23:09:16 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2010.10.05 22:49:52 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro

[2010.09.16 12:38:38 | 000,000,000 | -HSD | C] -- C:\FOUND.000

[2010.09.15 17:43:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Anwendungsdaten\Verbindungsassistent

[2010.09.15 17:42:59 | 000,621,056 | ---- | C] (DiBcom SA) -- C:\WINDOWS\System32\drivers\mod7700.sys

[2010.09.15 17:42:59 | 000,023,424 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\WINDOWS\System32\drivers\ewdcsc.sys

[2010.09.15 17:42:56 | 000,101,760 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ewusbmdm.sys

[2010.09.15 17:42:56 | 000,000,000 | ---D | C] -- C:\Programme\Verbindungsassistent

[2010.09.12 16:31:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Desktop\waasser

[2010.09.12 05:15:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Desktop\MENSCEHN

[2010.09.12 00:06:57 | 000,000,000 | ---D | C] -- C:\Programme\Conduit

[2010.09.12 00:06:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Anwendungsdaten\Conduit

[2010.09.12 00:06:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Anwendungsdaten\ArchiBar

[2010.09.12 00:06:56 | 000,000,000 | ---D | C] -- C:\Programme\ArchiBar

[2010.09.11 23:01:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Desktop\materialien_oberflächen

[2010.09.10 18:33:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Desktop\tad - bibliothek - acad

[2010.09.10 09:40:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Apple

[2010.09.09 17:10:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe

[2010.09.09 17:10:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Threat Expert

[2010.09.08 14:19:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Desktop\fotos vorort

[2010.09.07 16:21:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Desktop\3D Staffage

[2010.09.07 15:58:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\bill gates\Anwendungsdaten\WinRAR

[2010.09.07 15:57:19 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.10.06 11:44:26 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\bill gates\Desktop\OTL.exe

[2010.10.06 11:44:20 | 000,938,224 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010.10.06 11:44:20 | 000,405,692 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2010.10.06 11:44:20 | 000,392,630 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010.10.06 11:44:20 | 000,070,976 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2010.10.06 11:44:20 | 000,058,930 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010.10.06 11:38:52 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010.10.06 11:38:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010.10.06 01:33:40 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat

[2010.10.06 01:33:38 | 003,932,160 | -H-- | M] () -- C:\Dokumente und Einstellungen\bill gates\NTUSER.DAT

[2010.10.06 01:33:38 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\bill gates\ntuser.ini

[2010.10.05 23:09:22 | 000,000,580 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.10.05 22:50:18 | 000,002,441 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\HiJackThis.lnk

[2010.10.05 18:18:34 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010.09.24 17:03:26 | 000,350,044 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\hausheim.3dm

[2010.09.15 17:43:00 | 000,001,634 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Verbindungsassistent.lnk

[2010.09.15 17:42:58 | 000,621,056 | ---- | M] (DiBcom SA) -- C:\WINDOWS\System32\drivers\mod7700.sys

[2010.09.15 17:42:58 | 000,023,424 | ---- | M] (Huawei Tech. Co., Ltd.) -- C:\WINDOWS\System32\drivers\ewdcsc.sys

[2010.09.15 11:37:12 | 004,580,346 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\RhinoCrashDump.dmp

[2010.09.15 11:37:06 | 000,216,545 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\quatsch2.3dm

[2010.09.13 06:41:42 | 010,904,650 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\tief.jpg

[2010.09.13 06:17:28 | 145,543,834 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\tiefgaragenrendering.3dm

[2010.09.13 05:03:50 | 018,945,251 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\collage am wasser.jpg

[2010.09.13 01:03:04 | 137,322,161 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\MODELL GESAMT innen2.3dm

[2010.09.12 18:42:14 | 000,013,363 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\orchidee im haus.jpg

[2010.09.12 04:54:18 | 514,954,803 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\MODELL GESAMT innen1.3dm

[2010.09.12 03:48:46 | 000,017,951 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Andy-Warhol-Jackie-1964-181013.jpg

[2010.09.12 02:52:08 | 000,617,051 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\DoorsMetalDouble0148_M.jpg

[2010.09.11 20:38:16 | 000,579,972 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Paintings0062_M.jpg

[2010.09.11 20:31:54 | 000,545,450 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksPainted0158_M.jpg

[2010.09.11 20:28:54 | 000,577,016 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksDirty0050_M.jpg

[2010.09.11 20:20:08 | 000,705,505 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksPainted0056_M.jpg

[2010.09.11 20:17:12 | 000,525,592 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodRough0062_M.jpg

[2010.09.11 20:12:14 | 003,688,632 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksPainted0176_L.jpg

[2010.09.11 03:49:52 | 186,711,182 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\collage süd weit.psd

[2010.09.11 03:42:54 | 010,364,684 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\collage süd weit.jpg

[2010.09.11 03:36:20 | 186,711,182 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\1.psd

[2010.09.10 17:35:30 | 002,160,127 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Süd weit weg.jpg

[2010.09.10 14:27:34 | 000,236,950 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\nord.weit.weg.jpg

[2010.09.10 11:27:42 | 000,174,482 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\caro.jpg

[2010.09.10 09:40:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010.09.07 15:34:12 | 000,188,301 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Baum.3dm

[2010.09.06 19:48:14 | 006,342,861 | ---- | M] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\quatsch.3dm

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2010.10.05 23:09:21 | 000,000,580 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.10.05 22:49:53 | 000,002,441 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\HiJackThis.lnk

[2010.09.19 15:11:46 | 000,350,044 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\hausheim.3dm

[2010.09.15 17:42:59 | 000,001,634 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Verbindungsassistent.lnk

[2010.09.15 11:37:08 | 004,580,346 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\RhinoCrashDump.dmp

[2010.09.15 11:37:04 | 000,216,545 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\quatsch2.3dm

[2010.09.13 06:33:09 | 010,904,650 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\tief.jpg

[2010.09.13 04:54:47 | 145,543,834 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\tiefgaragenrendering.3dm

[2010.09.12 20:24:45 | 018,945,251 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\collage am wasser.jpg

[2010.09.12 18:42:13 | 000,013,363 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\orchidee im haus.jpg

[2010.09.12 05:29:30 | 137,322,161 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\MODELL GESAMT innen2.3dm

[2010.09.12 03:47:11 | 000,017,951 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Andy-Warhol-Jackie-1964-181013.jpg

[2010.09.12 02:52:00 | 000,617,051 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\DoorsMetalDouble0148_M.jpg

[2010.09.11 23:06:54 | 514,954,803 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\MODELL GESAMT innen1.3dm

[2010.09.11 20:38:12 | 000,579,972 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Paintings0062_M.jpg

[2010.09.11 20:31:50 | 000,545,450 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksPainted0158_M.jpg

[2010.09.11 20:28:51 | 000,577,016 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksDirty0050_M.jpg

[2010.09.11 20:20:04 | 000,705,505 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksPainted0056_M.jpg

[2010.09.11 20:17:08 | 000,525,592 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodRough0062_M.jpg

[2010.09.11 20:12:01 | 003,688,632 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\WoodPlanksPainted0176_L.jpg

[2010.09.11 03:49:40 | 186,711,182 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\collage süd weit.psd

[2010.09.11 03:42:50 | 010,364,684 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\collage süd weit.jpg

[2010.09.10 19:40:07 | 186,711,182 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\1.psd

[2010.09.10 14:27:32 | 000,236,950 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\nord.weit.weg.jpg

[2010.09.10 11:27:40 | 000,174,482 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\caro.jpg

[2010.09.10 02:42:36 | 002,160,127 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Süd weit weg.jpg

[2010.09.07 15:34:09 | 000,188,301 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Desktop\Baum.3dm

[2010.09.04 19:08:29 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\BongoSDK.10.v40.dll

[2010.09.04 19:08:29 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\BongoSDK.dll

[2010.08.24 01:37:17 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll

[2009.08.03 20:06:15 | 000,000,179 | ---- | C] () -- C:\WINDOWS\twl.ini

[2009.08.03 20:06:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI

[2009.07.31 01:24:30 | 000,005,120 | ---- | C] () -- C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.01.11 23:04:18 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll

[2009.01.07 15:14:21 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys

[2009.01.06 21:58:05 | 000,000,188 | ---- | C] () -- C:\WINDOWS\lexstat.ini

[2009.01.06 21:57:51 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbkvs.dll

[2009.01.06 21:57:48 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBKLCNP.DLL

[2009.01.06 21:57:22 | 000,000,266 | ---- | C] () -- C:\WINDOWS\System32\lxbkcoin.ini

[2009.01.06 21:39:50 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2009.01.06 21:39:50 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2009.01.06 21:39:48 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2009.01.06 21:39:47 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2009.01.06 21:39:46 | 001,482,752 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

< End of report >

--- --- ---

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Datenbank Version: 4749

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

06.10.2010 14:03:36
mbam-log-2010-10-06 (14-03-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 219636
Laufzeit: 22 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Hi,

Woher hast Du die CS3-Version? Ist die sauber (verlässliche Quelle)?
Es starten einige Sachen von Adobe...
(-> apfelbaum.vbs ist eine dreamweaver datei, also eines der programme der cs3-suite.)???

Bitte folgende Files prüfen (Flash...):

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen!
(nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“
und suche folgende Datei/Dateien:

Code:

C:\WINDOWS\System32\NPSWF32.dll

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

OTL:

Doppelklick auf die OTL.exe, um das Programm auszuführen.

Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

http://oldtimer.geekstogo.com/OTL/OTL_Main_Tutorial.gif

Code:

:OTL

.js [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

.txt [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

O2 - BHO: (ArchiBar Toolbar) - {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (ArchiBar Toolbar) - {24cc1362-11c6-4918-a2c0-b9ee5a563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

O3 - HKCU\..\Toolbar\WebBrowser: (ArchiBar Toolbar) - {24CC1362-11C6-4918-A2C0-B9EE5A563185} - C:\Programme\ArchiBar\tbArc1.dll (Conduit Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [KernelFaultCheck]  File not found

O4 - HKCU..\Run: [AdobeBridge]  File not found

O33 - MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found

O33 - MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\Shell\AutoRun - "" = Auto&Play

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
 
 

:REG

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"5447:TCP" =-
 

:Commands

[purity]

[emptytemp]

[CREATERESTOREPOINT]

[EMPTYFLASH]

[Reboot]

Den roten Run Fixes! Button anklicken.

Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

%systemroot%\_OTL

Gmer:
http://www.trojaner-board.de/74908-a...t-scanner.html
Den Downloadlink findest Du links oben (GMER - Rootkit Detector and Remover), dort dann
auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken).
Starte gmer und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein.

Lade SystemLook von einem der folgenden Links und speichere das Tool auf dem Desktop.
http://jpshortstuff.247fixes.com/SystemLook.exe - http://images.malwareremoval.com/jps...SystemLook.exe

Doppelklick auf die SystemLook.exe, um das Tool zu starten.

Vista-User mit Rechtsklick und als Administrator starten.

Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

Code:

:filefind

*.vbs

*.inf

Klicke nun auf den Button Look, um den Scan zu starten.

Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, diese hier in den Thread posten.
Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

Lade die vbs-datei hier hoch:
Fileuplod:
File-Upload.net - Ihr kostenloser File Hoster!, hochladen und den Link (mit Löschlink) als "PrivateMail" an mich...

Mal sehen ob wir so an das Teil kommen (es gleicht das Filedatum an bestimmte Dateien von Windows an, so dass wir es nicht sehen wenn wir nur 3 Monate zurückgehen (und es hat den nachteil für uns, das wir eigentlich alle Files prüfen müssen, jörg))

Starte bitte die OTL.exe

Vista/Win7-User mit Rechtsklick "als Administrator starten"

Kopiere nun den Inhalt in die Textbox

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%SYSTEMDRIVE%\*.exe

c:\windows\system32\drivers\*.sys /lockedfiles

c:\windows\system32\*.dll /lockedfiles

%systemroot%\*. /mp /s

%PROGRAMFILES%\*.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)

Klicke nun bitte auf den Quick Scan Button

Klick auf OK

Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Und nun die Keule...
Combofix
Lade Combo Fix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop.
Antivierenlösung komplett auschalten und zwar so, dass sie sich auch nach einem Reboot NICHT einschaltet!

Achtung: In einigen wenigen Fällen kann es vorkommen, das der Rechner nicht mehr booten kann und Neuaufgesetzt werden muß!

Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.

Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen
Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird.
Nach Scanende wird ein Report (ComboFix.txt) angezeigt, den bitte kopieren und in deinem Thread einfuegen.

chris

Hi,

da fällt mir noch was ein:
Vor dem CF-lauf alle Wechselmedien (USB-Stick/Festplatte) bei gedrückter Shift-Taste anschließen! Sonst gibts immer wieder Infektionen...

Schauen wir mal ob er nach der Orgie noch gesetzt wird, der Windows-Titel:
Speichere den nachfolgenden Text als IE_Titel.reg und führe Ihn dann per Doppelklick und abnicken mit der Registry zusammen...

Code:

REGEDIT4
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Window Title"=-

chris

hallo chris,
das ergebnis von virustotal...
gruss

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: NPSWF32.dll
Submission date: 2010-10-06 21:37:49 (UTC)
Current status: queued (#1) queued (#1) analysing finished

Result: 0/ 43 (0.0%)
VT Community

not reviewed
Safety score: -

Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.10.07.00 2010.10.06 -
AntiVir 7.10.12.142 2010.10.06 -
Antiy-AVL 2.0.3.7 2010.10.06 -
Authentium 5.2.0.5 2010.10.06 -
Avast 4.8.1351.0 2010.10.06 -
Avast5 5.0.594.0 2010.10.06 -
AVG 9.0.0.851 2010.10.06 -
BitDefender 7.2 2010.10.06 -
CAT-QuickHeal 11.00 2010.10.05 -
ClamAV 0.96.2.0-git 2010.10.06 -
Comodo 6303 2010.10.06 -
DrWeb 5.0.2.03300 2010.10.06 -
Emsisoft 5.0.0.50 2010.10.06 -
eSafe 7.0.17.0 2010.10.06 -
eTrust-Vet 36.1.7895 2010.10.06 -
F-Prot 4.6.2.117 2010.10.06 -
F-Secure 9.0.15370.0 2010.10.06 -
Fortinet 4.2.249.0 2010.10.06 -
GData 21 2010.10.06 -
Ikarus T3.1.1.90.0 2010.10.06 -
Jiangmin 13.0.900 2010.10.06 -
K7AntiVirus 9.63.2689 2010.10.06 -
Kaspersky 7.0.0.125 2010.10.06 -
McAfee 5.400.0.1158 2010.10.06 -
McAfee-GW-Edition 2010.1C 2010.10.06 -
Microsoft 1.6201 2010.10.06 -
NOD32 5510 2010.10.06 -
Norman 6.06.07 2010.10.06 -
nProtect 2010-10-06.02 2010.10.06 -
Panda 10.0.2.7 2010.10.06 -
PCTools 7.0.3.5 2010.10.02 -
Prevx 3.0 2010.10.06 -
Rising 22.67.02.07 2010.09.30 -
Sophos 4.58.0 2010.10.06 -
Sunbelt 7000 2010.10.06 -
SUPERAntiSpyware 4.40.0.1006 2010.10.06 -
Symantec 20101.2.0.161 2010.10.06 -
TheHacker 6.7.0.1.050 2010.10.06 -
TrendMicro 9.120.0.1004 2010.10.06 -
TrendMicro-HouseCall 9.120.0.1004 2010.10.06 -
VBA32 3.12.14.1 2010.10.06 -
ViRobot 2010.10.4.4074 2010.10.06 -
VirusBuster 12.67.6.0 2010.10.06 -
Additional informationShow all
MD5 : edf220a1dcdb2cb01dcea8e80b1435c5
SHA1 : e4f9ffa4f9a56554e9644c64e7bde4b837b5d15e
SHA256: 6908b5f52955d6218d07204bb77f5cc713aedfcfa056db0bdfaa7a0d64273f0a
ssdeep: 49152:8slIHZBrsM6FyHj3FvnLmrBJ90Rqw5xZBTXyTU:8slIHHOEj1vLENwqw5xZBzh
File size : 2463976 bytes
First seen: 2009-02-23 18:34:44
Last seen : 2010-10-06 21:37:49
TrID:
Win32 Executable MS Visual C++ (generic) (75.0%)
Win32 Executable Generic (16.9%)
Generic Win/DOS Executable (3.9%)
DOS Executable Generic (3.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Adobe Systems, Inc.
copyright....: Adobe_ Flash_ Player. Copyright (c) 1996-2007 Adobe Systems Incorporated. All Rights Reserved. Protected by U.S. Patent 6,879,327_ Patents Pending in the United States and other countries. Adobe and Flash are either trademarks or registered trademarks in the United States and/or other countries.
product......: Shockwave Flash
description..: Shockwave Flash 9.0 r45
original name: npswf32.dll
internal name: Adobe Flash Player 9.0
file version.: 9,0,45,0
comments.....: n/a
signers......: Adobe Systems Incorporated
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 2:04 AM 2/21/2007
verified.....: -

packers (Kaspersky): PE_Patch
PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0xB16E4
timedatestamp....: 0x45DB8C68 (Wed Feb 21 00:03:52 2007)
machinetype......: 0x14c (I386)

[[ 5 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x1A3801, 0x1A4000, 6.77, 031bf99fcef9907227da34a255a044cd
.rdata, 0x1A5000, 0x52A63, 0x53000, 6.55, 5004f55447a33c0ddbbba3445e5734d6
.data, 0x1F8000, 0x1007B0, 0x39000, 6.61, f8e8dcd32f44af5449a44c55a08235c0
.rsrc, 0x2F9000, 0x14038, 0x15000, 4.23, 40c6a45dfb49a5b81abd79dc6f9f1592
.reloc, 0x30E000, 0x11C6E, 0x12000, 5.95, 5df5c02055127845a70e5d061cc7b5d5

[[ 13 import(s) ]]
WINMM.dll: timeGetDevCaps, waveInGetDevCapsA, waveOutGetNumDevs, waveInGetNumDevs, waveInStart, waveInAddBuffer, timeBeginPeriod, waveInClose, waveInUnprepareHeader, waveInReset, waveInPrepareHeader, waveInOpen, waveOutGetDevCapsA, waveOutPrepareHeader, waveOutWrite, waveOutReset, waveOutUnprepareHeader, waveOutClose, timeEndPeriod, waveOutOpen, timeKillEvent, timeSetEvent, waveInStop, timeGetTime
WININET.dll: HttpQueryInfoA
CRYPT32.dll: CryptVerifyMessageSignature, CryptGetMessageCertificates, CertCreateCertificateContext, CertFindCertificateInStore, CertVerifySubjectCertificateContext, CertFreeCertificateContext, CertCloseStore
VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
OLEAUT32.dll: -
KERNEL32.dll: GetModuleFileNameA, DeleteFileA, WriteFile, CreateFileA, GetTempFileNameA, GetModuleHandleA, GlobalFree, WideCharToMultiByte, GetCurrentDirectoryA, CreateDirectoryA, GetEnvironmentVariableA, GetLastError, FreeLibrary, GetVersionExA, GetSystemDefaultLangID, MoveFileA, GetFileAttributesA, GetSystemInfo, GetUserDefaultLangID, ExitThread, GetFileAttributesW, SetFilePointer, FindResourceExA, FindResourceExW, GlobalAlloc, CreateThread, SetUnhandledExceptionFilter, GetTempPathA, GetCurrentProcess, GetCurrentProcessId, FindClose, FindNextFileA, FindFirstFileA, GetTimeZoneInformation, FindResourceA, SystemTimeToFileTime, ReadFile, GetFileSize, CreateMutexA, CreateProcessA, GetFileAttributesExA, SetCurrentDirectoryA, RemoveDirectoryA, GetSystemDirectoryA, ExpandEnvironmentStringsA, UnmapViewOfFile, WaitForSingleObject, ReleaseMutex, MapViewOfFile, CreateFileMappingA, lstrcpyA, lstrlenA, InterlockedDecrement, InterlockedIncrement, GlobalUnlock, GlobalLock, IsDBCSLeadByteEx, QueryPerformanceFrequency, QueryPerformanceCounter, GetProcessTimes, SetEvent, SetThreadPriority, ResetEvent, WaitForMultipleObjects, VirtualFree, VirtualAlloc, GetThreadPriority, GetCurrentThread, SizeofResource, LoadResource, LockResource, OpenFile, _lwrite, _lclose, FreeResource, LCMapStringW, LCMapStringA, GetTickCount, GetCurrentThreadId, GetLocaleInfoA, HeapAlloc, GetProcessHeap, HeapFree, VirtualProtect, SetErrorMode, ExitProcess, LoadLibraryA, GetProcAddress, IsDBCSLeadByte, GetACP, GetCPInfo, MultiByteToWideChar, CreateEventA, CloseHandle, VirtualQuery, InterlockedExchange, InterlockedCompareExchange, Sleep, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, HeapReAlloc, TerminateProcess, HeapSize, GetSystemTimeAsFileTime, RtlUnwind, SetLastError, GetStdHandle, GetOEMCP, GetStringTypeA, GetStringTypeW, GetSystemTime
USER32.dll: GetForegroundWindow, WaitForInputIdle, MapVirtualKeyA, IsWindow, RegisterClipboardFormatA, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, SetClipboardData, EmptyClipboard, PostThreadMessageA, GetQueueStatus, RegisterWindowMessageA, DialogBoxParamW, GetMessageA, DialogBoxIndirectParamW, DialogBoxIndirectParamA, GetDesktopWindow, LoadIconA, SetWindowTextA, GetMenuItemCount, GetMenuItemInfoA, GetWindowRect, SetDlgItemTextA, MoveWindow, GetWindowLongA, InsertMenuItemA, RegisterClassA, SystemParametersInfoA, ScreenToClient, GetMenuItemID, DeleteMenu, TrackPopupMenu, ReleaseCapture, SetFocus, SetCapture, GetCapture, GetCursorPos, WindowFromPoint, GetParent, DefWindowProcA, CreateWindowExA, SetWindowPos, ShowWindow, DestroyWindow, GetSystemMetrics, EnumDisplaySettingsA, FillRect, GetTopWindow, GetWindowThreadProcessId, AttachThreadInput, GetFocus, SendNotifyMessageA, GetKeyState, ReleaseDC, GetDC, BeginPaint, EndPaint, LoadMenuA, GetSubMenu, DestroyMenu, EnableMenuItem, CheckMenuItem, DialogBoxParamA, GetDlgItem, EnableWindow, EndDialog, IsWindowEnabled, GetWindowTextLengthA, GetDlgItemTextA, SendMessageA, SetWindowLongA, KillTimer, SetTimer, InvalidateRect, CopyRect, GetClientRect, LoadCursorA, SetCursor, LoadStringA, MessageBoxA, PostMessageA, ClientToScreen, UnregisterClassA, SendInput, GetKeyboardLayout, PeekMessageA, MsgWaitForMultipleObjects, TranslateMessage, DispatchMessageA, GetDoubleClickTime, GetWindowInfo
GDI32.dll: SelectPalette, BitBlt, CreateCompatibleDC, GdiFlush, CreateDIBSection, GetDIBits, CreateCompatibleBitmap, CreateFontIndirectA, SetBkMode, SetTextAlign, IntersectClipRect, SelectClipRgn, ExtTextOutA, ExtTextOutW, SetTextColor, GetTextMetricsA, GetTextAlign, RealizePalette, CreateDCA, DeleteDC, CreateSolidBrush, DeleteObject, LPtoDP, StretchDIBits, GetStockObject, GetBkMode, GetTextColor, EnumFontFamiliesA, SetTextCharacterExtra, EndPage, BeginPath, EndPath, GetClipRgn, CreateRectRgn, DPtoLP, GetTextExtentPoint32W, GetCurrentObject, SetBkColor, GetBkColor, CreatePen, GetTextExtentPoint32A, CreatePalette, StartDocA, EndDoc, StrokePath, ExtCreatePen, FillPath, SelectClipPath, SelectObject, Rectangle, GetDeviceCaps, GetSystemPaletteEntries, GetClipBox, GetObjectA, RestoreDC, StartPage, PolyBezierTo, LineTo, MoveToEx, SetPolyFillMode, SaveDC
comdlg32.dll: GetOpenFileNameA, CommDlgExtendedError, GetSaveFileNameA, PrintDlgA
ADVAPI32.dll: RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, RegCreateKeyExA
SHELL32.dll: SHBrowseForFolderA, SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHAppBarMessage
ole32.dll: CoTaskMemAlloc, CoFreeUnusedLibraries, CoInitialize, CoUninitialize, CoTaskMemFree, CoCreateInstance
WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -

[[ 62 export(s) ]]
FlashPlugin_Setup, Flash_DisableLocalSecurity, Flash_EnforceLocalSecurity, Java_ShockwaveFlash_CurrentFrame_stub, Java_ShockwaveFlash_FlashVersion_stub, Java_ShockwaveFlash_FrameLoaded_stub, Java_ShockwaveFlash_GetVariable_stub, Java_ShockwaveFlash_GotoFrame_stub, Java_ShockwaveFlash_IsPlaying_stub, Java_ShockwaveFlash_LoadMovie_stub, Java_ShockwaveFlash_Pan_stub, Java_ShockwaveFlash_PercentLoaded_stub, Java_ShockwaveFlash_Play_stub, Java_ShockwaveFlash_SetVariable_stub, Java_ShockwaveFlash_SetZoomRect_stub, Java_ShockwaveFlash_StopPlay_stub, Java_ShockwaveFlash_TCallFrame_stub, Java_ShockwaveFlash_TCallLabel_stub, Java_ShockwaveFlash_TCurrentFrame_stub, Java_ShockwaveFlash_TCurrentLabel_stub, Java_ShockwaveFlash_TGetProperty_stub, Java_ShockwaveFlash_TGotoFrame_stub, Java_ShockwaveFlash_TGotoLabel_stub, Java_ShockwaveFlash_TPlay_stub, Java_ShockwaveFlash_TSetProperty_stub, Java_ShockwaveFlash_TStopPlay_stub, Java_ShockwaveFlash_TotalFrames_stub, Java_ShockwaveFlash_Zoom_stub, NP_GetEntryPoints, NP_Initialize, NP_Shutdown, native_ShockwaveFlash_CurrentFrame, native_ShockwaveFlash_FlashVersion, native_ShockwaveFlash_FrameLoaded, native_ShockwaveFlash_GetVariable, native_ShockwaveFlash_GotoFrame, native_ShockwaveFlash_IsPlaying, native_ShockwaveFlash_LoadMovie, native_ShockwaveFlash_Pan, native_ShockwaveFlash_PercentLoaded, native_ShockwaveFlash_Play, native_ShockwaveFlash_SetVariable, native_ShockwaveFlash_SetZoomRect, native_ShockwaveFlash_StopPlay, native_ShockwaveFlash_TCallFrame, native_ShockwaveFlash_TCallLabel, native_ShockwaveFlash_TCurrentFrame, native_ShockwaveFlash_TCurrentLabel, native_ShockwaveFlash_TGetProperty, native_ShockwaveFlash_TGotoFrame, native_ShockwaveFlash_TGotoLabel, native_ShockwaveFlash_TPlay, native_ShockwaveFlash_TSetProperty, native_ShockwaveFlash_TStopPlay, native_ShockwaveFlash_TotalFrames, native_ShockwaveFlash_Zoom, register_ShockwaveFlash, unregister_ShockwaveFlash, unuse_ShockwaveFlash, unuse_netscape_plugin_Plugin, use_ShockwaveFlash, use_netscape_plugin_Plugin

hallo chris,
habe alles im thread angegeben in otl kopiert und fix gedrückt...
der scan lief eine zeit und dann kam eine fehlermeldung..
"acces violation at adress 0040295B in module 'OTL.exe'.Read of address 001F2000."
ich musste ok drücken.
danach wollte das programm einen restore point erstellen und nicht unterbrochen werden,
habe lange zeit gewartet, programm hat aber nichts mehr gemacht.
danach habe ich den rechner runter und wieder hoch gefahren.
dann kam diese meldung:(das sind nich die richtigen results,oder?)
Files\Folders moved on Reboot...
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6OGDIS1J\CA05YHT2.de moved successfully.
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDY30D6F\report[1].htm moved successfully.
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\TCNRDAYP\CAR629NZ.de moved successfully.
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\TCNRDAYP\CAM7SPYN.de moved successfully.

Registry entries deleted on Reboot...

im moment läuft noch alles,warte mal was du dazu sagst und arbeite die anderen punkte morgen weiter ab.
gute nacht und danke
TiM

hier das ergebnis von gmer,
bin mir nicht sicher, ob versteckte dateien und ordner anzeigen, eingestellt war.
ist das wichtig?
wie gesagt der computer ist einmal hängengeblieben..
so jetzt wart ich mal auf ne kurze antwort,
ob ich die liste im thread von oben ab arbeiten soll, und wie das mit otl ergebnissen ist.
sorry, fasll das nervend ist..alles neuland für mich.
gruss und danke
TiM

GMER Logfile:

Code:

GMER 1.0.15.15281 - GMER - Rootkit Detector and Remover

Rootkit scan 2010-10-07 01:32:32

Windows 5.1.2600 Service Pack 3

Running: 540njx0i gmer.exe; Driver: C:\DOKUME~1\BILLGA~1\LOKALE~1\Temp\pwrcapow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            BA45C566                                                                                                             ZwCreateKey

SSDT            BA45C55C                                                                                                             ZwCreateThread

SSDT            BA45C56B                                                                                                             ZwDeleteKey

SSDT            BA45C575                                                                                                             ZwDeleteValueKey

SSDT            sprw.sys                                                                                                             ZwEnumerateKey [0xBA6C6CA2]

SSDT            sprw.sys                                                                                                             ZwEnumerateValueKey [0xBA6C7030]

SSDT            BA45C57A                                                                                                             ZwLoadKey

SSDT            sprw.sys                                                                                                             ZwOpenKey [0xBA6A80C0]

SSDT            BA45C548                                                                                                             ZwOpenProcess

SSDT            BA45C54D                                                                                                             ZwOpenThread

SSDT            sprw.sys                                                                                                             ZwQueryKey [0xBA6C7108]

SSDT            sprw.sys                                                                                                             ZwQueryValueKey [0xBA6C6F88]

SSDT            BA45C584                                                                                                             ZwReplaceKey

SSDT            BA45C57F                                                                                                             ZwRestoreKey

SSDT            BA45C570                                                                                                             ZwSetValueKey
 

INT 0x63        ?                                                                                                                    8A4BBBF8

INT 0x63        ?                                                                                                                    8A4BBBF8

INT 0x63        ?                                                                                                                    89F60BF8

INT 0x63        ?                                                                                                                    8A4BBBF8

INT 0x83        ?                                                                                                                    89F60BF8

INT 0x83        ?                                                                                                                    89F60BF8

INT 0x94        ?                                                                                                                    89F60BF8

INT 0x94        ?                                                                                                                    89F60BF8

INT 0x94        ?                                                                                                                    89F60BF8

INT 0xA4        ?                                                                                                                    8A4BBBF8

INT 0xA4        ?                                                                                                                    8A4BBBF8

INT 0xA4        ?                                                                                                                    89F60BF8

INT 0xA4        ?                                                                                                                    89F60BF8

INT 0xA4        ?                                                                                                                    8A4BBBF8
 

---- Kernel code sections - GMER 1.0.15 ----
 

?               sprw.sys                                                                                                             Das System kann die angegebene Datei nicht finden. !

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                             section is writeable [0xB9CE7360, 0x3496C7, 0xE8000020]

.text           USBPORT.SYS!DllUnload                                                                                                B9CC78AC 5 Bytes  JMP 89F601D8 

.text           af7la9ri.SYS                                                                                                         B9BE4386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]

.text           af7la9ri.SYS                                                                                                         B9BE43AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]

.text           af7la9ri.SYS                                                                                                         B9BE43C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}

.text           af7la9ri.SYS                                                                                                         B9BE43C9 1 Byte  [2E]

.text           af7la9ri.SYS                                                                                                         B9BE43C9 11 Bytes  [2E, 00, 00, 00, 5A, 02, 00, ...]

.text           ...                                                                                                                  
 

---- Kernel IAT/EAT - GMER 1.0.15 ----
 

IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                   [BA6A9040] sprw.sys

IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                           [BA6A913C] sprw.sys

IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                  [BA6A90BE] sprw.sys

IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                          [BA6A97FC] sprw.sys

IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                  [BA6A96D2] sprw.sys

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!KfAcquireSpinLock]                                                 C0840CEC

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!READ_PORT_UCHAR]                                                   053C0D74

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!KeGetCurrentIrql]                                                  57B80974

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!KfRaiseIrql]                                                       8B000000

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!KfLowerIrql]                                                       56C35DE5

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!HalGetInterruptVector]                                             8D08758B

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!HalTranslateBusAddress]                                            8D51FC4D

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!KeStallExecutionProcessor]                                         8D52FD55

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!KfReleaseSpinLock]                                                 8D51FE4D

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                           8D52FF55

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!READ_PORT_USHORT]                                                  8D51F84D

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                          5052F455

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                  EACAE856

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[WMILIB.SYS!WmiSystemControl]                                               0FC08520

IAT             \SystemRoot\System32\Drivers\af7la9ri.SYS[WMILIB.SYS!WmiCompleteRequest]                                             0001B185
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Fastfat \FatCdrom                                                                                        8A4BA1F8

Device          \Driver\sptd \Device\542344016                                                                                       sprw.sys

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                     89F5F1F8

Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                            8A52C1F8

Device          \Driver\dmio \Device\DmControl\DmConfig                                                                              8A52C1F8

Device          \Driver\dmio \Device\DmControl\DmPnP                                                                                 8A52C1F8

Device          \Driver\dmio \Device\DmControl\DmInfo                                                                                8A52C1F8

Device          \Driver\usbehci \Device\USBPDO-1                                                                                     89F481F8

Device          \Driver\usbuhci \Device\USBPDO-2                                                                                     89F5F1F8

Device          \Driver\usbuhci \Device\USBPDO-3                                                                                     89F5F1F8

Device          \Driver\usbehci \Device\USBPDO-4                                                                                     89F481F8

Device          \Driver\usbuhci \Device\USBPDO-5                                                                                     89F5F1F8

Device          \Driver\usbuhci \Device\USBPDO-6                                                                                     89F5F1F8

Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                               8A4BC1F8

Device          \Driver\Cdrom \Device\CdRom0                                                                                         89F101F8

Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                               8A4BC1F8

Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                               8A4BC1F8

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                          [BA5FBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                   [BA5FBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                   [BA5FBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort2                                                                                   [BA5FBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort3                                                                                   [BA5FBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-10                                                                         [BA5FBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\Cdrom \Device\CdRom1                                                                                         89F101F8

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                              8A1B8500

Device          \Driver\PCI_PNP1516 \Device\0000004a                                                                                 sprw.sys

Device          \Driver\NetBT \Device\NetbiosSmb                                                                                     8A1B8500

Device          \Driver\BTHUSB \Device\00000097                                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                     89F5F1F8

Device          \Driver\BTHUSB \Device\00000099                                                                                      bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                     89F5F1F8

Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                    8A120500

Device          \Driver\usbehci \Device\USBFDO-2                                                                                     89F481F8

Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                          8A120500

Device          \Driver\usbuhci \Device\USBFDO-3                                                                                     89F5F1F8

Device          \Driver\usbuhci \Device\USBFDO-4                                                                                     89F5F1F8

Device          \Driver\Ftdisk \Device\FtControl                                                                                     8A4BC1F8

Device          \Driver\usbuhci \Device\USBFDO-5                                                                                     89F5F1F8

Device          \Driver\NetBT \Device\NetBT_Tcpip_{406F35EE-F556-493C-BD1E-B9217A6EB9E5}                                             8A1B8500

Device          \Driver\usbehci \Device\USBFDO-6                                                                                     89F481F8

Device          \Driver\NetBT \Device\NetBT_Tcpip_{CA27A0A0-7028-4B6C-8745-429090D52831}                                             8A1B8500

Device          \Driver\af7la9ri \Device\Scsi\af7la9ri1                                                                              89F0F1F8

Device          \Driver\af7la9ri \Device\Scsi\af7la9ri1Port4Path0Target0Lun0                                                         89F0F1F8

Device          \FileSystem\Fastfat \Fat                                                                                             8A4BA1F8
 

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                             fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

Device          \FileSystem\Cdfs \Cdfs                                                                                               8A115500
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00231241255a                                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                   771343423

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                   285507792

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                   1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0xFB 0x02 0x62 0x9F ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0x78 0xCD 0x81 0x43 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x9F 0xBC 0xCC 0xDF ...

Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00231241255a (not active ControlSet)                      

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0xFB 0x02 0x62 0x9F ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x78 0xCD 0x81 0x43 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x9F 0xBC 0xCC 0xDF ...
 

---- EOF - GMER 1.0.15 ----

--- --- ---

SYSTEMLOOK ERGEBNISSE

SystemLook 04.09.10 by jpshortstuff
Log created at 01:52 on 07/10/2010 by bill gates
Administrator - Elevation successful

========== filefind ==========

Searching for "*.vbs"
C:\APFELBAUM.vbs -rahs-- 4248 bytes [19:32 23/08/2010] [22:47 23/08/2010] (Unable to calculate MD5)
C:\WINDOWS\system32\eventquery.vbs --a---- 98604 bytes [10:00 14/04/2008] [10:00 14/04/2008] B5B7DCCFF90E0E730AEA8144CCC55C4D
C:\WINDOWS\system32\pagefileconfig.vbs --a---- 168720 bytes [10:00 14/04/2008] [10:00 14/04/2008] 78E382C4E6EF6476E16A02F61FDFE1C7
C:\WINDOWS\system32\prncnfg.vbs --a---- 36045 bytes [10:00 14/04/2008] [10:00 14/04/2008] 10FD9833DA9405A9CDD8396678FFAC8C
C:\WINDOWS\system32\prndrvr.vbs --a---- 25679 bytes [10:00 14/04/2008] [10:00 14/04/2008] D2175D695F215B3235C9CA67E7CCA3E2
C:\WINDOWS\system32\prnjobs.vbs --a---- 21806 bytes [10:00 14/04/2008] [10:00 14/04/2008] 307C38CED96A65FA12FCA78F6067CC4F
C:\WINDOWS\system32\prnmngr.vbs --a---- 32871 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9FD12D4178DA5795BD9373E1A0354F24
C:\WINDOWS\system32\prnport.vbs --a---- 29878 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2C82974DDE2DD411707B680A679C9F09
C:\WINDOWS\system32\prnqctl.vbs --a---- 16046 bytes [10:00 14/04/2008] [10:00 14/04/2008] BB73D0C95F928C3B45A8C5020068FA39
C:\WINDOWS\system32\pubprn.vbs --a---- 3758 bytes [10:00 14/04/2008] [10:00 14/04/2008] 56E6B988E5C514A2A367F589DB4E22FA
C:\WINDOWS\system32\dllcache\evtquery.vbs --a---- 98604 bytes [10:00 14/04/2008] [10:00 14/04/2008] B5B7DCCFF90E0E730AEA8144CCC55C4D
C:\WINDOWS\system32\dllcache\pagefile.vbs --a---- 168720 bytes [10:00 14/04/2008] [10:00 14/04/2008] 78E382C4E6EF6476E16A02F61FDFE1C7
C:\WINDOWS\system32\dllcache\prncnfg.vbs --a---- 36045 bytes [10:00 14/04/2008] [10:00 14/04/2008] 10FD9833DA9405A9CDD8396678FFAC8C
C:\WINDOWS\system32\dllcache\prndrvr.vbs --a---- 25679 bytes [10:00 14/04/2008] [10:00 14/04/2008] D2175D695F215B3235C9CA67E7CCA3E2
C:\WINDOWS\system32\dllcache\prnjobs.vbs --a---- 21806 bytes [10:00 14/04/2008] [10:00 14/04/2008] 307C38CED96A65FA12FCA78F6067CC4F
C:\WINDOWS\system32\dllcache\prnmngr.vbs --a---- 32871 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9FD12D4178DA5795BD9373E1A0354F24
C:\WINDOWS\system32\dllcache\prnport.vbs --a---- 29878 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2C82974DDE2DD411707B680A679C9F09
C:\WINDOWS\system32\dllcache\prnqctl.vbs --a---- 16046 bytes [10:00 14/04/2008] [10:00 14/04/2008] BB73D0C95F928C3B45A8C5020068FA39
C:\WINDOWS\system32\dllcache\pubprn.vbs --a---- 3758 bytes [10:00 14/04/2008] [10:00 14/04/2008] 56E6B988E5C514A2A367F589DB4E22FA
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\CalendarSample\Calendar.vbs --a---- 4016 bytes [23:27 04/04/2007] [23:27 04/04/2007] 84CADEE6B6EB13F4971876DDF8532923
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Collect for Output\CollectForOutput.vbs --a---- 2962 bytes [23:27 04/04/2007] [23:27 04/04/2007] 9D41FB1F995022B5F47E25949E6F80D1
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\ColorWheel\ColorWheel.vbs --a---- 5766 bytes [23:27 04/04/2007] [23:27 04/04/2007] C98B746F52A10AD06B3033E42C1D8E7A
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\ContactSheet\ContactSheet.vbs --a---- 9916 bytes [23:27 04/04/2007] [23:27 04/04/2007] 51DED2E6413DAE057C2AE3D2202236CD
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\CycleGraph\CycleGraph.vbs --a---- 5897 bytes [23:27 04/04/2007] [23:27 04/04/2007] 91135B04AFDB4FE876D6F6B224C51316
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Export Flash Animation\ExportFlashAnimation.vbs --a---- 2987 bytes [23:27 04/04/2007] [23:27 04/04/2007] 268643886FC54CF453C502F46A7AC962
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Sierpinski\Sierpinski.vbs --a---- 5452 bytes [23:27 04/04/2007] [23:27 04/04/2007] BB75A00513BABCD86CB83FF322587196
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Web Gallery\WebGallery.vbs --a---- 10563 bytes [23:27 04/04/2007] [23:27 04/04/2007] BBCC90E3C5224F269506FDE18222926E
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working with Datasets\ExportAllExistingDatasets.vbs --a---- 2076 bytes [23:27 04/04/2007] [23:27 04/04/2007] 7FC2F891EA632BE7F300C9C952D13EB8
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working with Datasets\ImportDatasets.vbs --a---- 3275 bytes [23:27 04/04/2007] [23:27 04/04/2007] B5AF0D7FDF466E62FDC1950D752E30F9
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working with Path Points\CountCorners.vbs --a---- 1870 bytes [23:27 04/04/2007] [23:27 04/04/2007] 20BACA2F6918F06C4A0FE7FDCEFFC57C
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working with Path Points\CreatePaths.vbs --a---- 2681 bytes [23:27 04/04/2007] [23:27 04/04/2007] 34D034C315C99463E2B3670549268E91
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working with Path Points\DeletePathPoint.vbs --a---- 1471 bytes [23:27 04/04/2007] [23:27 04/04/2007] 5E10D1659AE315EF3E60F60FC5E007C6
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Symbols\SymbolsFromPageItems.vbs --a---- 1982 bytes [23:27 04/04/2007] [23:27 04/04/2007] 2503836DEA54BE52FC76F933107BC326
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Symbols\SymbolsFromStyles.vbs --a---- 1376 bytes [23:27 04/04/2007] [23:27 04/04/2007] 6331DB23867A81B4D9C84E76634DC0A7
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working with Tagged Art\CreateDeleteTag.vbs --a---- 1666 bytes [23:27 04/04/2007] [23:27 04/04/2007] 614936F1FF272AC4A83952B7E1F625DB
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Text\Align Text.vbs --a---- 1555 bytes [23:27 04/04/2007] [23:27 04/04/2007] 935CDC07BF24EC1FBD507406594071B6
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Text\Count Words.vbs --a---- 1533 bytes [23:27 04/04/2007] [23:27 04/04/2007] B595CF01E14BEA72D9E24539792E9DA7
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Text\CreateArea Text.vbs --a---- 1506 bytes [23:27 04/04/2007] [23:27 04/04/2007] CBD497E1CD0F7FD4257ACF35565725CC
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Text\Get Selection.vbs --a---- 2790 bytes [23:27 04/04/2007] [23:27 04/04/2007] ABBC6DF0910A024988E1697AC4A9BDAA
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Text\MoveTextArt.vbs --a---- 1488 bytes [23:27 04/04/2007] [23:27 04/04/2007] B8F407241268964194E87DA8366FDBD4
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Text\Select Range of Text.vbs --a---- 1108 bytes [23:27 04/04/2007] [23:27 04/04/2007] 3196D99446C20B97B961FC64FA219308
C:\Programme\Adobe\Adobe Illustrator CS3\Scripting\Sample Scripts\Visual Basic\Working With Text\Select Text Art.vbs --a---- 1665 bytes [23:27 04/04/2007] [23:27 04/04/2007] C80E1AA78E0D56379228B183D8BE2FE7
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\AddGuides.vbs --a---- 9280 bytes [17:08 26/03/2007] [17:08 26/03/2007] 9833FF692109C3850BDFEEB3C820C077
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\AddPoints.vbs --a---- 7749 bytes [17:08 26/03/2007] [17:08 26/03/2007] 5863DB48216B294980B80A95EAE69F36
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\AdjustLayout.vbs --a---- 10556 bytes [17:08 26/03/2007] [17:08 26/03/2007] EE688250E2054CBEEEA29864D328A9C4
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\AlignToPage.vbs --a---- 8193 bytes [17:08 26/03/2007] [17:08 26/03/2007] AB3EBFFD15D5A9D4CA478562B75CEB86
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\BreakFrame.vbs --a---- 2954 bytes [17:08 26/03/2007] [17:08 26/03/2007] AD7DF092AA0BD31CC9DA315633FC8E60
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\CornerEffects.vbs --a---- 19060 bytes [17:08 26/03/2007] [17:08 26/03/2007] BD19852BDE75498D4978E28342CF1662
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\CreateCharacterStyle.vbs --a---- 7451 bytes [17:08 26/03/2007] [17:08 26/03/2007] 77DBFB63B4BDBBF586FA7AC797BB9D6F
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\CropMarks.vbs --a---- 19560 bytes [17:08 26/03/2007] [17:08 26/03/2007] 2C95B8639B1E64D666941EB8C0623F62
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\ExportAllStories.vbs --a---- 4053 bytes [17:08 26/03/2007] [17:08 26/03/2007] 26097343B01BF315FEE155F966DA1B54
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\FindChangeByList.vbs --a---- 12668 bytes [17:08 26/03/2007] [17:08 26/03/2007] 713EBA964931962AF0D7908FA2F73DA0
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\ImageCatalog.vbs --a---- 18625 bytes [17:08 26/03/2007] [17:08 26/03/2007] 9690338FE2E71B508A814C5E964E96A4
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\LabelGraphicMenu.vbs --a---- 2054 bytes [17:08 26/03/2007] [17:08 26/03/2007] 08BB5BC69102A8E11DC89B20411ABB14
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\LabelGraphics.vbs --a---- 8004 bytes [17:08 26/03/2007] [17:08 26/03/2007] D652D1A666D0B628C62729897BCC01ED
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\MakeGrid.vbs --a---- 8025 bytes [17:08 26/03/2007] [17:08 26/03/2007] 8C6F615024D24B510BCE088A9DAFE544
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\Neon.vbs --a---- 9815 bytes [17:08 26/03/2007] [17:08 26/03/2007] CFABE2C7E05AAE083DFAF210F4DAE75E
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\PathEffects.vbs --a---- 11557 bytes [17:08 26/03/2007] [17:08 26/03/2007] AE4CF98CDF126476743C75D39D358F21
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\PlaceMultipagePDF.vbs --a---- 4469 bytes [17:08 26/03/2007] [17:08 26/03/2007] BD1314FA66BFF028B10D09FD19AF6474
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\SelectObjects.vbs --a---- 5781 bytes [17:08 26/03/2007] [17:08 26/03/2007] DB658209423DC6751045D6DD0D2ED22C
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\SortParagraphs.vbs --a---- 2785 bytes [17:08 26/03/2007] [17:08 26/03/2007] 7FD3D27A382C9640AAD3A1CFDE8EDB42
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\SplitStory.vbs --a---- 2097 bytes [17:08 26/03/2007] [17:08 26/03/2007] 66AAFFD0FBEE1CF3C90919E452B1E95D
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\TabUtilities.vbs --a---- 8324 bytes [17:08 26/03/2007] [17:08 26/03/2007] 7257E25A23382F55C644B5AF8EB91B87
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\LabelGraphicSupport\LabelGraphicBeforeDisplay.vbs --a---- 4914 bytes [17:08 26/03/2007] [17:08 26/03/2007] 1E0291B61A4FF438A8E0C75DA2011579
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\LabelGraphicSupport\LabelGraphicOnInvoke.vbs --a---- 8375 bytes [17:08 26/03/2007] [17:08 26/03/2007] AF62862763CF71142A4D8A24BB63D946
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Scripts Panel\Samples\VBScript\LabelGraphicSupport\RemoveLabelGraphicMenu.vbs --a---- 2372 bytes [17:08 26/03/2007] [17:08 26/03/2007] 3DDF60099EDD43EE2F9FF94DFEB547EF
C:\Programme\Adobe\Adobe InDesign CS3\Scripts\Xml Rules\glue code.vbs --a---- 5876 bytes [17:08 26/03/2007] [17:08 26/03/2007] A8DDE29563F0A6E54C392AC62B193D4C
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\ApplyStyle.vbs --a---- 1818 bytes [04:09 03/04/2007] [04:09 03/04/2007] 6D4AF3BC30FD57A0CA3EE1E4B0D2939B
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\BatchProcess.vbs --a---- 4631 bytes [04:09 03/04/2007] [04:09 03/04/2007] 9424A2F1EBD85888FEE17C11993F5649
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\ClipboardInteraction.vbs --a---- 2149 bytes [04:09 03/04/2007] [04:09 03/04/2007] 87830BF6A1349A88B469A9DF30B6AAE6
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\CreateAndExecuteAction.vbs --a---- 2136 bytes [04:09 03/04/2007] [04:09 03/04/2007] ED9D4915BF03511A79B0416D3FD9B069
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\CreateNewTextArt.vbs --a---- 1307 bytes [04:09 03/04/2007] [04:09 03/04/2007] EE6AE50B174C30B4A7D0F6B5D230BB47
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\Crop.vbs --a---- 2366 bytes [04:09 03/04/2007] [04:09 03/04/2007] 2DDE8BD9A32C059E82C3EE44A6E32CD5
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\DocumentByName.vbs --a---- 589 bytes [04:09 03/04/2007] [04:09 03/04/2007] BD67FB4B8561C5ECFF61E96CBEC82BC0
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\DuplicateLayers.vbs --a---- 1676 bytes [04:09 03/04/2007] [04:09 03/04/2007] 5240D215E35DB2477DDF8E5D6CA3362F
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\ExecuteAction.vbs --a---- 2299 bytes [04:09 03/04/2007] [04:09 03/04/2007] B92C9F60EF983A287A7424B7E9A8F0C3
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\ExecuteJavaScript.vbs --a---- 1546 bytes [04:09 03/04/2007] [04:09 03/04/2007] 43DE850F787B1C96EEA04BB4D0A4AD2C
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\Filters.vbs --a---- 2508 bytes [04:09 03/04/2007] [04:09 03/04/2007] ECF82BB658C4D60A3A359EB508C67A44
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\HistoryState.vbs --a---- 2220 bytes [04:09 03/04/2007] [04:09 03/04/2007] 01E10C05E3470C0FB1590564546182A9
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\OpenDocument.vbs --a---- 1364 bytes [04:09 03/04/2007] [04:09 03/04/2007] ED6FC20DC6204B91D4AB7CD1AC2B9272
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\SaveAsFormats.vbs --a---- 3501 bytes [04:09 03/04/2007] [04:09 03/04/2007] DBD4271C380C4F8BF74FE11308E650BD
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\Selection.vbs --a---- 2156 bytes [04:09 03/04/2007] [04:09 03/04/2007] 6CE9D8E63CCEEC361245798826133097
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\SelectionEffects.vbs --a---- 1880 bytes [04:09 03/04/2007] [04:09 03/04/2007] 296FE831A5892C4DCBAF8950B33DCC04
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\TextArt.vbs --a---- 3949 bytes [04:09 03/04/2007] [04:09 03/04/2007] 98C387641BC1A565B356791ADB0FFCC8
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\TextArtCenter.vbs --a---- 2624 bytes [04:09 03/04/2007] [04:09 03/04/2007] 0BAAEE0E20CF96CD946CAAD40EC24C01
C:\Programme\Adobe\Adobe Photoshop CS3\Skript Handbuch\Beispielskripten\VBScript\Trim.vbs --a---- 1663 bytes [04:09 03/04/2007] [04:09 03/04/2007] D20587638F044244BD7341F16CE464FF

Searching for "*.inf"
C:\autorun.inf -rahs-- 0 bytes [18:35 11/01/2009] [22:47 23/08/2010] (Unable to calculate MD5)
C:\WINDOWS\system32\mmdriver.inf --a---- 1492 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6C8FFEB1A4F7DB9D8F5EF68D953AC139
C:\WINDOWS\system32\ieuinit.inf --a---- 46148 bytes [10:00 14/04/2008] [10:00 14/04/2008] F589C180A053BE9D155340BCDA2B52BF
C:\WINDOWS\system32\homepage.inf --a---- 929 bytes [10:00 14/04/2008] [10:00 14/04/2008] BF7DFAD60D4809DAA505765A1A925E3E
C:\WINDOWS\system32\pid.inf --a---- 1950 bytes [10:00 14/04/2008] [10:00 14/04/2008] C64B90EC63066C54F76C344A2BA415E5
C:\WINDOWS\system32\$winnt$.inf --a---- 261 bytes [10:54 06/01/2009] [11:12 06/01/2009] D77BBE394E419A31AD8AF29B36D6F735
C:\WINDOWS\system32\ras\pad.inf --a---- 14527 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8FCCDDD3F0C0DECDB074F7C058A00F09
C:\WINDOWS\system32\ras\switch.inf --a---- 7384 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4FA22987198D835F9363B67EC8977DCB
C:\WINDOWS\system32\dllcache\pid.inf --a---- 1950 bytes [10:00 14/04/2008] [10:00 14/04/2008] C64B90EC63066C54F76C344A2BA415E5
C:\WINDOWS\system32\dllcache\archvapp.inf --a---- 144776 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5A7077FE2E2FBC18F8D64FF4DC782958
C:\WINDOWS\system32\oobe\phone.inf --a---- 48458 bytes [11:07 06/01/2009] [11:00 14/04/2008] 22DD0C0ED58A6EDCEDA328EFE3ECCBCB
C:\WINDOWS\system32\usmt\archvapp.inf --a---- 144776 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5A7077FE2E2FBC18F8D64FF4DC782958
C:\WINDOWS\system32\usmt\migapp.inf --a---- 564594 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5B11CD409FF6308A1C4D787FE92FA623
C:\WINDOWS\system32\usmt\migism.inf --a---- 5958 bytes [10:00 14/04/2008] [10:00 14/04/2008] B303841534F17098FBFFA67E3B2EC669
C:\WINDOWS\system32\usmt\migsys.inf --a---- 133070 bytes [10:00 14/04/2008] [10:00 14/04/2008] CBDE9BBB3E13294695CD80E6CDE4DD41
C:\WINDOWS\system32\usmt\miguser.inf --a---- 8122 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6DE83D45B41EFD6CE715DD708C9D50B6
C:\WINDOWS\system32\usmt\migwiz.inf --a---- 9278 bytes [10:00 14/04/2008] [10:00 14/04/2008] B10B084857FF3BF8A6AF449FA8080F14
C:\WINDOWS\system32\usmt\sysfiles.inf --a---- 1650524 bytes [10:00 14/04/2008] [10:00 14/04/2008] B20F00D8C3C3CA292C47C5D3139684C3
C:\WINDOWS\system32\usmt\usmtdef.inf --a---- 27910 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0A883553F46B065D683FA1FBC953DFDB
C:\WINDOWS\system32\DRVSTORE\isight_9400F3F80DDA0C20D44CA2C11A0AC807680CB60D\isight.inf --a---- 4526 bytes [19:36 06/01/2009] [13:32 15/04/2008] 404FBAE276491E1D4E9C083D08F992C7
C:\WINDOWS\system32\DRVSTORE\applebt_2AFDFA020DECCE87129AB18179F97C964445FAAC\applebt.inf --a---- 4509 bytes [19:37 06/01/2009] [13:29 15/04/2008] CDD20F8BCCE8C7EA131BB47F8F5A3203
C:\WINDOWS\system32\DRVSTORE\yk51x86_98FE2F08F37A78F4FF0C10AACFE1E827854D61AE\yk51x86.inf --a---- 789336 bytes [19:37 06/01/2009] [13:35 15/04/2008] A738D06B38B007ACBFFBA56E8DDF4993
C:\WINDOWS\system32\DRVSTORE\net5211_83E4E86F1350732D629D737DAECF97C35FD29B0F\net5211.inf --a---- 83271 bytes [19:37 06/01/2009] [13:32 15/04/2008] 85F072E24A141AAD3BE53D9722487D0D
C:\WINDOWS\system32\DRVSTORE\net5416_011416A5D099921307D4CC88E2E5BD075CE39446\net5416.inf --a---- 23687 bytes [19:37 06/01/2009] [13:32 15/04/2008] 024B75ED9CB1A4BC39B28B00B1E5B595
C:\WINDOWS\system32\DRVSTORE\bcmwl5_F9FBC28EF04BA05355D6105BDFE0197A3790DAA4\bcmwl5.inf --a---- 538786 bytes [19:37 06/01/2009] [13:33 15/04/2008] E07DFDFAA3FB6D0A2DC5BDF726AC5614
C:\WINDOWS\system32\DRVSTORE\applenull_8D831C2CF232C6113BF35CA6DFA60199CB2CC70B\applenull.inf --a---- 1519 bytes [19:37 06/01/2009] [13:30 15/04/2008] 354642AFA257D3AE805FED5761F53065
C:\WINDOWS\system32\DRVSTORE\qd25232_E8704349DFE568F4F507D2E3303A72E4230BFE7B\qd25232.inf --a---- 2916 bytes [19:37 06/01/2009] [13:33 15/04/2008] 6246AA8963AE35251CCA42D692FB11CB
C:\WINDOWS\system32\DRVSTORE\bthkicker_22481FFE232728F300C3EA4B9D04741F71A78A6F\bthkicker.inf --a---- 1900 bytes [19:41 06/01/2009] [13:29 15/04/2008] EA3D94193617E4B0A8D486E524102F1C
C:\WINDOWS\system32\DRVSTORE\irfilter_1B7BB89AE411085A6AC127DCBF8C41E26A8A8592\irfilter.inf --a---- 2462 bytes [19:41 06/01/2009] [13:31 15/04/2008] 726B1685BA62B7D147BB3015F1BF4AC5
C:\WINDOWS\system32\DRVSTORE\keymagic_F53EB2D12E895A98319E03CE13FACAF273CBB244\keymagic.inf --a---- 7159 bytes [19:41 06/01/2009] [13:30 15/04/2008] B8F0C42C4E9536462E6B67FB3754B369
C:\WINDOWS\system32\DRVSTORE\aaplmonf_23258C7C7282A187EB6F2A77C18E3B3BC852D04D\aaplmonf.inf --a---- 2715 bytes [19:42 06/01/2009] [13:30 15/04/2008] 92CDADEB96E64B44CEB52DA0AA1A5C53
C:\WINDOWS\system32\DRVSTORE\aapltctp_932475B6A0E9A94773F9F9662D557609CB32FF4E\aapltctp.inf --a---- 3079 bytes [19:42 06/01/2009] [13:31 15/04/2008] 218D1E08CAFA9CE6A1B3F92E8350CB90
C:\WINDOWS\system32\DRVSTORE\aapltp_F3D6F04C49D41FFDCE8B7B563B57B110E62F08F8\aapltp.inf --a---- 5711 bytes [19:42 06/01/2009] [13:31 15/04/2008] 5767C24733EBCB1D83634472D03FF318
C:\WINDOWS\system32\DRVSTORE\applemtm_98FB1BE77D11DFBAE6446CA90678465D448641CD\applemtm.inf --a---- 5596 bytes [19:42 06/01/2009] [13:30 15/04/2008] 6DE3892D3AA2AF271DB745274F7B4F47
C:\WINDOWS\system32\DRVSTORE\applemtp_4188EB303A0EA85801A31C467889AB494D52DC02\applemtp.inf --a---- 5318 bytes [19:42 06/01/2009] [13:30 15/04/2008] 67431C1A7C7E861C725729888AB1B9E6
C:\WINDOWS\system32\DRVSTORE\e1000325_4D2F92D840FE9D1A0C33FEC20BFC7747BB0608EA\e1000325.inf --a---- 336492 bytes [19:42 06/01/2009] [13:33 15/04/2008] 5B1C7852CDD6B86CA856D15252D5C7C0
C:\WINDOWS\system32\DRVSTORE\e1e5132_A95FC331A737294D9476DAB83E0F4371146BDFDE\e1e5132.inf --a---- 198410 bytes [19:42 06/01/2009] [13:33 15/04/2008] 4EB39C597C73B7AB52FF598522709EED
C:\WINDOWS\system32\DRVSTORE\965m_9A15108BB7B30D82287DC605E58871A518189EE4\965m.inf --a---- 3580 bytes [19:42 06/01/2009] [21:33 15/04/2008] AF662E4AE56C6EC6CFADC23379CC58D5
C:\WINDOWS\system32\DRVSTORE\ich8core_501A6B0DA028D1B14A460ADF906D3EC6C148E1B5\ich8core.inf --a---- 6002 bytes [19:42 06/01/2009] [21:33 15/04/2008] 499BD23CAF4184B5961A5E6CF0163D25
C:\WINDOWS\system32\DRVSTORE\ich8ide_F90485B98E63BA9DB84D0D6B462A1E7925391FAE\ich8ide.inf --a---- 4163 bytes [19:43 06/01/2009] [21:33 15/04/2008] FBB05F294013F849A7E5FC9BABBBC117
C:\WINDOWS\system32\DRVSTORE\ich8smb_C6EB7BBD81CAB5125EB553C321E2F0445173A791\ich8smb.inf --a---- 3430 bytes [19:43 06/01/2009] [21:33 15/04/2008] B255B3CCACCE8807637AF2D3806CD5FD
C:\WINDOWS\system32\DRVSTORE\appleusbet_6A3275723D7938B8CA3EC650DBC99B1E2C65F44B\appleusbethernet.inf --a---- 4749 bytes [19:43 06/01/2009] [13:32 15/04/2008] BF78BB9E0F62F875E4865B9C8BAD5FB7
C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\input.inf --a---- 140666 bytes [19:41 06/01/2009] [10:00 14/04/2008] FDF21A752843EA3E33B67B7050FA1C38
C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\input.inf --a---- 140666 bytes [19:41 06/01/2009] [10:00 14/04/2008] FDF21A752843EA3E33B67B7050FA1C38
C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\input.inf --a---- 140666 bytes [19:42 06/01/2009] [10:00 14/04/2008] FDF21A752843EA3E33B67B7050FA1C38
C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\input.inf --a---- 140666 bytes [19:42 06/01/2009] [10:00 14/04/2008] FDF21A752843EA3E33B67B7050FA1C38
C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\machine.inf --a---- 171580 bytes [19:42 06/01/2009] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\machine.inf --a---- 171580 bytes [19:42 06/01/2009] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\machine.inf --a---- 171580 bytes [19:42 06/01/2009] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\machine.inf --a---- 171580 bytes [19:42 06/01/2009] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\machine.inf --a---- 171580 bytes [19:42 06/01/2009] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\machine.inf --a---- 171580 bytes [19:42 06/01/2009] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\machine.inf --a---- 171580 bytes [19:43 06/01/2009] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\mshdc.inf --a---- 55244 bytes [19:43 06/01/2009] [10:00 14/04/2008] 99C5E5ABC035E8F2811CE8CF204D04AC
C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\mshdc.inf --a---- 55244 bytes [19:43 06/01/2009] [10:00 14/04/2008] 99C5E5ABC035E8F2811CE8CF204D04AC
C:\WINDOWS\system\setup.inf --a---- 59167 bytes [10:00 14/04/2008] [10:00 14/04/2008] FD5130F1070715C066D68DC1665AECC0
C:\WINDOWS\repair\secsetup.inf --a---- 834496 bytes [11:10 06/01/2009] [11:10 06/01/2009] 1CB5F322C54D460B6378B2C5E083E803
C:\WINDOWS\inf\1394.inf --a---- 15770 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8DB5C136011B816DFD9148588FF6C124
C:\WINDOWS\inf\1394vdbg.inf --a---- 2732 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3693590265DF83927B68C8D335F8062B
C:\WINDOWS\inf\61883.inf --a---- 5020 bytes [10:00 14/04/2008] [10:00 14/04/2008] 58B021DAC9DAE94D8E840F651C64E1C0
C:\WINDOWS\inf\acerscan.inf --a---- 6492 bytes [10:00 14/04/2008] [10:00 14/04/2008] B5F4961A87212D36CD8C96382CD13D0D
C:\WINDOWS\inf\apcompat.inf --a---- 7692 bytes [10:00 14/04/2008] [10:00 14/04/2008] FCBB3655D748FD1C75CE9BE0773605A5
C:\WINDOWS\inf\appmig.inf --a---- 810 bytes [10:00 14/04/2008] [10:00 14/04/2008] F8136C9BF38432BEB900277ECD8AC05B
C:\WINDOWS\inf\apps.inf --a---- 125226 bytes [10:00 14/04/2008] [10:00 14/04/2008] D83E0AABA51FFDD76A09C43D026559A0
C:\WINDOWS\inf\asroc.inf --a---- 806 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2C5DE3CBC69F50EA7B9FF867A78F6E0D
C:\WINDOWS\inf\atividin.inf --a---- 59598 bytes [10:00 14/04/2008] [10:00 14/04/2008] B12A15320EF9C8D40C052C9D679903D6
C:\WINDOWS\inf\avc.inf --a---- 8548 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7A12223180DA5351BF07774336F04B99
C:\WINDOWS\inf\axant5.inf --a---- 3268 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6F9D68EF9FDE366A13443AD4726849A9
C:\WINDOWS\inf\brmfcmdm.inf --a---- 57366 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2F5AD484060AFC50A5E437F4784F4F3D
C:\WINDOWS\inf\brmfcmf.inf --a---- 96126 bytes [10:00 14/04/2008] [10:00 14/04/2008] 441A62A6957D0365E84125DF56A0C785
C:\WINDOWS\inf\brmfcsto.inf --a---- 6098 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0430F691AF2B80508821DA2181790DAA
C:\WINDOWS\inf\brmfcumd.inf --a---- 5116 bytes [10:00 14/04/2008] [10:00 14/04/2008] 56AA2EEF3EC14251A725DF975F12AE73
C:\WINDOWS\inf\brmfcwia.inf --a---- 46972 bytes [10:00 14/04/2008] [10:00 14/04/2008] D10E1188D70B049B9220FF58C2B1E65B
C:\WINDOWS\inf\brmfport.inf --a---- 10598 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4FCC3FF6700E495A1EFAEE23E6582600
C:\WINDOWS\inf\camdsh20.inf --a---- 16058 bytes [10:00 14/04/2008] [10:00 14/04/2008] A0D3F206512D488841CCDFDB6CB7B75D
C:\WINDOWS\inf\camvid20.inf --a---- 19576 bytes [10:00 14/04/2008] [10:00 14/04/2008] EEA992C936E7B43749E25697209848BA
C:\WINDOWS\inf\camvid30.inf --a---- 13570 bytes [10:00 14/04/2008] [10:00 14/04/2008] 594E711BDA58F874A91820DDCBA0BED8
C:\WINDOWS\inf\certclas.inf --a---- 4374 bytes [10:00 14/04/2008] [10:00 14/04/2008] 555198D5DAF738FFD4079EAE7BCEE5EC
C:\WINDOWS\inf\communic.inf --a---- 17848 bytes [10:00 14/04/2008] [10:00 14/04/2008] 475E48D399B674F2A3DBF48172B6F0EA
C:\WINDOWS\inf\corelist.inf --a---- 16928 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0D4FF6A66046A2275D3057BFDDE60C73
C:\WINDOWS\inf\cyclad-z.inf --a---- 4844 bytes [10:00 14/04/2008] [10:00 14/04/2008] 05FDC6B92BB7450781DE83AA8F18DAC4
C:\WINDOWS\inf\cyclom-y.inf --a---- 5186 bytes [10:00 14/04/2008] [10:00 14/04/2008] 80E04E3202F533C36BA380FCFCBBAFC8
C:\WINDOWS\inf\cyyport.inf --a---- 9588 bytes [10:00 14/04/2008] [10:00 14/04/2008] 449CB5DB04E0C83CBD3EC0CFDB960E84
C:\WINDOWS\inf\cyzport.inf --a---- 16282 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3E653E81482F5D7E2F9A67E6A799978E
C:\WINDOWS\inf\dfrg.inf --a---- 4280 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4415FF7C5F4EF8CD7DE7407DB81AB56E
C:\WINDOWS\inf\dgaport.inf --a---- 32150 bytes [10:00 14/04/2008] [10:00 14/04/2008] CB7054167CFA295C716443A45BC1F600
C:\WINDOWS\inf\dgasync.inf --a---- 29968 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4FFA36B0E61207D1B7AAE6814543CCD3
C:\WINDOWS\inf\digiasyn.inf --a---- 4036 bytes [10:00 14/04/2008] [10:00 14/04/2008] B056D28B8BA551E0CEA7AC8931C3713A
C:\WINDOWS\inf\digiisdn.inf --a---- 6314 bytes [10:00 14/04/2008] [10:00 14/04/2008] DE812378B3E28FC05C8B6F5E2FFF1EDC
C:\WINDOWS\inf\digimps.inf --a---- 24600 bytes [10:00 14/04/2008] [10:00 14/04/2008] DA247C38EDF6BEBE375C3C36E62EE157
C:\WINDOWS\inf\digirp.inf --a---- 9354 bytes [10:00 14/04/2008] [10:00 14/04/2008] C5C53AF48EE9286B2A48AB14AC2F88A4
C:\WINDOWS\inf\digirprt.inf --a---- 8002 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7A10491FFD205EAC2BA4158FB2DE75AB
C:\WINDOWS\inf\dimaps.inf --a---- 22752 bytes [10:00 14/04/2008] [10:00 14/04/2008] FE984AB85D8FC7DDC755185FC2CEEB15
C:\WINDOWS\inf\display.inf --a---- 67434 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3B18D760581E798F3F85E3D5F3A3EBC0
C:\WINDOWS\inf\dot4.inf --a---- 84960 bytes [10:00 14/04/2008] [10:00 14/04/2008] D26FE8E24C7FA5217770D860FFCFCF5C
C:\WINDOWS\inf\dot4prt.inf --a---- 4508 bytes [10:00 14/04/2008] [10:00 14/04/2008] 254D483F48FE0E117139922F9CBF3CA4
C:\WINDOWS\inf\dvd.inf --a---- 33270 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7DDBEB3B4B14FE1EEC6F04963E2570EF
C:\WINDOWS\inf\enum1394.inf --a---- 3070 bytes [10:00 14/04/2008] [10:00 14/04/2008] F7E0376DB7C3EC833FB2341FAF61EBD3
C:\WINDOWS\inf\epcfw2k.inf --a---- 3078 bytes [10:00 14/04/2008] [10:00 14/04/2008] 88F338481C41196FAF20DDEE55161964
C:\WINDOWS\inf\epsnscan.inf --a---- 65412 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4D127E5D5B40C69BAB888C5FFBD0CD71
C:\WINDOWS\inf\epsnmfp.inf --a---- 9972 bytes [10:00 14/04/2008] [10:00 14/04/2008] A6D9CF18459DD6BD238789B2CB4A8126
C:\WINDOWS\inf\epstw2k.inf --a---- 2846 bytes [10:00 14/04/2008] [10:00 14/04/2008] E573C98041B07091EBD98C3B87BA29C8
C:\WINDOWS\inf\fdc.inf --a---- 4806 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8F3FE94CA0FAA6AD75E15F786ACD9ED7
C:\WINDOWS\inf\fjtscan.inf --a---- 24872 bytes [10:00 14/04/2008] [10:00 14/04/2008] F1861B191555412E1C8027E3928ED6C3
C:\WINDOWS\inf\flash.inf --a---- 12710 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1AAA7161EE2D5890E8103952E2DB3598
C:\WINDOWS\inf\flpydisk.inf --a---- 6116 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0F3B660C8A1B315D8E504EA5F686B800
C:\WINDOWS\inf\font.inf --a---- 141426 bytes [10:00 14/04/2008] [10:00 14/04/2008] 90B5ACE3936EAAAD73FD3629676CA6F7
C:\WINDOWS\inf\gameport.inf --a---- 12606 bytes [10:00 14/04/2008] [10:00 14/04/2008] 327739CF9A1A9029D9FFE552873E7FE5
C:\WINDOWS\inf\games.inf --a---- 17742 bytes [10:00 14/04/2008] [10:00 14/04/2008] B5D1A15BC68B7F8690602952C8B24925
C:\WINDOWS\inf\genprint.inf --a---- 2806 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4917F4F3DF740F4A9CCB9A71A431F42E
C:\WINDOWS\inf\hal.inf --a---- 12112 bytes [10:00 14/04/2008] [10:00 14/04/2008] E9F5ECEA4BD6BD589A7846E1ADE263AD
C:\WINDOWS\inf\hpdigwia.inf --a---- 3892 bytes [10:00 14/04/2008] [10:00 14/04/2008] 613F63B98A71E4A689CA96562CC1E3E8
C:\WINDOWS\inf\hpojscan.inf --a---- 17910 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0852884B42B84187CC3AD67C943F79D0
C:\WINDOWS\inf\hpscan.inf --a---- 57504 bytes [10:00 14/04/2008] [10:00 14/04/2008] 735764138BF98FDFC4AB4901BD994884
C:\WINDOWS\inf\ibmvcap.inf --a---- 5648 bytes [10:00 14/04/2008] [10:00 14/04/2008] 546470A5536CD9817E9D596D464688F4
C:\WINDOWS\inf\icam3.inf --a---- 15318 bytes [10:00 14/04/2008] [10:00 14/04/2008] 28D7ABF79AFB0C5978E80A409429308F
C:\WINDOWS\inf\icam4usb.inf --a---- 22288 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5A5335EB8D3DC03A4B363DD98D3ED06B
C:\WINDOWS\inf\icam5usb.inf --a---- 16104 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7A161CD9141DFE81319F177B9C3918BD
C:\WINDOWS\inf\icminst.inf --a---- 1250 bytes [10:00 14/04/2008] [10:00 14/04/2008] 686DE225E1B9E52E4238E5A6C415FA76
C:\WINDOWS\inf\icwnt5.inf --a---- 16440 bytes [10:00 14/04/2008] [10:00 14/04/2008] FD7D716632C41AAD9696CF29064DC60E
C:\WINDOWS\inf\iereset.inf --a---- 5526 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7F6006F2AA16EAEAE171D479731CCBEB
C:\WINDOWS\inf\igames.inf --a---- 12680 bytes [10:00 14/04/2008] [10:00 14/04/2008] 78FAE055C002C058C06106B5F5CFEACE
C:\WINDOWS\inf\image.inf --a---- 38448 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5D40EFE5175E27B0B6D1C3632E2B3D0E
C:\WINDOWS\inf\irdasmc.inf --a---- 23944 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5E5D908ADD086128F8431A747111B9D1
C:\WINDOWS\inf\irnsc.inf --a---- 47758 bytes [10:00 14/04/2008] [10:00 14/04/2008] B784D79DFAA22466C3BDF8624AABBCB0
C:\WINDOWS\inf\irmk7w2k.inf --a---- 9482 bytes [10:00 14/04/2008] [10:00 14/04/2008] D56D711D7024915AD1414CBB9B3D1643
C:\WINDOWS\inf\irstusb.inf --a---- 7558 bytes [10:00 14/04/2008] [10:00 14/04/2008] B966242736AE60BC1452DA5F7F75EC63
C:\WINDOWS\inf\kdk2x0.inf --a---- 21574 bytes [10:00 14/04/2008] [10:00 14/04/2008] A184ACF7B8A41FA886CCC63D327E7181
C:\WINDOWS\inf\kdkscan.inf --a---- 9624 bytes [10:00 14/04/2008] [10:00 14/04/2008] 446BA3318C47640811230D88937BBDA0
C:\WINDOWS\inf\kodak.inf --a---- 6332 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6492468957EE880EF08D6F4B4EC03F5D
C:\WINDOWS\inf\legcydrv.inf --a---- 1648 bytes [10:00 14/04/2008] [10:00 14/04/2008] D7843A1C96827E92A6858757D215ED38
C:\WINDOWS\inf\lwngmadi.inf --a---- 14022 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1B498C592D4B947F435D2EEE02294E92
C:\WINDOWS\inf\lwusbhid.inf --a---- 17482 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9996512885649EA551D0760CCCA27300
C:\WINDOWS\inf\mdm3com.inf --a---- 106470 bytes [10:00 14/04/2008] [10:00 14/04/2008] 646477EAA5339AFD78FDB38367B741FB
C:\WINDOWS\inf\mdm5674a.inf --a---- 65616 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9C779C441DA3CFC64B064FF50D069F25
C:\WINDOWS\inf\mdmadc.inf --a---- 13066 bytes [10:00 14/04/2008] [10:00 14/04/2008] CDA6097DC70D0ACCB08557585B35D2D1
C:\WINDOWS\inf\mdmairte.inf --a---- 5724 bytes [10:00 14/04/2008] [10:00 14/04/2008] BCCCE2ECEAA3E688DAB8E47418163BCD
C:\WINDOWS\inf\mdmaiwa.inf --a---- 26762 bytes [10:00 14/04/2008] [10:00 14/04/2008] 94A108E35C06563AB8235A39DDBBF55E
C:\WINDOWS\inf\mdmaiwa3.inf --a---- 19230 bytes [10:00 14/04/2008] [10:00 14/04/2008] 027028C7E249D1C787FF192310091879
C:\WINDOWS\inf\mdmaiwa4.inf --a---- 119452 bytes [10:00 14/04/2008] [10:00 14/04/2008] D50ABB5B8C93CA0A4DE70B695E1C23EA
C:\WINDOWS\inf\mdmaiwa5.inf --a---- 28858 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7CFEEE734DFB30262DE236E7D1B275AB
C:\WINDOWS\inf\mdmaiwat.inf --a---- 8636 bytes [10:00 14/04/2008] [10:00 14/04/2008] E70D4E08621631E59BD430F75E1C7344
C:\WINDOWS\inf\mdmar1.inf --a---- 15524 bytes [10:00 14/04/2008] [10:00 14/04/2008] 48DF783CA638A6DF351DD7F04663040C
C:\WINDOWS\inf\mdmarch.inf --a---- 50148 bytes [10:00 14/04/2008] [10:00 14/04/2008] 27477749174F470C9549EB235FB0AF21
C:\WINDOWS\inf\mdmarn.inf --a---- 14466 bytes [10:00 14/04/2008] [10:00 14/04/2008] 098BA6CE2208152235B477B7F7857229
C:\WINDOWS\inf\mdmati.inf --a---- 105392 bytes [10:00 14/04/2008] [10:00 14/04/2008] BD4FD47E8DC6C1A3D1930542B168B313
C:\WINDOWS\inf\mdmatm2k.inf --a---- 20168 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9C8742B8C074D6EE6902AC86E82AD641
C:\WINDOWS\inf\mdmatt.inf --a---- 44026 bytes [10:00 14/04/2008] [10:00 14/04/2008] 240AE763B6F8718C5DE616FA9A76DAAF
C:\WINDOWS\inf\mdmaus.inf --a---- 25768 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5E0D473BB2FB07CBFA187206682F7E9D
C:\WINDOWS\inf\mdmboca.inf --a---- 88880 bytes [10:00 14/04/2008] [10:00 14/04/2008] ECD9E63FEE8CC51A3606B5B718F6E8C9
C:\WINDOWS\inf\mdmbsb.inf --a---- 24716 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5BD2F61D107E0F4AB5D160656C6902BA
C:\WINDOWS\inf\mdmbug3.inf --a---- 8414 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8F4F848783C085BF3F879387543C922B
C:\WINDOWS\inf\mdmbw561.INF --a---- 29352 bytes [10:00 14/04/2008] [10:00 14/04/2008] B179CA51F66E7AE7275E2379FC6947C8
C:\WINDOWS\inf\mdmc26a.INF --a---- 25800 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3227CE89E0BDB50B022991D8CBCFE6A7
C:\WINDOWS\inf\mdmcdp.inf --a---- 12092 bytes [10:00 14/04/2008] [10:00 14/04/2008] 634D183F0EE633BC4174DD6F71C043FB
C:\WINDOWS\inf\mdmchipv.inf --a---- 156 bytes [10:00 14/04/2008] [10:00 14/04/2008] E1054A6388FD2C3824E9480697A8B213
C:\WINDOWS\inf\mdmcm28.inf --a---- 139404 bytes [10:00 14/04/2008] [10:00 14/04/2008] FECF0576C7703AD955E6F764F5D0DC02
C:\WINDOWS\inf\mdmcodex.inf --a---- 26072 bytes [10:00 14/04/2008] [10:00 14/04/2008] 81DE15C54DC3340615957EFBF034A1CC
C:\WINDOWS\inf\mdmcom1.inf --a---- 57000 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3DA20EBE0D07F42A92A5B1FA676BE028
C:\WINDOWS\inf\mdmcommu.inf --a---- 7524 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4FBF41A7C74F20AB215F3D4A4979FB34
C:\WINDOWS\inf\mdmcomp.inf --a---- 12056 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9D82883BC720F3E1279710511826F648
C:\WINDOWS\inf\mdmcpq.inf --a---- 208314 bytes [10:00 14/04/2008] [10:00 14/04/2008] 026A3E9E2306951EF70521C74B3B194D
C:\WINDOWS\inf\mdmcpq2.inf --a---- 56754 bytes [10:00 14/04/2008] [10:00 14/04/2008] CB713D3EBF6C32227D9A345A8C278A65
C:\WINDOWS\inf\mdmcpv.inf --a---- 11380 bytes [10:00 14/04/2008] [10:00 14/04/2008] A072EAEC612DE2312D1499BBEB4B6E13
C:\WINDOWS\inf\mdmcrtix.inf --a---- 23946 bytes [10:00 14/04/2008] [10:00 14/04/2008] 10339FF5185DA1B3522B8CD943E9CD14
C:\WINDOWS\inf\mdmdcm5.inf --a---- 107142 bytes [10:00 14/04/2008] [10:00 14/04/2008] 38EE8DA67CEE08D55C548DB25925E74D
C:\WINDOWS\inf\mdmdcm6.inf --a---- 45554 bytes [10:00 14/04/2008] [10:00 14/04/2008] AB266528EBCE443D90FF667998B95D5D
C:\WINDOWS\inf\netrlw2k.inf --a---- 6448 bytes [10:00 14/04/2008] [10:00 14/04/2008] FF7DAA687574B38C799EE56D74EED16A
C:\WINDOWS\inf\mdmdf56F.inf --a---- 26552 bytes [10:00 14/04/2008] [10:00 14/04/2008] EDA7EF5DCDB4A77C4A63B6BB4B1BA891
C:\WINDOWS\inf\mdmdgitn.inf --a---- 19474 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2BA3DBC8A2763710E2195771E94DB85B
C:\WINDOWS\inf\mdmdgden.inf --a---- 22816 bytes [10:00 14/04/2008] [10:00 14/04/2008] 45CB002D5A0F7171AFFF1E145576680C
C:\WINDOWS\inf\mdmdp2.inf --a---- 18578 bytes [10:00 14/04/2008] [10:00 14/04/2008] B2FDAA24F4EA166E8C75A3D3FD4993C5
C:\WINDOWS\inf\mdmdsi.inf --a---- 267026 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0EC100478DD296CDC8646A7292AB5C78
C:\WINDOWS\inf\mdmdyna.inf --a---- 76610 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7A726E15A29AA5F655D6572FB0C6892E
C:\WINDOWS\inf\mdmeiger.inf --a---- 35880 bytes [10:00 14/04/2008] [10:00 14/04/2008] 035185887B232902CCA27FC84465B004
C:\WINDOWS\inf\mdmelsa.inf --a---- 152964 bytes [10:00 14/04/2008] [10:00 14/04/2008] B0C38614CC0313190DDB7D415F15370E
C:\WINDOWS\inf\mdmeric.inf --a---- 19946 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9EB996FFBF989F27FB1E0A364B44E16F
C:\WINDOWS\inf\mdmeric2.inf --a---- 31048 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7ABBA9BCB64D5F7CC071C010F2036EA8
C:\WINDOWS\inf\mdmexp.inf --a---- 62644 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8127690922C5E3B905A8152A8EABF394
C:\WINDOWS\inf\mdmfj2.inf --a---- 22076 bytes [10:00 14/04/2008] [10:00 14/04/2008] 40029D5C76C2C02EFC7DDFE762032F2D
C:\WINDOWS\inf\mdmgatew.inf --a---- 92564 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3DEC5281EAAA49BFF1940B314D6765AF
C:\WINDOWS\inf\mdmgcs.inf --a---- 47154 bytes [10:00 14/04/2008] [10:00 14/04/2008] CA95111A59FF29BEE816D0AAA9027DDA
C:\WINDOWS\inf\mdmgl001.inf --a---- 89430 bytes [10:00 14/04/2008] [10:00 14/04/2008] 70BC40A7977D27D563248FB9F37B353E
C:\WINDOWS\inf\mdmgl002.inf --a---- 98796 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6B53DD5F27AD70C2169166C8AC41D168
C:\WINDOWS\inf\mdmgl003.inf --a---- 104278 bytes [10:00 14/04/2008] [10:00 14/04/2008] FF8AEEECA5152AE05FFD19A38F271CB8
C:\WINDOWS\inf\mdmgl004.inf --a---- 3142006 bytes [10:00 14/04/2008] [10:00 14/04/2008] E918CC056E06FAAEA0659FF528E4B187
C:\WINDOWS\inf\mdmgl005.inf --a---- 94054 bytes [10:00 14/04/2008] [10:00 14/04/2008] EBB072F8C1A34FD6D12266EA5034A60D
C:\WINDOWS\inf\mdmgl006.inf --a---- 152512 bytes [10:00 14/04/2008] [10:00 14/04/2008] C4A1B5196132DA6427C70D06BE7467C8
C:\WINDOWS\inf\mdmgl007.inf --a---- 205372 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5AE01AB6FC630DC3CABAB70CF31519E1
C:\WINDOWS\inf\mdmgl008.inf --a---- 80416 bytes [10:00 14/04/2008] [10:00 14/04/2008] 51917EFB609F0E9D0942E79CC1641C3D
C:\WINDOWS\inf\mdmgl009.inf --a---- 216196 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2A458DEA5C52D4DD5CFEB59450256BDC
C:\WINDOWS\inf\mdmgl010.inf --a---- 110804 bytes [10:00 14/04/2008] [10:00 14/04/2008] 47B7EDD22EA582A2DCCAAD89161D169A
C:\WINDOWS\inf\mdmgsm.inf --a---- 38842 bytes [10:00 14/04/2008] [10:00 14/04/2008] E098518FD167B5E23BB8FB3A7B2C07E9
C:\WINDOWS\inf\mdmhaeu.inf --a---- 5016 bytes [10:00 14/04/2008] [10:00 14/04/2008] 55231E0C4383AED99D634CBE3FBC6AB5
C:\WINDOWS\inf\mdmhandy.inf --a---- 66542 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6406AD2C5DDCA414685BFCF67665DE17
C:\WINDOWS\inf\mdmhay2.inf --a---- 101892 bytes [10:00 14/04/2008] [10:00 14/04/2008] 86562B1331EB83B9F4C56CFC0D32B4DC
C:\WINDOWS\inf\mdmhayes.inf --a---- 145734 bytes [10:00 14/04/2008] [10:00 14/04/2008] 09273FC9061B9E0F8DF95E4693FA83FE
C:\WINDOWS\inf\mdminfot.inf --a---- 40474 bytes [10:00 14/04/2008] [10:00 14/04/2008] A570CD59A2E35245ABA89C705EBE7EAB
C:\WINDOWS\inf\mdmintel.inf --a---- 30316 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4CFBDDE5498E29D1E1E81F479301E375
C:\WINDOWS\inf\mdmiodat.inf --a---- 35604 bytes [10:00 14/04/2008] [10:00 14/04/2008] FB693FF871A481ED83D363BCA59A58DA
C:\WINDOWS\inf\mdmisdn.inf --a---- 89924 bytes [10:00 14/04/2008] [10:00 14/04/2008] EB02685F57AB343C83437A01F4307A2F
C:\WINDOWS\inf\MDMJF56E.INF --a---- 28540 bytes [10:00 14/04/2008] [10:00 14/04/2008] A72719AA76615E7B2909DACE4BE81800
C:\WINDOWS\inf\mdmke.inf --a---- 8934 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7C064DF7A4E7E4F3405DEF0A5E0964A5
C:\WINDOWS\inf\mdmkortx.inf --a---- 11424 bytes [10:00 14/04/2008] [10:00 14/04/2008] 880B3170420468415013B1E543CE5179
C:\WINDOWS\inf\mdmlasat.inf --a---- 20674 bytes [10:00 14/04/2008] [10:00 14/04/2008] ABADC9A8F3ED01D0B5A17545B89B5837
C:\WINDOWS\inf\mdmlasno.inf --a---- 46182 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2EFB647AA873E88A804D95C14FE09CA5
C:\WINDOWS\inf\mdmlucnt.inf --a---- 44850 bytes [10:00 14/04/2008] [10:00 14/04/2008] 87E9CF905262E55C0928F15F911CF846
C:\WINDOWS\inf\mdmmc288.inf --a---- 18990 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8AC6E96648E00EC1E8BA642428EA1F0E
C:\WINDOWS\inf\mdmmcd.inf --a---- 10208 bytes [10:00 14/04/2008] [10:00 14/04/2008] 61DC66184466375ABBE5AD21EEC23D76
C:\WINDOWS\inf\mdmmcom.inf --a---- 92150 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5480E9A79FD2070FD78260E6A661DA29
C:\WINDOWS\inf\mdmmct.inf --a---- 72752 bytes [10:00 14/04/2008] [10:00 14/04/2008] 15B3D8BE19809E44EF4675D81C4FA329
C:\WINDOWS\inf\mdmmega.inf --a---- 16904 bytes [10:00 14/04/2008] [10:00 14/04/2008] EAFC26E1EB283508757FC06E0E1C987C
C:\WINDOWS\inf\mdmmetri.inf --a---- 143656 bytes [10:00 14/04/2008] [10:00 14/04/2008] DDDA85E2EE8736C5555AADD9D5D665E3
C:\WINDOWS\inf\mdmmhrtz.inf --a---- 97230 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9FB15235003972430525A36809A275F8
C:\WINDOWS\inf\mdmmhza.inf --a---- 115672 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7A813D1C04D7021E473436DACDEE4B2E
C:\WINDOWS\inf\mdmmhzel.inf --a---- 254556 bytes [10:00 14/04/2008] [10:00 14/04/2008] B7E862CCAE0F20621DACAC896A011975
C:\WINDOWS\inf\mdmmhzk1.inf --a---- 113700 bytes [10:00 14/04/2008] [10:00 14/04/2008] 80B0E6E354FBCC8B3821A74F5A735A45
C:\WINDOWS\inf\mdmminij.inf --a---- 8822 bytes [10:00 14/04/2008] [10:00 14/04/2008] 44224A405CBEFC54B6A57CC12B58574F
C:\WINDOWS\inf\mdmmod.inf --a---- 16722 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6712EE294851E8812340678F9923463A
C:\WINDOWS\inf\mdmmoto.inf --a---- 96032 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9C7AD87CBAA2D5249DCF8488576CBB29
C:\WINDOWS\inf\mdmmoto1.inf --a---- 24444 bytes [10:00 14/04/2008] [10:00 14/04/2008] D5091DDA842953E49462000516DA7894
C:\WINDOWS\inf\mdmmotou.inf --a---- 5716 bytes [10:00 14/04/2008] [10:00 14/04/2008] CE5CDC7CAF63F8424A82B55F23D13423
C:\WINDOWS\inf\mdmmts.inf --a---- 106712 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6686425E813224768F41978A58CC63F8
C:\WINDOWS\inf\mdmneuhs.inf --a---- 23270 bytes [10:00 14/04/2008] [10:00 14/04/2008] DE7544D79F0CAE70417C1677F990717A
C:\WINDOWS\inf\netrtpnt.inf --a---- 9314 bytes [10:00 14/04/2008] [10:00 14/04/2008] E535324866642E5E37AE323378EE0682
C:\WINDOWS\inf\Mdmnis1u.inf --a---- 7974 bytes [10:00 14/04/2008] [10:00 14/04/2008] 340788A89B97A473ADBD86C7C6AD6F23
C:\WINDOWS\inf\netsis.inf --a---- 28784 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8D78149DD7821F9649ECBD40AF0C5AB5
C:\WINDOWS\inf\Mdmnis2u.inf --a---- 8042 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9DDD378626F3720A274B8D9453C12959
C:\WINDOWS\inf\netsk_fp.inf --a---- 35802 bytes [10:00 14/04/2008] [10:00 14/04/2008] ED61212F62024A9895A3F7FD607C40AA
C:\WINDOWS\inf\Mdmnis3t.inf --a---- 8184 bytes [10:00 14/04/2008] [10:00 14/04/2008] 96695FD4F092163E0AB937BB220AFAD3
C:\WINDOWS\inf\netsk98.inf --a---- 15696 bytes [10:00 14/04/2008] [10:00 14/04/2008] FE563A8A16EDDB8866B78B32A61D0046
C:\WINDOWS\inf\Mdmnis5t.inf --a---- 8262 bytes [10:00 14/04/2008] [10:00 14/04/2008] 71FF3BAE18DBAD79CEF74D3D7D07B930
C:\WINDOWS\inf\mdmnokia.inf --a---- 11810 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3DA9FDCC5068B74F71F8BE2C132A080F
C:\WINDOWS\inf\mdmnova.inf --a---- 23232 bytes [10:00 14/04/2008] [10:00 14/04/2008] 789ECBED516808E0452D68972B5EA739
C:\WINDOWS\inf\mdmntt1.INF --a---- 12688 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8F3B4759FB14CC2C47F3783BAF3EB1AF
C:\WINDOWS\inf\mdmnttd2.inf --a---- 24688 bytes [10:00 14/04/2008] [10:00 14/04/2008] 14A70A1E689A7B563F926FAA659D489B
C:\WINDOWS\inf\mdmnttd6.inf --a---- 24334 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7A238E5C426099A78DB9DD751E7C433D
C:\WINDOWS\inf\mdmnttme.INF --a---- 9116 bytes [10:00 14/04/2008] [10:00 14/04/2008] 022BCD6353CA3096814FC68BFDFB6E62
C:\WINDOWS\inf\mdmnttp.inf --a---- 16026 bytes [10:00 14/04/2008] [10:00 14/04/2008] 78669E3112B9CE062E691CA078A03DB3
C:\WINDOWS\inf\mdmnttp2.inf --a---- 17224 bytes [10:00 14/04/2008] [10:00 14/04/2008] 57AAC0B70D40703DF3788AADF1498B5B
C:\WINDOWS\inf\mdmnttte.inf --a---- 8342 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6927B58CBF6D28FB7012E3D9FE8B7BC3
C:\WINDOWS\inf\mdmolic.inf --a---- 16878 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0E3F25E64F084B40644A791F9F34FCC6
C:\WINDOWS\inf\mdmomrn3.inf --a---- 142810 bytes [10:00 14/04/2008] [10:00 14/04/2008] E79284299FB0BFF20CD2B0EF4AD8C27B
C:\WINDOWS\inf\mdmoptn.inf --a---- 9084 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4C73C907FEB06889EBD0FDDD59A5107C
C:\WINDOWS\inf\mdmosi.inf --a---- 63112 bytes [10:00 14/04/2008] [10:00 14/04/2008] B609CD702FF870C9D60F796416DD23DC
C:\WINDOWS\inf\mdmpace.inf --a---- 35954 bytes [10:00 14/04/2008] [10:00 14/04/2008] 74DA4F3FBB9CCF65F35136D601AABC3C
C:\WINDOWS\inf\mdmpbit.inf --a---- 5002 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4E139CC60F736206D8A12831BE48A3A3
C:\WINDOWS\inf\mdmpenr.inf --a---- 111014 bytes [10:00 14/04/2008] [10:00 14/04/2008] 620946A7C01AA1CD7780C164730ED02E
C:\WINDOWS\inf\mdmpin.inf --a---- 21154 bytes [10:00 14/04/2008] [10:00 14/04/2008] B7E1DEF7BB9AB0C76210EC7B878B2B2E
C:\WINDOWS\inf\mdmpn1.inf --a---- 6376 bytes [10:00 14/04/2008] [10:00 14/04/2008] 05C834CBB5AAC69FC4A3C8DE7F2AF982
C:\WINDOWS\inf\mdmpp.inf --a---- 75316 bytes [10:00 14/04/2008] [10:00 14/04/2008] 55AFFDFF7820732DADE97CE430E0AC72
C:\WINDOWS\inf\mdmpsion.inf --a---- 15240 bytes [10:00 14/04/2008] [10:00 14/04/2008] D794ACE3BFAC300499B3D5F3589C4AA6
C:\WINDOWS\inf\mdmracal.inf --a---- 103114 bytes [10:00 14/04/2008] [10:00 14/04/2008] BF81E3B6230BD647455E436B27E6798F
C:\WINDOWS\inf\mdmrock.inf --a---- 26358 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0C246EE84FC7C02F020C43341E18427E
C:\WINDOWS\inf\mdmrock3.inf --a---- 81620 bytes [10:00 14/04/2008] [10:00 14/04/2008] F36ECCFD5CCD89A7296F0E7C085C4181
C:\WINDOWS\inf\mdmrock4.inf --a---- 91204 bytes [10:00 14/04/2008] [10:00 14/04/2008] F8585E688BBE4F8EFFCCFFCF6E4CCB3B
C:\WINDOWS\inf\mdmrock5.inf --a---- 158258 bytes [10:00 14/04/2008] [10:00 14/04/2008] 53CB81D091EF167838CCDD42AEC3BB63
C:\WINDOWS\inf\mdmsier.inf --a---- 53322 bytes [10:00 14/04/2008] [10:00 14/04/2008] 38605C784CEB0410635456839BA91EDE
C:\WINDOWS\inf\mdmsmart.inf --a---- 13214 bytes [10:00 14/04/2008] [10:00 14/04/2008] 366E3E63F9118C76F42A1881514AD44D
C:\WINDOWS\inf\mdmsonyu.inf --a---- 98426 bytes [10:00 14/04/2008] [10:00 14/04/2008] 53C762C55D370B749345E143505DE8D7
C:\WINDOWS\inf\mdmspq28.inf --a---- 82380 bytes [10:00 14/04/2008] [10:00 14/04/2008] D6716D6DEF2A8A65279CAC2005F90675
C:\WINDOWS\inf\mdmsetup.inf --a---- 1300 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4BFF44E2707AA810C73C2C58EF834419
C:\WINDOWS\inf\mdmsiil6.INF --a---- 27870 bytes [10:00 14/04/2008] [10:00 14/04/2008] 511C362129B4465ABCC6CB6A01C0C3D9
C:\WINDOWS\inf\mdmsii64.INF --a---- 27540 bytes [10:00 14/04/2008] [10:00 14/04/2008] 32339651D8227344A7D378AB51DA4EFC
C:\WINDOWS\inf\mdmsun1.inf --a---- 10054 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5781B9BD1C9C1AA4AB77C077FC9A929A
C:\WINDOWS\inf\mdmsun2.inf --a---- 43096 bytes [10:00 14/04/2008] [10:00 14/04/2008] 67F517029B56CE9A7FB76CBA00FD48D4
C:\WINDOWS\inf\mdmsupr3.inf --a---- 59852 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1A23310330C001E9A16DE3712FB84F4B
C:\WINDOWS\inf\mdmsupra.inf --a---- 233438 bytes [10:00 14/04/2008] [10:00 14/04/2008] C1064E96A0685C28E57CDF74807B5E65
C:\WINDOWS\inf\mdmtdk.inf --a---- 91762 bytes [10:00 14/04/2008] [10:00 14/04/2008] C0B39539167BDBCE727E37328ED56C62
C:\WINDOWS\inf\mdmtdkj2.inf --a---- 32364 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3E36F940F1A916AFF15BB5399FE8D475
C:\WINDOWS\inf\mdmtdkj3.inf --a---- 36646 bytes [10:00 14/04/2008] [10:00 14/04/2008] F4C65C6827DAA10F915B8B6EE294E6A5
C:\WINDOWS\inf\mdmtdkj4.inf --a---- 26440 bytes [10:00 14/04/2008] [10:00 14/04/2008] 84F516C6468B9DCFE467985899C9EA7C
C:\WINDOWS\inf\mdmtdkj5.inf --a---- 36082 bytes [10:00 14/04/2008] [10:00 14/04/2008] 195248CFA792C5245281D051E9DFA1FE
C:\WINDOWS\inf\mdmtdkj6.inf --a---- 19784 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7754D0DE4E0B4FFC81D5486A22261677
C:\WINDOWS\inf\mdmtdkj7.inf --a---- 25682 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3DAC3DD85EC07C2092B2F21FBB2D0A6E
C:\WINDOWS\inf\mdmtexas.inf --a---- 18844 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1A6922EF9EF425EF0739C843D19D5D7B
C:\WINDOWS\inf\mdmti.inf --a---- 71808 bytes [10:00 14/04/2008] [10:00 14/04/2008] B74AFB28E8DB318E4E03E9FAD2F7BCB1
C:\WINDOWS\inf\mdmtosh.inf --a---- 67784 bytes [10:00 14/04/2008] [10:00 14/04/2008] A0ACF02FECEF930516F53FE1EAF79AA7
C:\WINDOWS\inf\mdmtron.inf --a---- 27114 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3B8150A119864F904441A207A1A58A6B
C:\WINDOWS\inf\mdmusrf.inf --a---- 6066 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5A26CB7451F21CBB8C246E5FC5D5F4DB
C:\WINDOWS\inf\mdmusrg.inf --a---- 24424 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1B7C951CC7CDD17707BAFBA223F6450E
C:\WINDOWS\inf\mdmusrgl.inf --a---- 114730 bytes [10:00 14/04/2008] [10:00 14/04/2008] F2A744073FC331FE46E5502673190ED7
C:\WINDOWS\inf\mdmusrsp.inf --a---- 7474 bytes [10:00 14/04/2008] [10:00 14/04/2008] E4EA44A3330D2AB19741B3968BE7E9FF
C:\WINDOWS\inf\mdmvdot.inf --a---- 4848 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9FAD3C07D687B85A82D90E9066468DB7
C:\WINDOWS\inf\mdmwhql0.inf --a---- 261178 bytes [10:00 14/04/2008] [10:00 14/04/2008] A134DF112C288A1A19A3F7F6DBC71F7D
C:\WINDOWS\inf\mdmx5560.inf --a---- 75418 bytes [10:00 14/04/2008] [10:00 14/04/2008] B4944B60C168012064B579AEDCE61E3F
C:\WINDOWS\inf\mdmzoom.inf --a---- 216004 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1C8C764BE81B7B0F088D70C1DF212CC3
C:\WINDOWS\inf\mdmzyp.inf --a---- 105114 bytes [10:00 14/04/2008] [10:00 14/04/2008] 33E5ACE4A3507F9AF2330B5E3EE0AF1E
C:\WINDOWS\inf\mdmzyxel.inf --a---- 160840 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9F36A2F53FBE12992751507875C4C929
C:\WINDOWS\inf\mdmzyxlg.inf --a---- 207850 bytes [10:00 14/04/2008] [10:00 14/04/2008] 61B4858F6915F79022BA534AEC807C28
C:\WINDOWS\inf\memcard.inf --a---- 26552 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0A310B7A1292B3E274EAF2DF048FF7B1
C:\WINDOWS\inf\memstpci.inf --a---- 4518 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4B538031B88CB7EE8F60F2ACC86E566F
C:\WINDOWS\inf\mf.inf --a---- 2644 bytes [10:00 14/04/2008] [10:00 14/04/2008] F379D7D8113BB7B70CCCBB73D983E623
C:\WINDOWS\inf\mfsocket.inf --a---- 9374 bytes [10:00 14/04/2008] [10:00 14/04/2008] B9C605EFAD33737D2E7FD4BB2DA5FA9D
C:\WINDOWS\inf\mfsupra.inf --a---- 4790 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1336A126B613EA8CAC94E7767391EED1
C:\WINDOWS\inf\minioc.inf --a---- 1264 bytes [10:00 14/04/2008] [10:00 14/04/2008] D8810DB2D87A79532F4AD3FD71FDFDE0
C:\WINDOWS\inf\modemcsa.inf --a---- 8772 bytes [10:00 14/04/2008] [10:00 14/04/2008] 54DB48D6DE56F19628BF8CBC6C01DD2D
C:\WINDOWS\inf\monitor.inf --a---- 104272 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3D8F644506008C053891BB044BC4A010
C:\WINDOWS\inf\monitor2.inf --a---- 95462 bytes [10:00 14/04/2008] [10:00 14/04/2008] A388689C944CF9E523FEF26F6ACBA8CC
C:\WINDOWS\inf\monitor3.inf --a---- 83886 bytes [10:00 14/04/2008] [10:00 14/04/2008] 28D5152705559E5B2DD3CE0C1F6FCE02
C:\WINDOWS\inf\monitor4.inf --a---- 80198 bytes [10:00 14/04/2008] [10:00 14/04/2008] B761A4FBF9B11599214F029B32E6A598
C:\WINDOWS\inf\monitor5.inf --a---- 121272 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0C9CFE6D503066FB7C568B321C7B4134
C:\WINDOWS\inf\monitor6.inf --a---- 91412 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6FDED80C6D34E0953C651F8EA91C0727
C:\WINDOWS\inf\monitor7.inf --a---- 80894 bytes [10:00 14/04/2008] [10:00 14/04/2008] 661C37649E350810A7AF6FC90BAACAD5
C:\WINDOWS\inf\monitor8.inf --a---- 105402 bytes [10:00 14/04/2008] [10:00 14/04/2008] D95599AECC36F16E343F51BE24E073A7
C:\WINDOWS\inf\mqsysoc.inf --a---- 660 bytes [10:00 14/04/2008] [10:00 14/04/2008] E96AD19094C5C620F14D5E27F96098B4
C:\WINDOWS\inf\mscpqpa1.inf --a---- 3418 bytes [10:00 14/04/2008] [10:00 14/04/2008] F73E2D9ECE76FB1E67F458CA9AE4705C
C:\WINDOWS\inf\msdv.inf --a---- 62282 bytes [10:00 14/04/2008] [10:00 14/04/2008] 780404E478B2DDAA836AC7A777526AF8
C:\WINDOWS\inf\msinfo32.inf --a---- 7374 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0FC5BC1910DA56619025EABEB8205452
C:\WINDOWS\inf\msmouse.inf --a---- 63804 bytes [10:00 14/04/2008] [10:00 14/04/2008] A9D523BFBEFEE8D3564F5DA55B6F0740
C:\WINDOWS\inf\msmqocm.inf --a---- 13208 bytes [10:00 14/04/2008] [10:00 14/04/2008] 285F4386281F07A3B0F6E46B10183A85
C:\WINDOWS\inf\msmscsi.inf --a---- 39844 bytes [10:00 14/04/2008] [10:00 14/04/2008] E043DA8AF2614C96B694207A527E467B
C:\WINDOWS\inf\msmusb.inf --a---- 16308 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9AFBC46D3F04F11CCD1CCF80803E864A
C:\WINDOWS\inf\msnike.inf --a---- 3694 bytes [10:00 14/04/2008] [10:00 14/04/2008] D5EB1FDEDEEBA72ABBE4F942809DFB0A
C:\WINDOWS\inf\msports.inf --a---- 38740 bytes [10:00 14/04/2008] [10:00 14/04/2008] 224E522D53424BF9D86ADD9DA94BBFDA
C:\WINDOWS\inf\msrio8.inf --a---- 3858 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1FABF8F768914E4CBEB555ED01F05639
C:\WINDOWS\inf\msrio.inf --a---- 3864 bytes [10:00 14/04/2008] [10:00 14/04/2008] AA5A8FC9203E0794A0E3A51E56914FCE
C:\WINDOWS\inf\mstask.inf --a---- 13104 bytes [10:00 14/04/2008] [10:00 14/04/2008] D9179CC55801DC49CD013EF2EB91C265
C:\WINDOWS\inf\mtxvideo.inf --a---- 6202 bytes [10:00 14/04/2008] [10:00 14/04/2008] 99BB953B3D8C62F733194DF2D41EB83D
C:\WINDOWS\inf\multiprt.inf --a---- 4786 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8CC03BE8C764EF0F25B6982CBDAB1E16
C:\WINDOWS\inf\ndisuio.inf --a---- 4938 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6F090046E6B98066A464E669D33F8EA6
C:\WINDOWS\inf\net1394.inf --a---- 4620 bytes [10:00 14/04/2008] [10:00 14/04/2008] A3B66F9A0E9DD0D8633A94AC599F9B95
C:\WINDOWS\inf\net21x4.inf --a---- 45010 bytes [10:00 14/04/2008] [10:00 14/04/2008] BD88454B273582A48E881B73D0D3EE95
C:\WINDOWS\inf\net5515n.inf --a---- 7152 bytes [10:00 14/04/2008] [10:00 14/04/2008] B7616363A800F443560F14748EACB146
C:\WINDOWS\inf\netana.inf --a---- 14390 bytes [10:00 14/04/2008] [10:00 14/04/2008] BEAB738E7386080B0417B73641BEA97D
C:\WINDOWS\inf\netauni.inf --a---- 3484 bytes [10:00 14/04/2008] [10:00 14/04/2008] B147FE63C876F8DA8EF070BB67534A73
C:\WINDOWS\inf\netbrdgm.inf --a---- 2646 bytes [10:00 14/04/2008] [10:00 14/04/2008] 678D8FF24ABED785068A4DB877FDFDE3
C:\WINDOWS\inf\netbrdgs.inf --a---- 2194 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3E2E70A12A4FD6DA3B6A869C5E28C0AD
C:\WINDOWS\inf\netcis.inf --a---- 2130 bytes [10:00 14/04/2008] [10:00 14/04/2008] 19F33F6393CBCED44826446945B4C08A
C:\WINDOWS\inf\netclass.inf --a---- 2566 bytes [10:00 14/04/2008] [10:00 14/04/2008] 922F2FEBDD6B387E4A853C62711DB86F
C:\WINDOWS\inf\netdav.inf --a---- 7844 bytes [10:00 14/04/2008] [10:00 14/04/2008] F2DBB206EA80A2C4ED087D920EBC3CDF
C:\WINDOWS\inf\netdefxa.inf --a---- 9518 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1E4D93863FD06792835C75EE0F73CE1E
C:\WINDOWS\inf\netdgdxb.inf --a---- 116582 bytes [10:00 14/04/2008] [10:00 14/04/2008] 59809195DED12CE6FC8DBF091F2262CB
C:\WINDOWS\inf\netel90a.inf --a---- 14250 bytes [10:00 14/04/2008] [10:00 14/04/2008] B17F14AAFFD28B7D7FD253D7D933F7AB
C:\WINDOWS\inf\netel90b.inf --a---- 25804 bytes [10:00 14/04/2008] [10:00 14/04/2008] E1F14DE06E0117275BD52D78A8BFCFDA
C:\WINDOWS\inf\netepvcm.inf --a---- 5224 bytes [10:00 14/04/2008] [10:00 14/04/2008] 54309DB016CC8628568DA5ADDBD155BF
C:\WINDOWS\inf\netepvcp.inf --a---- 4270 bytes [10:00 14/04/2008] [10:00 14/04/2008] DCCD9859C631EBD1364D5C9A70E7CC4C
C:\WINDOWS\inf\netfore.inf --a---- 6254 bytes [10:00 14/04/2008] [10:00 14/04/2008] 79FC23694E0E82DB8C4DE2EAA90FDB1D
C:\WINDOWS\inf\netgpc.inf --a---- 2216 bytes [10:00 14/04/2008] [10:00 14/04/2008] 48665A2A873107EB0AC8BD91E19D53A2
C:\WINDOWS\inf\netias.inf --a---- 7112 bytes [10:00 14/04/2008] [10:00 14/04/2008] BEA2FA3C23E05586D85042CAAA59D87F
C:\WINDOWS\inf\netiprip.inf --a---- 3788 bytes [10:00 14/04/2008] [10:00 14/04/2008] 732932B5BB194A27F452D3307B301D56
C:\WINDOWS\inf\netirda.inf --a---- 9026 bytes [10:00 14/04/2008] [10:00 14/04/2008] A619ADB364B20B783B244CFAB1954F56
C:\WINDOWS\inf\netirsir.inf --a---- 30524 bytes [10:00 14/04/2008] [10:00 14/04/2008] A95C502B78654002C2CEDFCAA3BD5871
C:\WINDOWS\inf\netlanem.inf --a---- 2386 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9CBE939269BB8CB2954C6B402BF59A7E
C:\WINDOWS\inf\netlanep.inf --a---- 3656 bytes [10:00 14/04/2008] [10:00 14/04/2008] 125F19C5CA4AAC9776E60615DA9B77CE
C:\WINDOWS\inf\netloop.inf --a---- 6000 bytes [10:00 14/04/2008] [10:00 14/04/2008] D27E9A97C0A33F280E49B8E7437E701C
C:\WINDOWS\inf\netlpd.inf --a---- 7850 bytes [10:00 14/04/2008] [10:00 14/04/2008] E3D5477B50D8CE756EC7BB5349BF6E29
C:\WINDOWS\inf\netmadge.inf --a---- 44310 bytes [10:00 14/04/2008] [10:00 14/04/2008] 160DA8B7EC5B3F953993487A4FC9FFF0
C:\WINDOWS\inf\netnb.inf --a---- 3920 bytes [10:00 14/04/2008] [10:00 14/04/2008] 34464DD905CDA0CE0A5AE247683B7CD2
C:\WINDOWS\inf\netnovel.inf --a---- 13340 bytes [10:00 14/04/2008] [10:00 14/04/2008] B9AE9BDF55C72552EB2DB2D0927F4C34
C:\WINDOWS\inf\netnwcli.inf --a---- 8840 bytes [10:00 14/04/2008] [10:00 14/04/2008] 96768EB83FF861B4EB5FBC33CE1A6877
C:\WINDOWS\inf\netnwlnk.inf --a---- 26552 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4632632948E55AEC678E4547F3CC90CC
C:\WINDOWS\inf\netpsa.inf --a---- 2628 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3C3E9DDCA2B3B02D39D1F2A7645DF6D9
C:\WINDOWS\inf\netpschd.inf --a---- 3732 bytes [10:00 14/04/2008] [10:00 14/04/2008] 313DFBAC059B6030C9A0AD3F48999D2D
C:\WINDOWS\inf\netrasa.inf --a---- 35256 bytes [10:00 14/04/2008] [10:00 14/04/2008] BC999D2C5723FE665036E8B15A39BBD7
C:\WINDOWS\inf\netrast.inf --a---- 11816 bytes [10:00 14/04/2008] [10:00 14/04/2008] 78786A87CE345FCAF943625C8B250C3D
C:\WINDOWS\inf\netrsvp.inf --a---- 6504 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5EF5B96C6D8FFC70B9B53D4B968BE2F8
C:\WINDOWS\inf\netrwan.inf --a---- 5040 bytes [10:00 14/04/2008] [10:00 14/04/2008] 521C28F7030D9FA8115366F57C94C269
C:\WINDOWS\inf\netsap.inf --a---- 4862 bytes [10:00 14/04/2008] [10:00 14/04/2008] F66CA3066CD875112C4570CA190F63E8
C:\WINDOWS\inf\netserv.inf --a---- 6872 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2ECC9814B723F76F58421D6D7B36A0AC
C:\WINDOWS\inf\netsnmp.inf --a---- 23456 bytes [10:00 14/04/2008] [10:00 14/04/2008] 81A6D85C1AF1E5518F06302B71B30178
C:\WINDOWS\inf\nettpsmp.inf --a---- 9544 bytes [10:00 14/04/2008] [10:00 14/04/2008] 45FDA34EA958FDDA5B882CB07BA2DF43
C:\WINDOWS\inf\netupnp.inf --a---- 1680 bytes [10:00 14/04/2008] [10:00 14/04/2008] 329E69DBE8808841A5024A7C7D9416AA
C:\WINDOWS\inf\ntgrip.inf --a---- 4672 bytes [10:00 14/04/2008] [10:00 14/04/2008] 59F51802F84E6648DE81E1B0A0F4796D
C:\WINDOWS\inf\optional.inf --a---- 14566 bytes [10:00 14/04/2008] [10:00 14/04/2008] 77A333E9D0FAB0C701D740CF0DDF2BA9
C:\WINDOWS\inf\ovcam.inf --a---- 29714 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5323383D79895FFC28028897A201F54C
C:\WINDOWS\inf\ovcomp.inf --a---- 3458 bytes [10:00 14/04/2008] [10:00 14/04/2008] DB51475A75EA725EEDBD910550DEDC29
C:\WINDOWS\inf\ovsound.inf --a---- 11532 bytes [10:00 14/04/2008] [10:00 14/04/2008] 354F98C34BFC83DD3F986B1AA7CF7676
C:\WINDOWS\inf\pcmcia.inf --a---- 40664 bytes [10:00 14/04/2008] [10:00 14/04/2008] 93BB81294C7B66872647AC9485AD7090
C:\WINDOWS\inf\perm2.inf --a---- 12264 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5EB280D845B3A3E89D28396C29A24195
C:\WINDOWS\inf\perm3.inf --a---- 8850 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8F686C1631CE4A3FF159B4B9DC1EFBD2
C:\WINDOWS\inf\phdsext.inf --a---- 21714 bytes [10:00 14/04/2008] [10:00 14/04/2008] C7663D6176B3D9BDD9833C0C9AB85B8F
C:\WINDOWS\inf\phil1vid.inf --a---- 8310 bytes [10:00 14/04/2008] [10:00 14/04/2008] AD8BA6607E06972D5CABE80C973746B9
C:\WINDOWS\inf\phil2vid.inf --a---- 16874 bytes [10:00 14/04/2008] [10:00 14/04/2008] 86CAA601259CBA7DF7EC2380ADC37A7B
C:\WINDOWS\inf\phildec.inf --a---- 22026 bytes [10:00 14/04/2008] [10:00 14/04/2008] BB301CBACD847C11DBB3256455CE7327
C:\WINDOWS\inf\philtune.inf --a---- 13824 bytes [10:00 14/04/2008] [10:00 14/04/2008] A447903BB130AEF846542147F4FA8025
C:\WINDOWS\inf\pinball.inf --a---- 7082 bytes [10:00 14/04/2008] [10:00 14/04/2008] E1A98166A6E27D435988102BE1AC8CED
C:\WINDOWS\inf\pmxmcro.inf --a---- 22338 bytes [10:00 14/04/2008] [10:00 14/04/2008] FD81955E8DCFF802783B2ABB7E7F1248
C:\WINDOWS\inf\printupg.inf --a---- 37366 bytes [10:00 14/04/2008] [10:00 14/04/2008] 460034B35429950DBF8940BB73DFA902
C:\WINDOWS\inf\prtupg9x.inf --a---- 137578 bytes [10:00 14/04/2008] [10:00 14/04/2008] 71863AC2B83BB22679C2DF3447B841E2
C:\WINDOWS\inf\ptpusb.inf --a---- 7222 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7D30D44A8842F7272DCCFD0B83B05297
C:\WINDOWS\inf\ricoh.inf --a---- 20834 bytes [10:00 14/04/2008] [10:00 14/04/2008] CBA234062BC1F136E15DDA97269BDCA8
C:\WINDOWS\inf\rootau.inf --a---- 1734 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6C14BABF7E99E621772B7507F6E9B7F3
C:\WINDOWS\inf\sapi5.inf --a---- 175448 bytes [10:00 14/04/2008] [10:00 14/04/2008] 24980397776C4EEBB4A07BF38B4DCCF0
C:\WINDOWS\inf\sbp2.inf --a---- 3616 bytes [10:00 14/04/2008] [10:00 14/04/2008] FA7BFF5D1AD2F18F9ED395ECFFCB6F9C
C:\WINDOWS\inf\scsidev.inf --a---- 44906 bytes [10:00 14/04/2008] [10:00 14/04/2008] 06529959D36B66B11CE147A0A9E80960
C:\WINDOWS\inf\sdwndr2k.inf --a---- 48324 bytes [10:00 14/04/2008] [10:00 14/04/2008] B16DC768C7F6A4E85AD4023289E3A7F3
C:\WINDOWS\inf\secdrv.inf --a---- 1470 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6AF24AF04C61E744385FD8604A71D09E
C:\WINDOWS\inf\sonypvu1.inf --a---- 2996 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7048A2664E69FB0E9CECF2403492611E
C:\WINDOWS\inf\sr.inf --a---- 10272 bytes [10:00 14/04/2008] [10:00 14/04/2008] 308E6973D9034BBCCF9B437AFDC6A665
C:\WINDOWS\inf\srchasst.inf --a---- 3500 bytes [10:00 14/04/2008] [10:00 14/04/2008] C6338C8817B130D0BE6ABAE08B7B4954
C:\WINDOWS\inf\srusbusd.inf --a---- 10494 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7AEC98AE2C50125567B460575A24B149
C:\WINDOWS\inf\sti.inf --a---- 34820 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2DA1EA9FDE1083A059BE52B28244EA9A
C:\WINDOWS\inf\stillcam.inf --a---- 114344 bytes [10:00 14/04/2008] [10:00 14/04/2008] 37CCE383ABD30C286330942A84D875F7
C:\WINDOWS\inf\svcpack.inf --a---- 276 bytes [10:00 14/04/2008] [10:00 14/04/2008] 266045361CFC76897F09FF623F5DD271
C:\WINDOWS\inf\syscomp.inf --a---- 894 bytes [10:00 14/04/2008] [10:00 14/04/2008] F965571F60A620E0307CF0212BAABC5A
C:\WINDOWS\inf\tsbvcap.inf --a---- 7736 bytes [10:00 14/04/2008] [10:00 14/04/2008] 05603D7B05F15C4F4E039F0417CD35FA
C:\WINDOWS\inf\tshoot.inf --a---- 28682 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1F80DA652F37BBBAF2EF07DD88A6540D
C:\WINDOWS\inf\umax.inf --a---- 188686 bytes [10:00 14/04/2008] [10:00 14/04/2008] 702F6BA969F02225628BDF6ABB95F709
C:\WINDOWS\inf\umaxpp.inf --a---- 8890 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3BF913398467CBF2443E4AF32364157A
C:\WINDOWS\inf\unknown.inf --a---- 2828 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9686ABF1B595A7B76CF95737A728351C
C:\WINDOWS\inf\usb.inf --a---- 40950 bytes [10:00 14/04/2008] [10:00 14/04/2008] 436C6C63E77D5F07A2DE7D10D44C9356
C:\WINDOWS\inf\usbprint.inf --a---- 3354 bytes [10:00 14/04/2008] [10:00 14/04/2008] DEE04F12F15ACCEF983966E5C8B872D4
C:\WINDOWS\inf\usbstor.inf --a---- 29652 bytes [10:00 14/04/2008] [10:00 14/04/2008] D48B9981C2372BA9122E7909FD36449A
C:\WINDOWS\inf\vgx.inf --a---- 2604 bytes [10:00 14/04/2008] [10:00 14/04/2008] A8EDF0DAF26C5753062B6D678637CCD0
C:\WINDOWS\inf\volsnap.inf --a---- 2202 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3F7A8FA64009697EBE900CF721C52362
C:\WINDOWS\inf\volume.inf --a---- 2042 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7CC8B6CDEB727EF67885C659CCE8F433
C:\WINDOWS\inf\wab50.inf --a---- 21804 bytes [10:00 14/04/2008] [10:00 14/04/2008] 85AF7045E9D29AF27A12FEB7E24C6C74
C:\WINDOWS\inf\wave.inf --a---- 7196 bytes [10:00 14/04/2008] [10:00 14/04/2008] 67C05CC3B5028CAF8AC96ABD5C73280B
C:\WINDOWS\inf\wbemsnmp.inf --a---- 5216 bytes [10:00 14/04/2008] [10:00 14/04/2008] FC49D692AB5438AE4AD674358C21CEE8
C:\WINDOWS\inf\wdma_avc.inf --a---- 22932 bytes [10:00 14/04/2008] [10:00 14/04/2008] FEA39AC719082C1BC09F33C13B78ECE2
C:\WINDOWS\inf\wdma_azt.inf --a---- 33066 bytes [10:00 14/04/2008] [10:00 14/04/2008] F117672E70FCD4B59671FE189EC61253
C:\WINDOWS\inf\wdma_csc.inf --a---- 44630 bytes [10:00 14/04/2008] [10:00 14/04/2008] D88E5F47EDF3D3ACFFA1BFE91D15E4FB
C:\WINDOWS\inf\wdma_csf.inf --a---- 51272 bytes [10:00 14/04/2008] [10:00 14/04/2008] C16CC9892F2884633572734A43A8263C
C:\WINDOWS\inf\wdma_ctl.inf --a---- 80946 bytes [10:00 14/04/2008] [10:00 14/04/2008] 821463D27C0DF474FA52148AB241244D
C:\WINDOWS\inf\wdma_cwr.inf --a---- 31888 bytes [10:00 14/04/2008] [10:00 14/04/2008] E50EAEFB55894551CD20960C07D55701
C:\WINDOWS\inf\wdma_es2.inf --a---- 152420 bytes [10:00 14/04/2008] [10:00 14/04/2008] A5F184088CCD1085403A4DB1E2793ADF
C:\WINDOWS\inf\wdma_es3.inf --a---- 243856 bytes [10:00 14/04/2008] [10:00 14/04/2008] DE7048AE5461C960A9FCE8930C1B41E6
C:\WINDOWS\inf\wdma_ens.inf --a---- 51640 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1E977202F0B6D2FD56E978BE2FA8ED4B
C:\WINDOWS\inf\wdma_ess.inf --a---- 55296 bytes [10:00 14/04/2008] [10:00 14/04/2008] F5136D12021CACF3A0AFFE73EABF8B2B
C:\WINDOWS\inf\wdma_m2e.inf --a---- 61792 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6243B3B2058398D523C12F709CD9685C
C:\WINDOWS\inf\wdma_neo.inf --a---- 25000 bytes [10:00 14/04/2008] [10:00 14/04/2008] 32D41E2295F61EA6AB8166C837198E3C
C:\WINDOWS\inf\wdma_ne2.inf --a---- 16720 bytes [10:00 14/04/2008] [10:00 14/04/2008] 976496F7279950EFCF56A6730BBF6C99
C:\WINDOWS\inf\wdma_rip.inf --a---- 29458 bytes [10:00 14/04/2008] [10:00 14/04/2008] DD05E5526D01FF569C08F85F5D963C62
C:\WINDOWS\inf\wdma_sis.inf --a---- 48058 bytes [10:00 14/04/2008] [10:00 14/04/2008] A911DE24749631B58114D3A7408D8290
C:\WINDOWS\inf\wdma_usb.inf --a---- 114642 bytes [10:00 14/04/2008] [10:00 14/04/2008] 401CC8DCFBA18D1574DA4BBF563F75E6
C:\WINDOWS\inf\wdma_ym2.inf --a---- 38096 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1D3E69E35184030205AE5C12CB9288AD
C:\WINDOWS\inf\wdma_ymh.inf --a---- 17068 bytes [10:00 14/04/2008] [10:00 14/04/2008] B63E9ADCB05B8FBBC92C69B7BEBF18CD
C:\WINDOWS\inf\wdmaudio.inf --a---- 47344 bytes [10:00 14/04/2008] [10:00 14/04/2008] E93E758B56A5356B9C908B6A30039417
C:\WINDOWS\inf\wdmjoy.inf --a---- 15534 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4EE5D4AE0AF2916640010C90136FC55D
C:\WINDOWS\inf\wsh.inf --a---- 16664 bytes [10:00 14/04/2008] [10:00 14/04/2008] 91578D4E4631FA65F27D673142F2CFEA
C:\WINDOWS\inf\3dfxvs2k.inf --a---- 35360 bytes [10:00 14/04/2008] [10:00 14/04/2008] CB66FE91EF19A4FC2C0F348EEACC7ED3
C:\WINDOWS\inf\adm_mult.inf --a---- 5298 bytes [10:00 14/04/2008] [10:00 14/04/2008] C76226EA280FF716119CE429016719B2
C:\WINDOWS\inf\adm_port.inf --a---- 3268 bytes [10:00 14/04/2008] [10:00 14/04/2008] E66F51A1DDEEB5BC4588307CEF4C59A2
C:\WINDOWS\inf\asynceqn.inf --a---- 14902 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3945CA81C1F7F0A5D3FDAD826FBF556C
C:\WINDOWS\inf\atim128.inf --a---- 51268 bytes [10:00 14/04/2008] [10:00 14/04/2008] AEF7C500BCBD97EC3BC24E0F1E972E20
C:\WINDOWS\inf\atimpab.inf --a---- 64740 bytes [10:00 14/04/2008] [10:00 14/04/2008] 54AC149ECC999F4792598A7093C4FB5B
C:\WINDOWS\inf\atirage3.inf --a---- 6102 bytes [10:00 14/04/2008] [10:00 14/04/2008] D5306DCD683B7DD0C3F4142845513DFA
C:\WINDOWS\inf\avmisdn.inf --a---- 56234 bytes [10:00 14/04/2008] [10:00 14/04/2008] 35EE51EE59F56E18199FF8C3806FA941
C:\WINDOWS\inf\banshee.inf --a---- 6300 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4D6CA8333470FF613A498B84718DE6B2
C:\WINDOWS\inf\ctmaport.inf --a---- 15020 bytes [10:00 14/04/2008] [10:00 14/04/2008] B5836B4F83159EB9B909D9CFE623995B
C:\WINDOWS\inf\divac.inf --a---- 43932 bytes [10:00 14/04/2008] [10:00 14/04/2008] 23CF65535BC689A28CB5B64134BD6E58
C:\WINDOWS\inf\divasrv.inf --a---- 45112 bytes [10:00 14/04/2008] [10:00 14/04/2008] AE6FF426BD666D47F1460A6882233FC6
C:\WINDOWS\inf\dshowext.inf --a---- 7706 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6290795C5DEEBCDBDDEA623058B894DB
C:\WINDOWS\inf\eqnport.inf --a---- 6416 bytes [10:00 14/04/2008] [10:00 14/04/2008] BBB764A26A585D1F68D6D9421189C7AB
C:\WINDOWS\inf\fsvga.inf --a---- 7292 bytes [10:00 14/04/2008] [10:00 14/04/2008] E951F23A10B71838A7CFFC094850E83C
C:\WINDOWS\inf\fsvgaadd.inf --a---- 628 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8379B3A615FADF7A9E6EBB84866FB595
C:\WINDOWS\inf\fsvgadel.inf --a---- 630 bytes [10:00 14/04/2008] [10:00 14/04/2008] 145E39D06E81AB4C7B8E8E996C0917D7
C:\WINDOWS\inf\g200.inf --a---- 7740 bytes [10:00 14/04/2008] [10:00 14/04/2008] C42015DE8EF3202DE1E3D87CC40F15FD
C:\WINDOWS\inf\i740nt5.inf --a---- 5548 bytes [10:00 14/04/2008] [10:00 14/04/2008] A35BC90643936B5327AF9A6200040634
C:\WINDOWS\inf\irdaalif.inf --a---- 8534 bytes [10:00 14/04/2008] [10:00 14/04/2008] D3CA258B921E06685BA997B6AA4549E5
C:\WINDOWS\inf\irtos4mo.inf --a---- 21316 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9FFC8BFCF876AA696ADCA13E96A439B1
C:\WINDOWS\inf\mdm3cpcm.inf --a---- 51878 bytes [10:00 14/04/2008] [10:00 14/04/2008] 60305A9D3BCC2CAADB22F7550F116B47
C:\WINDOWS\inf\mdm3mini.inf --a---- 111530 bytes [10:00 14/04/2008] [10:00 14/04/2008] 982C0870364308BDC7DE62FED7209DA3
C:\WINDOWS\inf\mdm656n5.inf --a---- 61870 bytes [10:00 14/04/2008] [10:00 14/04/2008] 44CE8A2D70654A61EBC90B58DD19175A
C:\WINDOWS\inf\mdmbcmsm.inf --a---- 96342 bytes [10:00 14/04/2008] [10:00 14/04/2008] 35CCA4FA4E4E536BC3BAC237FFA189C4
C:\WINDOWS\inf\mdmcxsft.inf --a---- 1241462 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7CDF8628CD0874E307B1FCBAE5714242
C:\WINDOWS\inf\mdmdigi.inf --a---- 38252 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2FFAA7F6A7F35E38B5576D3DCC0C165B
C:\WINDOWS\inf\mdmess.inf --a---- 87952 bytes [10:00 14/04/2008] [10:00 14/04/2008] DCBA4ABE75B77AD4EEA90B98838E2E49
C:\WINDOWS\inf\mdmltleo.inf --a---- 97962 bytes [10:00 14/04/2008] [10:00 14/04/2008] 62166635086ED9C238D929CCE71BCD80
C:\WINDOWS\inf\mdmltsft.inf --a---- 99114 bytes [10:00 14/04/2008] [10:00 14/04/2008] 59CA9897AA8B18F103598CD140919645
C:\WINDOWS\inf\mdmosice.inf --a---- 58058 bytes [10:00 14/04/2008] [10:00 14/04/2008] 82E5E9A95F2D5147B5D0AF464D7C42A3
C:\WINDOWS\inf\mdmpctel.inf --a---- 76360 bytes [10:00 14/04/2008] [10:00 14/04/2008] B297A0497AC457AD80BF1D547600D21B
C:\WINDOWS\inf\mdmrisa.inf --a---- 4042 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6836F8F7B74488C51324850C669035C6
C:\WINDOWS\inf\mdmrpciw.inf --a---- 3089684 bytes [10:00 14/04/2008] [10:00 14/04/2008] 001F613392F4A82DD2DCF250C5E56010
C:\WINDOWS\inf\mdmsgsml.inf --a---- 3606 bytes [10:00 14/04/2008] [10:00 14/04/2008] 69EFDF2B62995C8DB3A87A06F6EADB32
C:\WINDOWS\inf\mdmsgsmu.inf --a---- 27966 bytes [10:00 14/04/2008] [10:00 14/04/2008] 94E8F0B1B4CEE012EEAC676BABC9D6A3
C:\WINDOWS\inf\mdmxircc.inf --a---- 97882 bytes [10:00 14/04/2008] [10:00 14/04/2008] 254AEE11A0BA22F858DDD0D65C60B5AB
C:\WINDOWS\inf\mdmxirmp.inf --a---- 93676 bytes [10:00 14/04/2008] [10:00 14/04/2008] A6C6E20EBCC3D4BD01D957C7BC1FD919
C:\WINDOWS\inf\mfcem28.inf --a---- 4466 bytes [10:00 14/04/2008] [10:00 14/04/2008] CEAD9B328EE71C19D154701E1F9F9FB5
C:\WINDOWS\inf\mfcem33.inf --a---- 4164 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0B720453F7BF3BB233DBD859F17CFA9F
C:\WINDOWS\inf\mfcem56.inf --a---- 21126 bytes [10:00 14/04/2008] [10:00 14/04/2008] 075341663069494BF51D6DF9EB4E5A1A
C:\WINDOWS\inf\mff56n5.inf --a---- 7882 bytes [10:00 14/04/2008] [10:00 14/04/2008] B974F2C3A291BD8FF025C2013A47222A
C:\WINDOWS\inf\mfmhzn5.inf --a---- 12876 bytes [10:00 14/04/2008] [10:00 14/04/2008] B7E7474D5E541FA60789D763E5CCFE29
C:\WINDOWS\inf\mflm.inf --a---- 9506 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8611DEC77576D9B0D49D298E2A69EDE6
C:\WINDOWS\inf\mflm56.inf --a---- 9512 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5A252009F503A3D436DEAB189E02FFC8
C:\WINDOWS\inf\mfosi5.inf --a---- 12702 bytes [10:00 14/04/2008] [10:00 14/04/2008] C1C6832AE3753D3204C8E369E3CF6798
C:\WINDOWS\inf\mfx56nf.inf --a---- 7034 bytes [10:00 14/04/2008] [10:00 14/04/2008] 17AAD76CFBB97475F09AB745C6EB5F73
C:\WINDOWS\inf\mgau.inf --a---- 6636 bytes [10:00 14/04/2008] [10:00 14/04/2008] 11E377B58E38D90F1164735D8400BE12
C:\WINDOWS\inf\mpsstln.inf --a---- 15230 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7E5242C5B1FDE7943776FC5D58923828
C:\WINDOWS\inf\mwavmdm1.inf --a---- 52266 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3B3B52A6BEE608E3AE57DC7A8225BB21
C:\WINDOWS\inf\mwmbatam.inf --a---- 10164 bytes [10:00 14/04/2008] [10:00 14/04/2008] DC8A6EC21FEED19DCE64CBAF45B98B7F
C:\WINDOWS\inf\mwremove.inf --a---- 17294 bytes [10:00 14/04/2008] [10:00 14/04/2008] EEEB55FDC42B42C054025A8D69801C0D
C:\WINDOWS\inf\mwtpdsp.inf --a---- 113924 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0880671688BBE4A91576F0A481B73CA0
C:\WINDOWS\inf\mxboard.inf --a---- 9386 bytes [10:00 14/04/2008] [10:00 14/04/2008] 31FD46CA398F3649786C8DC425CE5310
C:\WINDOWS\inf\mxport.inf --a---- 8820 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7D6E86DAAB050B155C21D82C1B6AB292
C:\WINDOWS\inf\neo20xx.inf --a---- 22420 bytes [10:00 14/04/2008] [10:00 14/04/2008] 400D1D1BA1086389479FDD396760AA86
C:\WINDOWS\inf\net10.inf --a---- 3236 bytes [10:00 14/04/2008] [10:00 14/04/2008] 091AF8B1DB0CF835CD4B8F0823B9D230
C:\WINDOWS\inf\net3c556.inf --a---- 6442 bytes [10:00 14/04/2008] [10:00 14/04/2008] 066F3784DE33A7C1D7666317A14B26A4
C:\WINDOWS\inf\net3c589.inf --a---- 11626 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3D63BF613BC049DCA66BE81B020802C5
C:\WINDOWS\inf\net3c985.inf --a---- 18164 bytes [10:00 14/04/2008] [10:00 14/04/2008] 51CB0A55EB49406DBE8771A3F67C3A21
C:\WINDOWS\inf\net3sr.inf --a---- 3500 bytes [10:00 14/04/2008] [10:00 14/04/2008] 323916988863FE9826FC6BF97B68CCDD
C:\WINDOWS\inf\net557.inf --a---- 132112 bytes [10:00 14/04/2008] [10:00 14/04/2008] AAC3243095A9467155851E56E291C4C0
C:\WINDOWS\inf\net559ib.inf --a---- 8186 bytes [10:00 14/04/2008] [10:00 14/04/2008] 281E1151CF4E1D8BF0EF3326D35A3E90
C:\WINDOWS\inf\net575nt.inf --a---- 9578 bytes [10:00 14/04/2008] [10:00 14/04/2008] A148A4DEB0645D6CC6CE1E1AB6CDAE90
C:\WINDOWS\inf\net656n5.inf --a---- 8838 bytes [10:00 14/04/2008] [10:00 14/04/2008] B925F7B0ABA42EFFBFA7449FF575A6C0
C:\WINDOWS\inf\net656c5.inf --a---- 6698 bytes [10:00 14/04/2008] [10:00 14/04/2008] 232607D6EF801B4D889B074E9996E4D8
C:\WINDOWS\inf\net713.inf --a---- 7258 bytes [10:00 14/04/2008] [10:00 14/04/2008] B054560483229EDFF5DE968D16219D26
C:\WINDOWS\inf\net83820.inf --a---- 14774 bytes [10:00 14/04/2008] [10:00 14/04/2008] DA401C68EABE4495E9BE50E207E3091C
C:\WINDOWS\inf\net8511.inf --a---- 36800 bytes [10:00 14/04/2008] [10:00 14/04/2008] 153847FABE553B60248B878F3BB149C2
C:\WINDOWS\inf\netali.inf --a---- 5048 bytes [10:00 14/04/2008] [10:00 14/04/2008] A21F8BCD6BF65A88C9A32EFB36D2783E
C:\WINDOWS\inf\netan983.inf --a---- 14100 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8E9FEB3BFABFA78227D076D5F43C8AEA
C:\WINDOWS\inf\netamd.inf --a---- 10894 bytes [10:00 14/04/2008] [10:00 14/04/2008] BEF4318A90E04D7E4D873B0F22A02BE5
C:\WINDOWS\inf\netamd2.inf --a---- 30390 bytes [10:00 14/04/2008] [10:00 14/04/2008] F8180BAF81516DF2AEC7AB367D9D6364
C:\WINDOWS\inf\netambi.inf --a---- 4264 bytes [10:00 14/04/2008] [10:00 14/04/2008] BEFE585F12801050B0E56B8C56C93BC1
C:\WINDOWS\inf\netamdhl.inf --a---- 9946 bytes [10:00 14/04/2008] [10:00 14/04/2008] FE5F7CE41BD90AF1065BCCBEED61C10D
C:\WINDOWS\inf\netasp2k.inf --a---- 12502 bytes [10:00 14/04/2008] [10:00 14/04/2008] 97D7575DB741C55E9CD21C6389E68CBB
C:\WINDOWS\inf\netb57xp.inf --a---- 53656 bytes [10:00 14/04/2008] [10:00 14/04/2008] CE0EAB07778D112D3E7A9C1649EF0E67
C:\WINDOWS\inf\netbcm4p.inf --a---- 5528 bytes [10:00 14/04/2008] [10:00 14/04/2008] FA1BD5D132EA493E447C2FEF176D5E28
C:\WINDOWS\inf\netbcm4u.inf --a---- 5106 bytes [10:00 14/04/2008] [10:00 14/04/2008] CFA8CBB1C7F6881E74A82AA489DD171D
C:\WINDOWS\inf\netbcm4e.inf --a---- 6166 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3026CC7F6EC10F51377A41BDFC824A59
C:\WINDOWS\inf\netbrzw.inf --a---- 13266 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3A7B0956376965A860B2E90C3C66D0F8
C:\WINDOWS\inf\netcicap.inf --a---- 15030 bytes [10:00 14/04/2008] [10:00 14/04/2008] C5C9B3873346D6303B71070F563B2E4A
C:\WINDOWS\inf\netcb325.inf --a---- 22424 bytes [10:00 14/04/2008] [10:00 14/04/2008] E13BA2F36B1D62FEE6DB65E35834310D
C:\WINDOWS\inf\netcbe.inf --a---- 17388 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7275B1EBB48B5153C6C05F62E1BFAF62
C:\WINDOWS\inf\netcb102.inf --a---- 5940 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3D81E140B34B174C90354BD1E2B38B74
C:\WINDOWS\inf\netce2.inf --a---- 10968 bytes [10:00 14/04/2008] [10:00 14/04/2008] A1910525B9C6737F22EF9590A9B98DDF
C:\WINDOWS\inf\netce3.inf --a---- 16538 bytes [10:00 14/04/2008] [10:00 14/04/2008] 37F5D3FD1A6EF6D876A1517A3582925F
C:\WINDOWS\inf\netcem28.inf --a---- 8614 bytes [10:00 14/04/2008] [10:00 14/04/2008] C8DC8A0A269FE98B8B6E164241B2A9B0
C:\WINDOWS\inf\netcem33.inf --a---- 8586 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6F4CA90EB52CB109205D3B435F3004E5
C:\WINDOWS\inf\netcem56.inf --a---- 16822 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6A45254DD928FDA9115447F1379003CA
C:\WINDOWS\inf\netcpqc.inf --a---- 11662 bytes [10:00 14/04/2008] [10:00 14/04/2008] D7CDAD6D745856904E49671522C79C9C
C:\WINDOWS\inf\netcpqg.inf --a---- 26286 bytes [10:00 14/04/2008] [10:00 14/04/2008] 45F11F739D2B242D6FC48376A98A981B
C:\WINDOWS\inf\netcpqi.inf --a---- 24288 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5EB21C81B9F8900530C98F054D45666B
C:\WINDOWS\inf\netcpqmt.inf --a---- 12178 bytes [10:00 14/04/2008] [10:00 14/04/2008] B53B96001A8A3A3F0055353D4E07FCC7
C:\WINDOWS\inf\netctmrk.inf --a---- 10320 bytes [10:00 14/04/2008] [10:00 14/04/2008] 73CFD826D8D9882AC63FB11877C2E818
C:\WINDOWS\inf\netdlh5x.inf --a---- 16374 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9E2696DF119CD9C6B90C127E7A374DA0
C:\WINDOWS\inf\netdf650.inf --a---- 6576 bytes [10:00 14/04/2008] [10:00 14/04/2008] 71B965019D99C025D3F4EA89EF3CAA3E
C:\WINDOWS\inf\netdm.inf --a---- 8990 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3ECB0ABF999FC0469814D27C0C22E490
C:\WINDOWS\inf\net650d.inf --a---- 5962 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5DBF57FF12369EB345AAFF6B68F9E301
C:\WINDOWS\inf\nete1000.inf --a---- 45504 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8D3DC174F2A25FE67525329018A3DCDD
C:\WINDOWS\inf\nete100i.inf --a---- 11716 bytes [10:00 14/04/2008] [10:00 14/04/2008] E98E294CF14D169E0C7B359D68B1D203
C:\WINDOWS\inf\netejxmp.inf --a---- 6956 bytes [10:00 14/04/2008] [10:00 14/04/2008] 34A7DD446353519C97D31F7F7B48E475
C:\WINDOWS\inf\netel515.inf --a---- 6058 bytes [10:00 14/04/2008] [10:00 14/04/2008] CC202565F084C082BB005F8FDC90AE80
C:\WINDOWS\inf\netel574.inf --a---- 11156 bytes [10:00 14/04/2008] [10:00 14/04/2008] A0F8751DE65DFD16937F9A50E4512FCC
C:\WINDOWS\inf\netel5x9.inf --a---- 6094 bytes [10:00 14/04/2008] [10:00 14/04/2008] D1890EA063DFC62C53DD54F83C6F3F22
C:\WINDOWS\inf\netel980.inf --a---- 14300 bytes [10:00 14/04/2008] [10:00 14/04/2008] 05A710D710944FC040DFC2D495F64B0E
C:\WINDOWS\inf\netel99x.inf --a---- 22688 bytes [10:00 14/04/2008] [10:00 14/04/2008] 400D172DC21B613BA2C1F26478C072E8
C:\WINDOWS\inf\netepicn.inf --a---- 9848 bytes [10:00 14/04/2008] [10:00 14/04/2008] 41A3382D1763B5BE9D4FB6C192B65BED
C:\WINDOWS\inf\netepro.inf --a---- 8110 bytes [10:00 14/04/2008] [10:00 14/04/2008] 299F11D65D640B6E920E7C98B07150C7
C:\WINDOWS\inf\netex10.inf --a---- 4930 bytes [10:00 14/04/2008] [10:00 14/04/2008] 55586933C7063FA6381343CE86D00B34
C:\WINDOWS\inf\netf56n5.inf --a---- 7376 bytes [10:00 14/04/2008] [10:00 14/04/2008] A3AD669374C2E90CD0B56A1712094B46
C:\WINDOWS\inf\netfa312.inf --a---- 8980 bytes [10:00 14/04/2008] [10:00 14/04/2008] 378A2CF306972D35C9839AE676AA8AB4
C:\WINDOWS\inf\netfa410.inf --a---- 6088 bytes [10:00 14/04/2008] [10:00 14/04/2008] A481514794B07C40606DA9804BE83208
C:\WINDOWS\inf\netfjvi.inf --a---- 6006 bytes [10:00 14/04/2008] [10:00 14/04/2008] 829A538259249A5664DED846F22B2710
C:\WINDOWS\inf\netfjvj.inf --a---- 5788 bytes [10:00 14/04/2008] [10:00 14/04/2008] 29A52FF2F4601CCC4C420F298127E53A
C:\WINDOWS\inf\netforeh.inf --a---- 6216 bytes [10:00 14/04/2008] [10:00 14/04/2008] 28878B8BAD17C592797568BAE30A9008
C:\WINDOWS\inf\netibm.inf --a---- 25268 bytes [10:00 14/04/2008] [10:00 14/04/2008] C6396A50A017F60A1CB3AE77E78C8B82
C:\WINDOWS\inf\netibm2.inf --a---- 16880 bytes [10:00 14/04/2008] [10:00 14/04/2008] 59CA6DCD93DA6C5FCDB0DFA0AB3DCA26
C:\WINDOWS\inf\netktc.inf --a---- 5724 bytes [10:00 14/04/2008] [10:00 14/04/2008] 58BF5E560DA2E2C2E83397F59AF11B0C
C:\WINDOWS\inf\netlm.inf --a---- 4850 bytes [10:00 14/04/2008] [10:00 14/04/2008] D42246479EA75A589421FACACE5B09CA
C:\WINDOWS\inf\netlm56.inf --a---- 4694 bytes [10:00 14/04/2008] [10:00 14/04/2008] 31B9289E3468C75D0B6CD2CC39911B5D
C:\WINDOWS\inf\netlnev2.inf --a---- 5434 bytes [10:00 14/04/2008] [10:00 14/04/2008] DBC289B7F5A1C766BF5F68836A06EE25
C:\WINDOWS\inf\netmhzn5.inf --a---- 9022 bytes [10:00 14/04/2008] [10:00 14/04/2008] 219096C69DF54746FA82EF4ABE0B38CC
C:\WINDOWS\inf\netnf3.inf --a---- 49080 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0B807EDB5531A84ABA7924FB826EE7A7
C:\WINDOWS\inf\netngr.inf --a---- 10116 bytes [10:00 14/04/2008] [10:00 14/04/2008] E030F363559DCB36481D0D43BDB5500C
C:\WINDOWS\inf\netosi2c.inf --a---- 20206 bytes [10:00 14/04/2008] [10:00 14/04/2008] 39572DE95961F90A04E4957DD0883B0E
C:\WINDOWS\inf\netosi5.inf --a---- 16008 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4DA6BFD73C66B87D7D60A1ADC2AEB7D8
C:\WINDOWS\inf\netpc100.inf --a---- 6472 bytes [10:00 14/04/2008] [10:00 14/04/2008] 314328016B00B6AFD96808C98598367F
C:\WINDOWS\inf\netpnic.inf --a---- 9930 bytes [10:00 14/04/2008] [10:00 14/04/2008] 63994EBEF0A4304692429B3D0DE73EEB
C:\WINDOWS\inf\netpwr2.inf --a---- 12536 bytes [10:00 14/04/2008] [10:00 14/04/2008] F26B57BECF328AEF61608138751BD51D
C:\WINDOWS\inf\netsla30.inf --a---- 4408 bytes [10:00 14/04/2008] [10:00 14/04/2008] CE2E10CFB22ED9348E51E70A3C421D34
C:\WINDOWS\inf\netsmc.inf --a---- 4078 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7A7CC5BBB680F952AE60A44254DE2429
C:\WINDOWS\inf\netsnip.inf --a---- 6972 bytes [10:00 14/04/2008] [10:00 14/04/2008] 943AE5AAADD2C224554F3D0E61B25565
C:\WINDOWS\inf\nettb155.inf --a---- 9286 bytes [10:00 14/04/2008] [10:00 14/04/2008] 19A5E02FF02FFBA912E0F526E0DACD1D
C:\WINDOWS\inf\nettdkb.inf --a---- 6016 bytes [10:00 14/04/2008] [10:00 14/04/2008] BD6013534C3D0248F57F284742D0C254
C:\WINDOWS\inf\nettiger.inf --a---- 13042 bytes [10:00 14/04/2008] [10:00 14/04/2008] 76F8D833998E1398301E036D8CEBAA36
C:\WINDOWS\inf\nettpro.inf --a---- 5766 bytes [10:00 14/04/2008] [10:00 14/04/2008] ED22CE813B93B43CA35F45C6B3A03183
C:\WINDOWS\inf\netvt86.inf --a---- 16856 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7CDC3A0FA545778C631A6BB006E63544
C:\WINDOWS\inf\netw840.inf --a---- 10046 bytes [10:00 14/04/2008] [10:00 14/04/2008] C6B509A59BD795D79F6172F916221540
C:\WINDOWS\inf\netw926.inf --a---- 4604 bytes [10:00 14/04/2008] [10:00 14/04/2008] 91C9C080076A2F23F4B5F2D8E708C15A
C:\WINDOWS\inf\netw940.inf --a---- 4358 bytes [10:00 14/04/2008] [10:00 14/04/2008] 96DD0CCE69654003CE472BD71AAF7D25
C:\WINDOWS\inf\netx500.inf --a---- 24726 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7D1FC4F67D7A22FB4EC64F77584CC939
C:\WINDOWS\inf\netx56n5.inf --a---- 9118 bytes [10:00 14/04/2008] [10:00 14/04/2008] A3D5F3A007705BEDEB0B372EFBFC1FAD
C:\WINDOWS\inf\netxcpq.inf --a---- 9280 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8FE6D3A98DEA0322A136960127B5E482
C:\WINDOWS\inf\ntapm.inf --a---- 3616 bytes [10:00 14/04/2008] [10:00 14/04/2008] 582817C1C4437951BFAA2D588F11F70E
C:\WINDOWS\inf\nv3.inf --a---- 8356 bytes [10:00 14/04/2008] [10:00 14/04/2008] AB9BC6EFD117BC0E8671626BAB8CEADC
C:\WINDOWS\inf\ppa.inf --a---- 4174 bytes [10:00 14/04/2008] [10:00 14/04/2008] F8069507BE3F6710D936E9DF983C5606
C:\WINDOWS\inf\ppa3.inf --a---- 4236 bytes [10:00 14/04/2008] [10:00 14/04/2008] B6ADFA1163BA333E698D1083F7B51E8F
C:\WINDOWS\inf\s3sav3d.inf --a---- 6336 bytes [10:00 14/04/2008] [10:00 14/04/2008] A417B68C9A0E3D91F652235DDECC044F
C:\WINDOWS\inf\s3sav4.inf --a---- 6494 bytes [10:00 14/04/2008] [10:00 14/04/2008] 997A18BD0158520CDEAE846B67262A99
C:\WINDOWS\inf\s3savmx.inf --a---- 6518 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0718CFC27B421CF24B355A93697B346C
C:\WINDOWS\inf\s3trio3d.inf --a---- 4440 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7B37745B90336144967FDE5BC20417E7
C:\WINDOWS\inf\sgiu.inf --a---- 5782 bytes [10:00 14/04/2008] [10:00 14/04/2008] A13A0884E6453D9333CBEFF228843AF9
C:\WINDOWS\inf\sis300i.inf --a---- 7578 bytes [10:00 14/04/2008] [10:00 14/04/2008] 26277B0E51B75AFBEC60334074737B19
C:\WINDOWS\inf\sis6306.inf --a---- 6334 bytes [10:00 14/04/2008] [10:00 14/04/2008] A32E108DC9128E78552E24116C69AEE7
C:\WINDOWS\inf\sisgr.inf --a---- 10900 bytes [10:00 14/04/2008] [10:00 14/04/2008] E13C63473A2E4A67FB0B559E78129D50
C:\WINDOWS\inf\sisv6326.inf --a---- 6206 bytes [10:00 14/04/2008] [10:00 14/04/2008] B686C4D6116F62DA6D76C681C9D10171
C:\WINDOWS\inf\smi.inf --a---- 17898 bytes [10:00 14/04/2008] [10:00 14/04/2008] 46ED7FB585426D9F7FA46B22B196C372
C:\WINDOWS\inf\spx.inf --a---- 29756 bytes [10:00 14/04/2008] [10:00 14/04/2008] C1F48465B5CA0969F78DD389325A17F3
C:\WINDOWS\inf\spxports.inf --a---- 20044 bytes [10:00 14/04/2008] [10:00 14/04/2008] 453D43D95F0F5C4B7AB888DB69D0D78D
C:\WINDOWS\inf\stalport.inf --a---- 5146 bytes [10:00 14/04/2008] [10:00 14/04/2008] 938C3725745171BAF51EA7EC962DAF9F
C:\WINDOWS\inf\swnt.inf --a---- 60104 bytes [10:00 14/04/2008] [10:00 14/04/2008] EDA045E0FA9BB5E4DD9BBB4669282B99
C:\WINDOWS\inf\tgiu.inf --a---- 5640 bytes [10:00 14/04/2008] [10:00 14/04/2008] F565940178E24499721BD57200DC8261
C:\WINDOWS\inf\trid3d.inf --a---- 7220 bytes [10:00 14/04/2008] [10:00 14/04/2008] E2A37526CB0D5E869681842F6C456107
C:\WINDOWS\inf\tridkb.inf --a---- 8090 bytes [10:00 14/04/2008] [10:00 14/04/2008] BD54CE83322DA5609B23419090C4C7A9
C:\WINDOWS\inf\tridxp.inf --a---- 6244 bytes [10:00 14/04/2008] [10:00 14/04/2008] E13B74BE180D0D704D0F28515122F68D
C:\WINDOWS\inf\viafir2k.inf --a---- 9872 bytes [10:00 14/04/2008] [10:00 14/04/2008] C4F0AD146C2AA7B5D1067CEC67F01B43
C:\WINDOWS\inf\wbfirdma.inf --a---- 8322 bytes [10:00 14/04/2008] [10:00 14/04/2008] 96CCAC756CCE65C06BBD970BC95CA4C3
C:\WINDOWS\inf\wceusbsh.inf --a---- 9470 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6C7B4D325AEEFC1B1125441C70E44D24
C:\WINDOWS\inf\wdma10k1.inf --a---- 536760 bytes [10:00 14/04/2008] [10:00 14/04/2008] B385C09BBBB39D0F829F1C4B2A4E15EB
C:\WINDOWS\inf\wdma_aur.inf --a---- 173822 bytes [10:00 14/04/2008] [10:00 14/04/2008] A8511427E795B4906B9F9868BEB14285
C:\WINDOWS\inf\xscan_xp.inf --a---- 6444 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4572666649A7FFBBBC7320CE76D976FB
C:\WINDOWS\inf\wmtour.inf --a---- 2964 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0F21CD41CA9CCB5E5E6460B42990A778
C:\WINDOWS\inf\accessor.inf --a---- 51948 bytes [10:00 14/04/2008] [10:00 14/04/2008] A70BF0367A0608E4034FF3A21063ED5C
C:\WINDOWS\inf\acpi.inf --a---- 9480 bytes [10:00 14/04/2008] [10:00 14/04/2008] 060B4435BCBBC592167F1DFC6E2CAF55
C:\WINDOWS\inf\agp.inf --a---- 7954 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7E45ECC032707BC151441B953A2CA133
C:\WINDOWS\inf\agtinst.inf --a---- 15534 bytes [10:00 14/04/2008] [10:00 14/04/2008] 426A58A9FCD4C7AD469ECE74CEBB5DB8
C:\WINDOWS\inf\ati1xwdm.inf --a---- 59266 bytes [10:00 14/04/2008] [10:00 14/04/2008] CA0C7CE7DCF44BDE51318DD55AFAEB57
C:\WINDOWS\inf\battery.inf --a---- 10960 bytes [10:00 14/04/2008] [10:00 14/04/2008] C0910976E604BCE334D40E13922B64E0
C:\WINDOWS\inf\bda.inf --a---- 19852 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6E4FF25AD679B4DF15E3C8247EB3FA6E
C:\WINDOWS\inf\bth.inf --a---- 23458 bytes [10:00 14/04/2008] [10:00 14/04/2008] E54A98DBB5CC83FB26B7E497B5D74B1D
C:\WINDOWS\inf\bthprint.inf --a---- 4014 bytes [10:00 14/04/2008] [10:00 14/04/2008] 843C804946F0562561D9C391A8B0E27A
C:\WINDOWS\inf\bthspp.inf --a---- 3930 bytes [10:00 14/04/2008] [10:00 14/04/2008] A9011105031F93F6FF7089F15E3BB9DE
C:\WINDOWS\inf\bthpan.inf --a---- 5114 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9FA5BCC657F7D9B344CE1200CDBAB97F
C:\WINDOWS\inf\ccdecode.inf --a---- 7562 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7ED8C6209C9FC5DD020E7536CFE0EF4E
C:\WINDOWS\inf\cdrom.inf --a---- 71268 bytes [10:00 14/04/2008] [10:00 14/04/2008] F8523087D8C2F77911814F479ED801A9
C:\WINDOWS\inf\comnt5.inf --a---- 163634 bytes [10:00 14/04/2008] [10:00 14/04/2008] A72D73E65532952AE922FBB990636666
C:\WINDOWS\inf\cpu.inf --a---- 16270 bytes [10:00 14/04/2008] [10:00 14/04/2008] 19CBE1A6F2ABCBD675CF924EB143A444
C:\WINDOWS\inf\defltwk.inf --a---- 603322 bytes [10:00 14/04/2008] [10:00 14/04/2008] EFFCE9C4A0878161C4FF40271F323B83
C:\WINDOWS\inf\devxprop.inf --a---- 79068 bytes [10:00 14/04/2008] [10:00 14/04/2008] C6C06AA4C73A0863988D751BC9F3D286
C:\WINDOWS\inf\disk.inf --a---- 10660 bytes [10:00 14/04/2008] [10:00 14/04/2008] E7E08CD7717604F391DB755A42E2CB58
C:\WINDOWS\inf\drvindex.inf --a---- 67895 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4F638F08B788828B172D214363BA42BA
C:\WINDOWS\inf\dtcnt5.inf --a---- 6572 bytes [10:00 14/04/2008] [10:00 14/04/2008] CB4301712F8CAC1EF242C812721BBCF2
C:\WINDOWS\inf\dwup.inf --a---- 643640 bytes [10:00 14/04/2008] [10:00 14/04/2008] BAB40AC1BE89DFAD796AC70970FB6F7B
C:\WINDOWS\inf\fltmgr.inf --a---- 2450 bytes [10:00 14/04/2008] [10:00 14/04/2008] D5C50B6F4523B35F41E314B192A2D2D7
C:\WINDOWS\inf\fp40ext.inf --a---- 15810 bytes [10:00 14/04/2008] [10:00 14/04/2008] 408F5B80C7476C05AAB98582C40335CB
C:\WINDOWS\inf\fxsocm.inf --a---- 101456 bytes [10:00 14/04/2008] [10:00 14/04/2008] 45BA64F26C4C3807E5BAAC32BCB29001
C:\WINDOWS\inf\hdaudbus.inf --a---- 4948 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4287479BC45DB3EF738211A98B94333D
C:\WINDOWS\inf\hidbth.inf --a---- 3990 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4CEB0D9DADA9261B7843A45C7D74DBA6
C:\WINDOWS\inf\hidserv.inf --a---- 8818 bytes [10:00 14/04/2008] [10:00 14/04/2008] ACEFAB3A6D20CD778274D919627E83BC
C:\WINDOWS\inf\ie.inf --a---- 108340 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4FC2379234024A3A83066165CA8FCFAF
C:\WINDOWS\inf\ieaccess.inf --a---- 1654 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3A8A6A99AE8AC7E91FACDD1C9E387477
C:\WINDOWS\inf\iis.inf --a---- 844750 bytes [10:00 14/04/2008] [10:00 14/04/2008] 30DD58789907C0F358C2008967BBA73D
C:\WINDOWS\inf\ims.inf --a---- 98264 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8F9A20AE23BCA74035DD20DF4A82C803
C:\WINDOWS\inf\input.inf --a---- 140666 bytes [10:00 14/04/2008] [10:00 14/04/2008] FDF21A752843EA3E33B67B7050FA1C38
C:\WINDOWS\inf\intl.inf --a---- 870652 bytes [10:00 14/04/2008] [10:00 14/04/2008] 75BDDC699C4032AF6984B3020EEC4467
C:\WINDOWS\inf\irbus.inf --a---- 54968 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8DB7EEEA81AB32E2CE0C7ED0A8D7172E
C:\WINDOWS\inf\keyboard.inf --a---- 86932 bytes [10:00 14/04/2008] [10:00 14/04/2008] DF4850D89275F99FCC5D7EAFD0E135AA
C:\WINDOWS\inf\koc.inf --a---- 558 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5486CF0DAEE623A4DDEFB05715D2B378
C:\WINDOWS\inf\ks.inf --a---- 74720 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2D6AF28E003EE6612E2A876DA5DDCE28
C:\WINDOWS\inf\kscaptur.inf --a---- 48166 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5745FD8757132FAF0665F7F2E469E717
C:\WINDOWS\inf\ksfilter.inf --a---- 19916 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7312286D40ECBD0887CBFD3AF1DA5C4E
C:\WINDOWS\inf\layout.inf --a---- 411449 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1315E9E5537FB29D4A7D90D0E7E749B7
C:\WINDOWS\inf\machine.inf --a---- 171580 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1F02AFF77D569447D5213035A5B2C755
C:\WINDOWS\inf\mchgr.inf --a---- 32706 bytes [10:00 14/04/2008] [10:00 14/04/2008] B7EEF114204018C814ED2D1F4E967922
C:\WINDOWS\inf\mdac.inf --a---- 23586 bytes [10:00 14/04/2008] [10:00 14/04/2008] 614FCDD0E65E67C77D574905AF013F98
C:\WINDOWS\inf\mdmbtmdm.inf --a---- 53528 bytes [10:00 14/04/2008] [10:00 14/04/2008] D431646FA7E981E40734F89A74466041
C:\WINDOWS\inf\mdmetech.inf --a---- 82024 bytes [10:00 14/04/2008] [10:00 14/04/2008] 82C58C47C12C6862534F8E97BCA9816C
C:\WINDOWS\inf\mdmgen.inf --a---- 98606 bytes [10:00 14/04/2008] [10:00 14/04/2008] E829E88D8310E9151F7F7A0D3F01D476
C:\WINDOWS\inf\mdmirmdm.inf --a---- 160176 bytes [10:00 14/04/2008] [10:00 14/04/2008] 479851BE93ED92D14BF3D1C1E61A7E06
C:\WINDOWS\inf\mdmsuprv.inf --a---- 55944 bytes [10:00 14/04/2008] [10:00 14/04/2008] A23833DB90EB682AAD46C509D1D5FBF5
C:\WINDOWS\inf\mdmusrk1.inf --a---- 99328 bytes [10:00 14/04/2008] [10:00 14/04/2008] 604AB8D8A223C3FDE7C8C7ABD640A235
C:\WINDOWS\inf\mdmvv.inf --a---- 31068 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3CF604B51E700A374D77E4803E32F618
C:\WINDOWS\inf\mmopt.inf --a---- 41910 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9229DC837936FF2AED2813241D6C171F
C:\WINDOWS\inf\moviemk.inf --a---- 14752 bytes [10:00 14/04/2008] [10:00 14/04/2008] 32F11579A9C0CFCF09877721EFB97588
C:\WINDOWS\inf\mpe.inf --a---- 6714 bytes [10:00 14/04/2008] [10:00 14/04/2008] 91011A3BFC2A1412A72141ED0D1041F0
C:\WINDOWS\inf\mshdc.inf --a---- 55244 bytes [10:00 14/04/2008] [10:00 14/04/2008] 99C5E5ABC035E8F2811CE8CF204D04AC
C:\WINDOWS\inf\msoe50.inf --a---- 37132 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4C832E062042F2F28807DA37F52545EF
C:\WINDOWS\inf\mstape.inf --a---- 34054 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0177C69A59AC6DED080687F4ACA2DFA8
C:\WINDOWS\inf\multimed.inf --a---- 11746 bytes [10:00 14/04/2008] [10:00 14/04/2008] 85EA686ED07F06753688463966989A01
C:\WINDOWS\inf\nabtsfec.inf --a---- 8200 bytes [10:00 14/04/2008] [10:00 14/04/2008] 86D6BECCBD3A1E96B627FCE09F0BECF4
C:\WINDOWS\inf\ndisip.inf --a---- 13508 bytes [10:00 14/04/2008] [10:00 14/04/2008] 939FD05261B6D2A13693BB57BFA0B66A
C:\WINDOWS\inf\netbeac.inf --a---- 1576 bytes [10:00 14/04/2008] [10:00 14/04/2008] EAF1872CD931CED48D0F01451CD91D7F
C:\WINDOWS\inf\netfxocm.inf --a---- 222232 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4B2C5AD66DBDD4A816258283BF068CEA
C:\WINDOWS\inf\netfw.inf --a---- 1394 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7681C8B309D10689BB38C29A2C9BC970
C:\WINDOWS\inf\netip6.inf --a---- 12416 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6A6C4B6CB453256236D20E68109B9456
C:\WINDOWS\inf\netmscli.inf --a---- 24084 bytes [10:00 14/04/2008] [10:00 14/04/2008] 172F2FC9A4BF1D75D509CA562BFE646E
C:\WINDOWS\inf\netnm.inf --a---- 17696 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8B128334242F3A678AB1669CE71350D8
C:\WINDOWS\inf\netoc.inf --a---- 18844 bytes [10:00 14/04/2008] [10:00 14/04/2008] 586AB2FDF31630DD37B7C97E12BC9B79
C:\WINDOWS\inf\netrass.inf --a---- 78064 bytes [10:00 14/04/2008] [10:00 14/04/2008] E5C001C29CB02EDB41D6330BE111108B
C:\WINDOWS\inf\netrndis.inf --a---- 5878 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6D8D31A4BF08B9320079B0009D8180CD
C:\WINDOWS\inf\nettcpip.inf --a---- 49026 bytes [10:00 14/04/2008] [10:00 14/04/2008] 48E07E2142117CF4B0978030BBF9CB97
C:\WINDOWS\inf\nettun.inf --a---- 3990 bytes [10:00 14/04/2008] [10:00 14/04/2008] 779851E244207270C6C5F61DFC75A4FD
C:\WINDOWS\inf\netupnph.inf --a---- 6542 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6F9F3B7817FABED00DF76FF59AE99740
C:\WINDOWS\inf\netwzc.inf --a---- 8018 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9173C2FB1235AD12080F4C01B24EDE1E
C:\WINDOWS\inf\ntprint.inf --a---- 1498948 bytes [10:00 14/04/2008] [10:00 14/04/2008] 05239E1A5A94714C759905EA89787E8A
C:\WINDOWS\inf\oeaccess.inf --a---- 1574 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4A4084D458E2D9ECE07647BD8BFE6C84
C:\WINDOWS\inf\p2p.inf --a---- 13584 bytes [10:00 14/04/2008] [10:00 14/04/2008] E38F4D3A9F5A3DE0B873C75F06162510
C:\WINDOWS\inf\parhmse.inf --a---- 26718 bytes [10:00 14/04/2008] [10:00 14/04/2008] 997543198A7A5797D8D5FF3A7440D6F9
C:\WINDOWS\inf\pchealth.inf --a---- 9866 bytes [10:00 14/04/2008] [10:00 14/04/2008] 77BEB7E0A96AC92A1D18673E3CF0B2BF
C:\WINDOWS\inf\pnpscsi.inf --a---- 106474 bytes [10:00 14/04/2008] [10:00 14/04/2008] C384420BECC8D22D689F42E1CCE6316C
C:\WINDOWS\inf\qmgr.inf --a---- 13280 bytes [10:00 14/04/2008] [10:00 14/04/2008] 60D2A9C2BB8BD81953D9A78B410F7D96
C:\WINDOWS\inf\ramdisk.inf --a---- 3826 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2C6483CB5026B5CB32469C592CA7DB34
C:\WINDOWS\inf\sceregvl.inf --a---- 37550 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4DA4130B8C7ED7F5450371451697193E
C:\WINDOWS\inf\scsi.inf --a---- 21690 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6A500AB9F204C2FE13AA05298E27BFD9
C:\WINDOWS\inf\sdbus.inf --a---- 7328 bytes [10:00 14/04/2008] [10:00 14/04/2008] 21745DDE216EDDE5C2068B1BBE9D1B29
C:\WINDOWS\inf\secrecs.inf --a---- 16666 bytes [10:00 14/04/2008] [10:00 14/04/2008] B1C4BAF5A70299FC4B127C318322252F
C:\WINDOWS\inf\setupqry.inf --a---- 86782 bytes [10:00 14/04/2008] [10:00 14/04/2008] F3ACE4E09EA293CABABF8AF8BB88C8AF
C:\WINDOWS\inf\sffdisk.inf --a---- 8884 bytes [10:00 14/04/2008] [10:00 14/04/2008] D9642E6A9DFDE799A72BBA056D0A5BDF
C:\WINDOWS\inf\shell.inf --a---- 52928 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3BF85287E3056E80FE6E2CE830244A64
C:\WINDOWS\inf\shl_img.inf --a---- 13244 bytes [10:00 14/04/2008] [10:00 14/04/2008] D63C575AAF9AFAC97678F63CD6044671
C:\WINDOWS\inf\slip.inf --a---- 7206 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9E07C6660C974A1EADA57D4EFF401E5F
C:\WINDOWS\inf\smartcrd.inf --a---- 47422 bytes [10:00 14/04/2008] [10:00 14/04/2008] ECAAD608A459AA896D34D45F6C2C1AD0
C:\WINDOWS\inf\streamip.inf --a---- 11772 bytes [10:00 14/04/2008] [10:00 14/04/2008] A2ADC71CC42FD69E59E36CF4B500D513
C:\WINDOWS\inf\swflash.inf --a---- 3728 bytes [10:00 14/04/2008] [10:00 14/04/2008] A7677FE55AAF2EDB786676A6481CDDA2
C:\WINDOWS\inf\sysoc.inf --a---- 3810 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0C465277281C6ABD2BA3FE0D67C256B2
C:\WINDOWS\inf\syssetup.inf --a---- 70816 bytes [10:00 14/04/2008] [10:00 14/04/2008] 73E53F12C385D493D205AD8862EFC8DD
C:\WINDOWS\inf\tape.inf --a---- 67352 bytes [10:00 14/04/2008] [10:00 14/04/2008] 63FA58106A0CA7424A47B93D2633D209
C:\WINDOWS\inf\tdibth.inf --a---- 8946 bytes [10:00 14/04/2008] [10:00 14/04/2008] 28DC277359FD489D9F2D063A5C7C44FF
C:\WINDOWS\inf\tsoc.inf --a---- 240080 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7239F4B1359B2EC6004B685DC2D4F93B
C:\WINDOWS\inf\usbport.inf --a---- 47648 bytes [10:00 14/04/2008] [10:00 14/04/2008] 82F14A0BB71E001FDC7D0D4216EDEEDA
C:\WINDOWS\inf\usbvideo.inf --a---- 18080 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1A13499CBAC697AB6557913CD0AD353C
C:\WINDOWS\inf\wbemoc.inf --a---- 11916 bytes [10:00 14/04/2008] [10:00 14/04/2008] 21AE0B438E4B35EDCD62E23E841700CE
C:\WINDOWS\inf\wdma_ali.inf --a---- 126666 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9E7BA66C5589DD401EA1CFA2F5586257
C:\WINDOWS\inf\wdma_via.inf --a---- 37714 bytes [10:00 14/04/2008] [10:00 14/04/2008] 67059C493A5EA06CDD167E4B54D24E6E
C:\WINDOWS\inf\wordpad.inf --a---- 16082 bytes [10:00 14/04/2008] [10:00 14/04/2008] E183870542B10F676F79C92A4A8BAA61
C:\WINDOWS\inf\wstcodec.inf --a---- 7230 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5B807B4EBF0147033C848A2220847FBB
C:\WINDOWS\inf\au.inf --a---- 12188 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3FE3479155FB9E60EFBEDEACD2599AD2
C:\WINDOWS\inf\oobe.inf --a---- 12694 bytes [10:00 14/04/2008] [10:00 14/04/2008] D9BE73E23F493D08555AAA0ACBD30E99
C:\WINDOWS\inf\tabletpc.inf --a---- 771960 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5BD2DF0EC1A942841C3D4716895D9708
C:\WINDOWS\inf\medctroc.inf --a---- 191264 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7F5DA4BC5C0C899C68029EDE835458D5
C:\WINDOWS\inf\mplayer2.inf --a---- 36610 bytes [10:00 14/04/2008] [10:00 14/04/2008] D8E662ADA9631CB35F2D7F8A62ECE47E
C:\WINDOWS\inf\atiixpaa.inf --a---- 28912 bytes [10:00 14/04/2008] [10:00 14/04/2008] D6B23EFB7A0D5D0D4A50AB0D90602B5A
C:\WINDOWS\inf\atiixpag.inf --a---- 120610 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5C5AF199FEDC6B92063A2F69A349741D
C:\WINDOWS\inf\atixpwdm.inf --a---- 61098 bytes [10:00 14/04/2008] [10:00 14/04/2008] 630B686655142DFCD7F1546E4BF90BFC
C:\WINDOWS\inf\biosinfo.inf --a---- 48046 bytes [10:00 14/04/2008] [10:00 14/04/2008] 90093E08A4AEE2666885F69220F4AB84
C:\WINDOWS\inf\g400.inf --a---- 10390 bytes [10:00 14/04/2008] [10:00 14/04/2008] 9C93375110DC85A0AECF6E26586239CA
C:\WINDOWS\inf\HidDigi.inf --a---- 7590 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3552F3C303265AEDE65D797D20ECAEBE
C:\WINDOWS\inf\i81xnt5.inf --a---- 23424 bytes [10:00 14/04/2008] [10:00 14/04/2008] EE26A22C85201700A55ECF4C524135E8
C:\WINDOWS\inf\mdmcxsf2.inf --a---- 100136 bytes [10:00 14/04/2008] [10:00 14/04/2008] 72127E4936362A97AB0B16455ADA4F07
C:\WINDOWS\inf\mdmhamrw.inf --a---- 170140 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5DCE4CE9F1E0E6E48EE9C65ED7AD5709
C:\WINDOWS\inf\mdmntstm.inf --a---- 56258 bytes [10:00 14/04/2008] [10:00 14/04/2008] D01D5FF0DB2E976AFE1BD45A2197AD5C
C:\WINDOWS\inf\mdmlt3.inf --a---- 121468 bytes [10:00 14/04/2008] [10:00 14/04/2008] 3CEBEF837A0168D24A4DD9281ACEB717
C:\WINDOWS\inf\mdmrpci.inf --a---- 598890 bytes [10:00 14/04/2008] [10:00 14/04/2008] 6D4209CE5A28D785DDF7D4C2BE3A5BDC
C:\WINDOWS\inf\msnetmtg.inf --a---- 92678 bytes [10:00 14/04/2008] [10:00 14/04/2008] 5A9F9A8C98F0D5D9B81EC6C1E695785F
C:\WINDOWS\inf\netklsi.inf --a---- 17652 bytes [10:00 14/04/2008] [10:00 14/04/2008] A8C9F80651CB3631DC9BADCC5DB246D8
C:\WINDOWS\inf\netrtsnt.inf --a---- 18102 bytes [10:00 14/04/2008] [10:00 14/04/2008] 952A203797B4A0244315C871BD1B9FAC
C:\WINDOWS\inf\netwlan.inf --a---- 35084 bytes [10:00 14/04/2008] [10:00 14/04/2008] 17450AAAB800DD81E39089EC7E80F608
C:\WINDOWS\inf\netwlan2.inf --a---- 18174 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8BE27CF945E3AA4EF12ABA21E5275268
C:\WINDOWS\inf\netwv48.inf --a---- 20290 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0D6F174CE8C49F1971DA5A76A07D20C0
C:\WINDOWS\inf\nv4_disp.inf --a---- 42592 bytes [10:00 14/04/2008] [10:00 14/04/2008] 96FFD9A70D9DBB7F7B739C22F54A7CDF
C:\WINDOWS\inf\nvct.inf --a---- 22990 bytes [10:00 14/04/2008] [10:00 14/04/2008] EE5E6338A89CE74CCA6106EFBAF9ED53
C:\WINDOWS\inf\nvdm.inf --a---- 38430 bytes [10:00 14/04/2008] [10:00 14/04/2008] 038A2A1FA0E4C250EFCBC22EA59711FE
C:\WINDOWS\inf\nvts.inf --a---- 21732 bytes [10:00 14/04/2008] [10:00 14/04/2008] 8E420FD183CEA4845094447693540E25
C:\WINDOWS\inf\ps5333.inf --a---- 6930 bytes [10:00 14/04/2008] [10:00 14/04/2008] 702366915DB40120E20A640202ED3D8F
C:\WINDOWS\inf\wdma_int.inf --a---- 48972 bytes [10:00 14/04/2008] [10:00 14/04/2008] CE5D3D145666AA53F3CFBA9E063E981F
C:\WINDOWS\inf\wfp0.inf --a---- 6912 bytes [10:00 14/04/2008] [10:00 14/04/2008] FDA8C2DEA2A51987C8632010E039C7D5
C:\WINDOWS\inf\wfp1.inf --a---- 6910 bytes [10:00 14/04/2008] [10:00 14/04/2008] EAD98939D070DF757F33F38E4E48891B
C:\WINDOWS\inf\wfp2.inf --a---- 6908 bytes [10:00 14/04/2008] [10:00 14/04/2008] BD342FFE80DC5DD7CCCDF466F9B28632
C:\WINDOWS\inf\wfp3.inf --a---- 6912 bytes [10:00 14/04/2008] [10:00 14/04/2008] E0122AFE5E60B90FA9D7AAC19A2EFD1D
C:\WINDOWS\inf\wfp4.inf --a---- 6912 bytes [10:00 14/04/2008] [10:00 14/04/2008] 90577AD063E975299269C0001A45E2BF
C:\WINDOWS\inf\wfp5.inf --a---- 6920 bytes [10:00 14/04/2008] [10:00 14/04/2008] 7F2DCFE7DF40FB268AD956CEA437FE78
C:\WINDOWS\inf\wfp6.inf --a---- 6918 bytes [10:00 14/04/2008] [10:00 14/04/2008] A8ECD0B19CE631D31A4B65990B5E6309
C:\WINDOWS\inf\wfp7.inf --a---- 6918 bytes [10:00 14/04/2008] [10:00 14/04/2008] E311C62DFAF0377A02BDB27C1F4683A3
C:\WINDOWS\inf\wfp8.inf --a---- 6922 bytes [10:00 14/04/2008] [10:00 14/04/2008] CB1D8FEFD0197823097C3AE1F335B771
C:\WINDOWS\inf\wtv0.inf --a---- 6920 bytes [10:00 14/04/2008] [10:00 14/04/2008] F47A1F58D18D837DE6D5017BEC77A195
C:\WINDOWS\inf\wtv1.inf --a---- 6926 bytes [10:00 14/04/2008] [10:00 14/04/2008] E488E716EA72FF821ED4EAA64614299C
C:\WINDOWS\inf\wtv2.inf --a---- 6926 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2D2E80346F2C689C7015CEC56E70C18D
C:\WINDOWS\inf\wtv3.inf --a---- 6914 bytes [10:00 14/04/2008] [10:00 14/04/2008] 1E130BB3A75AEB22B7DD0BF25215630B
C:\WINDOWS\inf\wtv4.inf --a---- 6916 bytes [10:00 14/04/2008] [10:00 14/04/2008] 62A6CCC22E4E2C4FED5DBA701C92D485
C:\WINDOWS\inf\wtv5.inf --a---- 6912 bytes [10:00 14/04/2008] [10:00 14/04/2008] A2CD902CC0244EDB174D84DD1B090073
C:\WINDOWS\inf\oem31.inf --a---- 49908 bytes [15:42 15/09/2010] [15:42 15/09/2010] BE776CCD36F8C38720F96820A9CCF7C6
C:\WINDOWS\inf\msnmsn.inf --a---- 6028 bytes [10:00 14/04/2008] [10:00 14/04/2008] A510500236E2908B03ED78004D51F104
C:\WINDOWS\inf\drm.inf --a---- 1494 bytes [10:00 14/04/2008] [10:00 14/04/2008] FDE85B190808B06F1ACA6EF7A69B2FA7
C:\WINDOWS\inf\mymusic.inf --a---- 7284 bytes [10:00 14/04/2008] [10:00 14/04/2008] 2D59BBF0636FB3FB72B64B76A533099B
C:\WINDOWS\inf\skins.inf --a---- 1810 bytes [10:00 14/04/2008] [10:00 14/04/2008] C0C970CF8B9E6F19295A065DE0086AC1
C:\WINDOWS\inf\wmdm.inf --a---- 34554 bytes [10:00 14/04/2008] [10:00 14/04/2008] 0F2885253703F5C42F56DBB0AE52D495
C:\WINDOWS\inf\wmfsdk.inf --a---- 13540 bytes [10:00 14/04/2008] [10:00 14/04/2008] 02588CE2A656625AF77373E64EAF36A7
C:\WINDOWS\inf\wmp.inf --a---- 58216 bytes [10:00 14/04/2008] [10:00 14/04/2008] D52DEF8CE20AE1876566F3FE18B8AFC1
C:\WINDOWS\inf\wmpocm.inf --a---- 1730 bytes [10:00 14/04/2008] [10:00 14/04/2008] 11AD93608E0D83B1127E1AF3CEBE94C5
C:\WINDOWS\inf\msmsgs.inf --a---- 104030 bytes [10:00 14/04/2008] [10:00 14/04/2008] 223033C38E164A9D612B01D3421BB207
C:\WINDOWS\inf\wmaccess.inf --a---- 1210 bytes [10:00 14/04/2008] [10:00 14/04/2008] 46D526CE0B66259108AACD081C125E53
C:\WINDOWS\inf\oem32.inf --a---- 5964 bytes [15:42 15/09/2010] [15:42 15/09/2010] 6C4E7EF0E1DF84564F040300783E9648
C:\WINDOWS\inf\oem33.inf --a---- 9182 bytes [15:43 15/09/2010] [15:42 15/09/2010] 449FC3C863783EF2B0A6091CFB991A4A
C:\WINDOWS\inf\oem0.inf --a---- 4526 bytes [19:36 06/01/2009] [13:32 15/04/2008] 404FBAE276491E1D4E9C083D08F992C7
C:\WINDOWS\inf\oem1.inf --a---- 4509 bytes [19:37 06/01/2009] [13:29 15/04/2008] CDD20F8BCCE8C7EA131BB47F8F5A3203
C:\WINDOWS\inf\oem2.inf --a---- 789336 bytes [19:37 06/01/2009] [13:35 15/04/2008] A738D06B38B007ACBFFBA56E8DDF4993
C:\WINDOWS\inf\oem3.inf --a---- 83271 bytes [19:37 06/01/2009] [13:32 15/04/2008] 85F072E24A141AAD3BE53D9722487D0D
C:\WINDOWS\inf\oem4.inf --a---- 23687 bytes [19:37 06/01/2009] [13:32 15/04/2008] 024B75ED9CB1A4BC39B28B00B1E5B595
C:\WINDOWS\inf\oem5.inf --a---- 538786 bytes [19:37 06/01/2009] [13:33 15/04/2008] E07DFDFAA3FB6D0A2DC5BDF726AC5614
C:\WINDOWS\inf\oem6.inf --a---- 1519 bytes [19:37 06/01/2009] [13:30 15/04/2008] 354642AFA257D3AE805FED5761F53065
C:\WINDOWS\inf\oem7.inf --a---- 2916 bytes [19:37 06/01/2009] [13:33 15/04/2008] 6246AA8963AE35251CCA42D692FB11CB
C:\WINDOWS\inf\oem8.inf --a---- 22328 bytes [19:39 06/01/2009] [13:36 15/04/2008] 468C02F7F645EE9FD8B2255A0330A07D
C:\WINDOWS\inf\oem9.inf --a---- 377402 bytes [19:40 06/01/2009] [13:36 15/04/2008] D7BF1FD855BE19230A86B56189452916
C:\WINDOWS\inf\oem10.inf --a---- 166664 bytes [19:40 06/01/2009] [13:36 15/04/2008] 7B9C86CFE6010A7A2CF61C6A7A2A851A
C:\WINDOWS\inf\oem11.inf --a---- 51289 bytes [19:41 06/01/2009] [13:35 15/04/2008] 4199B781C4CADF785BB224618D2888D5
C:\WINDOWS\inf\oem12.inf --a---- 1900 bytes [19:41 06/01/2009] [13:29 15/04/2008] EA3D94193617E4B0A8D486E524102F1C
C:\WINDOWS\inf\oem13.inf --a---- 2462 bytes [19:41 06/01/2009] [13:31 15/04/2008] 726B1685BA62B7D147BB3015F1BF4AC5
C:\WINDOWS\inf\oem14.inf --a---- 7159 bytes [19:41 06/01/2009] [13:30 15/04/2008] B8F0C42C4E9536462E6B67FB3754B369
C:\WINDOWS\inf\oem15.inf --a---- 2715 bytes [19:42 06/01/2009] [13:30 15/04/2008] 92CDADEB96E64B44CEB52DA0AA1A5C53
C:\WINDOWS\inf\oem16.inf --a---- 3079 bytes [19:42 06/01/2009] [13:31 15/04/2008] 218D1E08CAFA9CE6A1B3F92E8350CB90
C:\WINDOWS\inf\oem17.inf --a---- 5711 bytes [19:42 06/01/2009] [13:31 15/04/2008] 5767C24733EBCB1D83634472D03FF318
C:\WINDOWS\inf\oem18.inf --a---- 5596 bytes [19:42 06/01/2009] [13:30 15/04/2008] 6DE3892D3AA2AF271DB745274F7B4F47
C:\WINDOWS\inf\oem19.inf --a---- 5318 bytes [19:42 06/01/2009] [13:30 15/04/2008] 67431C1A7C7E861C725729888AB1B9E6
C:\WINDOWS\inf\oem20.inf --a---- 336492 bytes [19:42 06/01/2009] [13:33 15/04/2008] 5B1C7852CDD6B86CA856D15252D5C7C0
C:\WINDOWS\inf\oem21.inf --a---- 198410 bytes [19:42 06/01/2009] [13:33 15/04/2008] 4EB39C597C73B7AB52FF598522709EED
C:\WINDOWS\inf\ich8usb.inf --a---- 7010 bytes [19:42 06/01/2009] [21:33 15/04/2008] 97E492F43349109C86ECA95992C8D0AB
C:\WINDOWS\inf\ich7usb.inf --a---- 6151 bytes [19:42 06/01/2009] [21:33 15/04/2008] C9E983A5D9213DB5827AA220ABE29981
C:\WINDOWS\inf\oem22.inf --a---- 3580 bytes [19:42 06/01/2009] [21:33 15/04/2008] AF662E4AE56C6EC6CFADC23379CC58D5
C:\WINDOWS\inf\oem23.inf --a---- 6002 bytes [19:42 06/01/2009] [21:33 15/04/2008] 499BD23CAF4184B5961A5E6CF0163D25
C:\WINDOWS\inf\oem24.inf --a---- 4163 bytes [19:43 06/01/2009] [21:33 15/04/2008] FBB05F294013F849A7E5FC9BABBBC117
C:\WINDOWS\inf\oem25.inf --a---- 3430 bytes [19:43 06/01/2009] [21:33 15/04/2008] B255B3CCACCE8807637AF2D3806CD5FD
C:\WINDOWS\inf\oem26.inf --a---- 4749 bytes [19:43 06/01/2009] [13:32 15/04/2008] BF78BB9E0F62F875E4865B9C8BAD5FB7
C:\WINDOWS\inf\oem27.inf -ra---- 21560 bytes [19:57 06/01/2009] [16:34 25/02/2003] D0F19A336E684F55A512A69A20F33780
C:\WINDOWS\inf\oem28.inf -ra---- 16837 bytes [19:57 06/01/2009] [14:18 23/07/2003] B86B4AC8EA785181A53F2DAD81C2C015
C:\WINDOWS\inf\d3dx9_30_x86.inf --a---- 779 bytes [13:22 07/01/2009] [10:46 31/03/2006] 0C1F7BC7C5FD19F4E41F473203F49254
C:\WINDOWS\inf\oem29.inf -ra---- 4243 bytes [16:21 27/01/2010] [16:01 02/05/2008] 64DBB24E92CBB9B428ACFB55563CC478
C:\WINDOWS\inf\oem30.inf --a---- 2813 bytes [15:42 15/09/2010] [15:42 15/09/2010] 508DBCC1D4F21A6935F064D9DED17384
C:\WINDOWS\security\templates\compatws.inf --a---- 67980 bytes [10:00 14/04/2008] [10:00 14/04/2008] 77C3CB0B3FCF67C885C658E25AF3A891
C:\WINDOWS\security\templates\hisecws.inf --a---- 8146 bytes [10:00 14/04/2008] [10:00 14/04/2008] DDAA33D21FA6A0E2FE790C1E5DFA8360
C:\WINDOWS\security\templates\hisecdc.inf --a---- 7888 bytes [10:00 14/04/2008] [10:00 14/04/2008] 4FC05C6574189E286CA2D26DDE179DF0
C:\WINDOWS\security\templates\rootsec.inf --a---- 732 bytes [10:00 14/04/2008] [10:00 14/04/2008] 90DF25F2CC8F8A3D8A2263948D0943F9
C:\WINDOWS\security\templates\securedc.inf --a---- 7889 bytes [10:00 14/04/2008] [10:00 14/04/2008] AB186185080843FF52CE84A5A6E5BD1F
C:\WINDOWS\security\templates\securews.inf --a---- 7868 bytes [10:00 14/04/2008] [10:00 14/04/2008] AACA90DBFE77846E1300EA5FDB3F4173
C:\WINDOWS\security\templates\setup security.inf --a---- 834496 bytes [10:58 06/01/2009] [11:10 06/01/2009] 1CB5F322C54D460B6378B2C5E083E803
C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.inf --a---- 3950 bytes [19:41 06/01/2009] [19:41 06/01/2009] 806B3C3C3E9F4B8482379AC3FD32E3D9
C:\Programme\Gemeinsame Dateien\Microsoft Shared\MSInfo\IEFILES5.INF --a---- 617 bytes [11:08 06/01/2009] [11:00 14/04/2008] 007CBCECA70EF6DAC67D98C302FB4D7C
C:\Programme\Gemeinsame Dateien\Adobe\PDFL\9.0\Fonts\PFM\sy______.info --a---- 487 bytes [13:46 28/07/2008] [13:46 28/07/2008] 734728DE28D75E812346304806AEC7CE
C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\plugins\org.junit4_4.3.1\META-INF\eclipse.inf --a---- 79 bytes [03:46 15/08/2008] [03:46 15/08/2008] 3D2EB4E14F52FAB60F3CFCBC9549FEBB
C:\Programme\Windows NT\Pinball\wavemix.inf -ra---- 2687 bytes [11:06 06/01/2009] [11:00 14/04/2008] A521F31ED4FB51F067A2496F3744ADC8
C:\Programme\Realtek\Audio\InstallShield\HDA.inf ------- 166029 bytes [19:40 06/01/2009] [13:36 15/04/2008] F8A2E5538AE3AEA2FA542121048AB6A0
C:\Programme\Realtek\Audio\InstallShield\HDA01.inf ------- 152920 bytes [19:40 06/01/2009] [13:36 15/04/2008] 34259023CDF990E3F857DD7D9E3E021A
C:\Programme\Realtek\Audio\InstallShield\HDA104D.inf ------- 153526 bytes [19:40 06/01/2009] [13:36 15/04/2008] 240CAFE37A3E6E25B57D8CC1E0E73BA0
C:\Programme\Realtek\Audio\InstallShield\HDA861A.inf ------- 151676 bytes [19:40 06/01/2009] [13:36 15/04/2008] B13E1AF84167182C8138A36A2ECC34B3
C:\Programme\Realtek\Audio\InstallShield\HDAAEEP.inf ------- 150657 bytes [19:40 06/01/2009] [13:36 15/04/2008] 2D9FE92E118E82D30D6FD7B768CB4CD9
C:\Programme\Realtek\Audio\InstallShield\HDAApple.inf ------- 154742 bytes [19:40 06/01/2009] [13:36 15/04/2008] BE06D28C8511065AE0ED191072CED702
C:\Programme\Realtek\Audio\InstallShield\HDACPC.inf ------- 164540 bytes [19:40 06/01/2009] [13:36 15/04/2008] 8A016D4283D8ECAA4B698130B2732865
C:\Programme\Realtek\Audio\InstallShield\HDAHP880.inf ------- 152972 bytes [19:40 06/01/2009] [13:36 15/04/2008] 0706BD6CEA2EA608A9BCE99E14BD736B
C:\Programme\Realtek\Audio\InstallShield\HDAHPNB.inf ------- 154746 bytes [19:40 06/01/2009] [13:36 15/04/2008] AE16E6E83624392A0CB78DF79AAFF325
C:\Programme\Realtek\Audio\InstallShield\HDALC.inf ------- 288121 bytes [19:40 06/01/2009] [13:36 15/04/2008] DA104322D9C61B5D8B0760625D6B927F
C:\Programme\Realtek\Audio\InstallShield\HDARt.inf ------- 166664 bytes [19:40 06/01/2009] [13:36 15/04/2008] 7B9C86CFE6010A7A2CF61C6A7A2A851A
C:\Programme\Realtek\Audio\InstallShield\HDASamsu.inf ------- 159741 bytes [19:40 06/01/2009] [13:36 15/04/2008] 3C58E6E27B15F69D20D866C553272917
C:\Programme\Realtek\Audio\InstallShield\HDX.INF ------- 153752 bytes [19:40 06/01/2009] [13:36 15/04/2008] 8A5318BF9604F7C98E2DD53CAFBA1457
C:\Programme\Realtek\Audio\InstallShield\HDX01.INF ------- 153208 bytes [19:40 06/01/2009] [13:36 15/04/2008] 9800B84108933EAC1E6B1C29C327D517
C:\Programme\Realtek\Audio\InstallShield\HDX104D.INF ------- 154304 bytes [19:40 06/01/2009] [13:36 15/04/2008] 41C46315C310DBE1C09C631EAEB07FCB
C:\Programme\Realtek\Audio\InstallShield\HDX861A.INF ------- 152402 bytes [19:40 06/01/2009] [13:36 15/04/2008] 220DC65E78AF866FAEE070427ED0AE38
C:\Programme\Realtek\Audio\InstallShield\HDXAEEP.inf ------- 151383 bytes [19:40 06/01/2009] [13:36 15/04/2008] FA81A2BE250591629A0A5BF02AA4A47C
C:\Programme\Realtek\Audio\InstallShield\HDXApple.inf ------- 155516 bytes [19:40 06/01/2009] [13:36 15/04/2008] AF0C5336138D4DB0E746C377B3BB5C1E
C:\Programme\Realtek\Audio\InstallShield\HDXCPC.inf ------- 165314 bytes [19:40 06/01/2009] [13:36 15/04/2008] F88A9666A81907CFC96ADEDF89E7B98A
C:\Programme\Realtek\Audio\InstallShield\HDXHP880.INF ------- 153752 bytes [19:40 06/01/2009] [13:36 15/04/2008] E35F29E1A1681BBB9856153F8ABAAF9D
C:\Programme\Realtek\Audio\InstallShield\HDXHPNB.INF ------- 155516 bytes [19:40 06/01/2009] [13:36 15/04/2008] 101A1AA3083B8120DA2A2951B98BE413
C:\Programme\Realtek\Audio\InstallShield\HDXLC.INF ------- 287099 bytes [19:40 06/01/2009] [13:36 15/04/2008] 3FEDEB27B1B6BEC89B383E0EF810782F
C:\Programme\Realtek\Audio\InstallShield\HDXRT.INF ------- 166075 bytes [19:40 06/01/2009] [13:36 15/04/2008] E8ACB0F4A5C82EF7A8E2C15235E0449C
C:\Programme\Realtek\Audio\InstallShield\HDXSamsu.INF ------- 153728 bytes [19:40 06/01/2009] [13:36 15/04/2008] F89621291AA7F3E7A68C1FEFB619D710
C:\Programme\Motorola\usmserial.inf --a---- 51289 bytes [19:41 06/01/2009] [13:35 15/04/2008] 4199B781C4CADF785BB224618D2888D5
C:\Programme\Lexmark X1100 Series\Drivers\lxbkscxp.inf --a---- 21560 bytes [19:57 06/01/2009] [16:34 25/02/2003] D0F19A336E684F55A512A69A20F33780
C:\Programme\Lexmark X1100 Series\Drivers\lxbkw2k.inf --a---- 16837 bytes [19:57 06/01/2009] [14:18 23/07/2003] B86B4AC8EA785181A53F2DAD81C2C015
C:\Programme\FaxTools\PcmFmt.inf --a---- 3565 bytes [20:00 06/01/2009] [03:01 24/11/1999] F1D6495F2510B86666407DC3500ADA98
C:\Programme\FaxTools\PRINTER.INF --a---- 11993 bytes [20:00 06/01/2009] [03:01 25/05/1998] 4A1E8CCF96A7A49E6DF7A551470BB58B
C:\Programme\FaxTools\Rings.inf --a---- 327 bytes [20:00 06/01/2009] [03:01 26/11/1999] 3E5232ECC73A6835B38E3B061382C78A
C:\Programme\ABBYY FineReader 5.0 Sprint\Support\ainfo.inf --a---- 142 bytes [14:01 13/09/2001] [14:01 13/09/2001] 13D248DD03B17FD74926D5F92A626D89
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFK.inf -ra---- 4240 bytes [16:00 02/05/2008] [16:00 02/05/2008] 24A8F24CE8B2A87153F87C9F007C8C37
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFJ.inf -ra---- 4246 bytes [16:00 02/05/2008] [16:00 02/05/2008] A9CB80CAFA36293227FC1B3CEFE45538
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFCT.inf -ra---- 4245 bytes [15:59 02/05/2008] [15:59 02/05/2008] EFCBC54FF6630ECEF393145743478AD6
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFCS.inf -ra---- 4253 bytes [15:59 02/05/2008] [15:59 02/05/2008] 9F04EE569BE371957A40E433B106AC76
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFstdJ.inf -ra---- 4290 bytes [16:00 02/05/2008] [16:00 02/05/2008] F17CEC6F7073B1C404E1A537BDBEED85
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFstdCT.inf -ra---- 4297 bytes [16:00 02/05/2008] [16:00 02/05/2008] B6AEA34CB88AEE005D1A537AA56A87A1
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFstdCS.inf -ra---- 4295 bytes [16:00 02/05/2008] [16:00 02/05/2008] 2AB73590B2B5B80BB8D65D2FD81D6644
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFstd.inf -ra---- 4281 bytes [16:00 02/05/2008] [16:00 02/05/2008] 11E7003E2293061F6EC91E6C0928A349
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDFstdK.inf -ra---- 4292 bytes [16:00 02/05/2008] [16:00 02/05/2008] 9201002F39E744C35B8A91E944827F53
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Xtras\AdobePDF\AdobePDF.inf -ra---- 4243 bytes [16:01 02/05/2008] [16:01 02/05/2008] 64DBB24E92CBB9B428ACFB55563CC478
C:\Programme\Adobe\Acrobat 9.0\Designer 8.2\Fonts\sy______.inf --a---- 487 bytes [23:16 22/05/2008] [23:16 22/05/2008] 734728DE28D75E812346304806AEC7CE
C:\Programme\Adobe\Adobe Illustrator CS3\Support Files\Required\Fonts\wmbi____.inf --a---- 556 bytes [00:06 28/03/2007] [00:06 28/03/2007] 419E8ACDAF7703413F44FA9CB2494260
C:\Programme\Adobe\Adobe Illustrator CS3\Support Files\Required\Fonts\wmb_____.inf --a---- 535 bytes [00:06 28/03/2007] [00:06 28/03/2007] EB7D07BB718F1F088931327C21359F4E
C:\Programme\Adobe\Adobe Illustrator CS3\Support Files\Required\Fonts\wmi_____.inf --a---- 542 bytes [00:06 28/03/2007] [00:06 28/03/2007] 6FEAD307858D38BD416D9811CEBC053C
C:\Programme\Adobe\Adobe Illustrator CS3\Support Files\Required\Fonts\wmr_____.inf --a---- 537 bytes [00:06 28/03/2007] [00:06 28/03/2007] 0F333A0339DEE1BBC9243F3016F9BFA5
C:\Programme\Avira\AntiVir Desktop\avgntflt.inf --a---- 2373 bytes [22:08 23/08/2010] [12:24 16/02/2010] 6E84128E6A429AFA9F51A098EEF93766
C:\Programme\Avira\AntiVir Desktop\avipbb.inf --a---- 1645 bytes [22:08 23/08/2010] [08:05 24/02/2010] 55240E58C5C50A0AD7504D2F2A70B8A8
C:\Programme\Avira\AntiVir Desktop\ssmdrv.inf --a---- 1030 bytes [22:08 23/08/2010] [09:23 09/05/2007] CF125D3DDEFA97C529E3EB021C4FF38D
C:\Programme\Verbindungsassistent\Drivers\Automatic\Huawei\ewdcsc.inf --a---- 2813 bytes [15:42 15/09/2010] [15:42 15/09/2010] 508DBCC1D4F21A6935F064D9DED17384
C:\Programme\Verbindungsassistent\Drivers\Automatic\Huawei\ewmdm2k.inf --a---- 49908 bytes [15:42 15/09/2010] [15:42 15/09/2010] BE776CCD36F8C38720F96820A9CCF7C6
C:\Programme\Verbindungsassistent\Drivers\Automatic\Huawei\ewser2k.inf --a---- 5964 bytes [15:42 15/09/2010] [15:42 15/09/2010] 6C4E7EF0E1DF84564F040300783E9648
C:\Programme\Verbindungsassistent\Drivers\Automatic\Huawei\mod7700.inf --a---- 9182 bytes [15:42 15/09/2010] [15:42 15/09/2010] 449FC3C863783EF2B0A6091CFB991A4A
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP46\A0025415.inf --a---- 106244 bytes [15:25 09/09/2010] [15:25 09/09/2010] 44DAC4BA816330EA57EF4ECF6E458879
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP47\A0025730.inf --a---- 106244 bytes [07:14 10/09/2010] [07:14 10/09/2010] 095C3282B43F3918A4EF6E03898072BE
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP47\A0025813.inf --a---- 106244 bytes [13:32 11/09/2010] [13:32 11/09/2010] 64BD1B455F164E078E9899E1FB37D904
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP48\A0026921.inf --a---- 0 bytes [15:42 15/09/2010] [15:43 15/09/2010] D41D8CD98F00B204E9800998ECF8427E
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP48\A0026923.inf --a---- 0 bytes [15:42 15/09/2010] [15:43 15/09/2010] D41D8CD98F00B204E9800998ECF8427E
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP48\A0026925.inf --a---- 0 bytes [15:42 15/09/2010] [15:43 15/09/2010] D41D8CD98F00B204E9800998ECF8427E
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP48\A0026927.inf --a---- 0 bytes [15:43 15/09/2010] [15:43 15/09/2010] D41D8CD98F00B204E9800998ECF8427E
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP48\A0026937.inf --a---- 106244 bytes [03:20 12/09/2010] [03:21 12/09/2010] 44DAC4BA816330EA57EF4ECF6E458879
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP50\A0027992.inf --a---- 106244 bytes [19:08 15/09/2010] [19:08 15/09/2010] 2AF6BA549F6C092952347A2D6947B3F7
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP50\A0028041.INF --a---- 106244 bytes [19:08 15/09/2010] [21:10 05/10/2010] FBC479321BA09C1F1C0B3300A358413E
C:\System Volume Information\_restore{C224EAEA-36DE-4446-B375-772E79DC40D4}\RP50\A0030222.inf --a---- 106244 bytes [12:01 06/10/2010] [21:10 05/10/2010] FBC479321BA09C1F1C0B3300A358413E

-= EOF =-

Hi,

das OTL hängen bleibt ist sehr ungewöhnlich...

Das hier sollte das Apfelmänchen schachmat setzten...

Fix für OTL:

Doppelklick auf die OTL.exe, um das Programm auszuführen.

Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

http://oldtimer.geekstogo.com/OTL/OTL_Main_Tutorial.gif

Code:



:OTL

O33 - MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\Shell\AutoRun\command - "" = G:\AutoRun.exe -- File not found

O33 - MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\Shell - "" = AutoRun

O33 - MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\Shell\AutoRun - "" = Auto&Play
 

:Files

C:\autorun.inf

C:\APFELBAUM.vbs
 

:Commands

[emptytemp]

[Reboot]

Den roten Run Fixes! Button anklicken.

Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

%systemroot%\_OTL

So, bitte poste das Log von CF, da mir das GMER-Log nicht gefällt noch den TDSS-Killer hinterher
(wobei einem die daemon-tools öfter einen streich spielen):

TDSS-Killer
Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft?
Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)!
Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe.
Nach dem Start erscheint ein Fenster, dort dann "Start Scan".
Wenn der Scan fertig ist bitte "Report" anwählen. Es öffnet sich ein Fenster, den Text abkopieren und hier posten...

chris

hallo chris,
hier die neue otl
lief dieses mal problemlos, das programm meinte, ein neustart sei nötig,um alle prozesse auszuführen, ich habe das gemacht und es kam dieser bericht.
ist das der richtige,also das otl-fix-log?
gruss
TiM
JETZT MACHE ICH DAS CF...
DANACH DANACH TDSS_KILLER

All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0873f77a-7d0a-11de-9b4d-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0873f77a-7d0a-11de-9b4d-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0873f77a-7d0a-11de-9b4d-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12d6107a-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12d6107a-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12d6107a-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12d6107b-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12d6107b-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12d6107b-d423-11de-9b76-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e9cb09c-13f4-11df-9bf1-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e9cb09c-13f4-11df-9bf1-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1e9cb09c-13f4-11df-9bf1-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d3299a0-6c83-11de-9b38-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d3299a0-6c83-11de-9b38-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d3299a0-6c83-11de-9b38-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ba7884a-e027-11dd-9aec-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7ba7884a-e027-11dd-9aec-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ba7884a-e027-11dd-9aec-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90d446f6-d692-11de-9b7a-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{90d446f6-d692-11de-9b7a-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90d446f6-d692-11de-9b7a-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8aad52-cfaf-11de-9b71-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9d8aad52-cfaf-11de-9b71-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9d8aad52-cfaf-11de-9b71-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6cfdfda-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6cfdfda-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6cfdfda-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6cfdfda-c0df-11df-9c13-00231241255a}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6cfdfdb-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6cfdfdb-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6cfdfdb-c0df-11df-9c13-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6cfdfdb-c0df-11df-9c13-00231241255a}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d05fea12-d8fb-11de-9b81-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d05fea12-d8fb-11de-9b81-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d05fea12-d8fb-11de-9b81-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6c51b4e-d9da-11de-9b83-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c51b4e-d9da-11de-9b83-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6c51b4e-d9da-11de-9b83-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e6cc1f7c-73a2-11df-9bf3-00231241255a}\ not found.
========== FILES ==========
C:\autorun.inf moved successfully.
C:\APFELBAUM.vbs moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: bill gates
->Temp folder emptied: 722187 bytes
->Temporary Internet Files folder emptied: 2637084 bytes
->Flash cache emptied: 0 bytes

User: FOUND.000

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 188480 bytes
RecycleBin emptied: 101701 bytes

Total Files Cleaned = 4,00 mb

OTL by OldTimer - Version 3.2.14.1 log created on 10072010_114251

Files\Folders moved on Reboot...
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\XZT1JPOG\91503-hacked-computername-da-hats-mich-wohl-auch-erwischt[1].html moved successfully.
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\PHRSBL45\CA7R9X1P.de moved successfully.
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\PHRSBL45\CAE6B3DW.de moved successfully.
C:\Dokumente und Einstellungen\bill gates\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8XGBI183\CA4HQZC1.de moved successfully.

Registry entries deleted on Reboot...

Hi,

ist das richtige, die Re-Einträge hat er wohl dann doch beim ersten Lauf erwischt...

Jetzt bitte das Reg-Script in einem der vorherigen Posts abfahren und dann den TDSS-Killer laufen lassen...

crhis

hallo chris,
muss ich diese otl- anweisung vor dem combofix noch durchführen?
oder hat sich das mit deiner neuen, von mir durchgeführten otl-anweisung erledigt?
entschuldige, die vielen rückfragen.
gruss
TiM

Starte bitte die OTL.exe
Vista/Win7-User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox

Code:Alles kopierenAlles auswählenLarusso Modus
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.exe
c:\windows\system32\drivers\*.sys /lockedfiles
c:\windows\system32\*.dll /lockedfiles
%systemroot%\*. /mp /s
%PROGRAMFILES%\*.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT
Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button
Klick auf OK
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hi,

lass OTL mal weg, wenn CF nichts bringt können wir Ihn immer noch laufen lassen. Vorher kannst Du das Reg-Script durchführen...

chris

hallo chris,
also habe das cf laufen lassen, computer lebt noch...kurzzeitig dachte ich alles ist gelaufen.
habe doppelklick auf das cf emblem auf meinem desktop gemacht, danach wollte er eine zustimmung von mir hören, kann leider nicht mehr genau wiedergeben was, es ging irgendwie um den ursprung dieses cf programmes und dass man es nicht von aufgeführten links erwerben soll.was danach stand war mir unverständliche computersprache.habe ja angegeben.
danach hat das programm angefangen zu arbeiten und relativ schnell fehler angezeit!
der computer hat sich heruntergefahren, beim wieder hochbooten war erst einmal schwärzeste nacht..
bin dann arbeiten gegangen.
als ich zurückkam immer noch tiefste nacht.
habe das ding mit ausknopf runtergefahren.
als er wieder hochfuhr, war desktophintergrund mit einer meldung, dass man die microsoft-wiederherstellungskonsole herunterladen müsse, da combo-fix ohne diese einige schwerwiegende reperaturen an infizierungen nicht vornehmen kann.
konnte das nicht herunterladen, da die mir angebotene computeroberfläche mich ja gar nicht bis zum internetverbindungsassisten vorließ.
combofix hat dann doch einen scan durchgeführt das logfile ist unten zu sehen.
Vor dem cf-durchlauf habe ich meine externe festplatte angeschlossen und einen umts stick angestöpselt,habe die shift taste einen moment gedrückt, vielleicht war das zu kurz bin mir nicht sicher, da der autorun sich geöffnet hat und die festplatte erkannt wurde.ALSO VIELLEICHT HABE ICH HIER EINEN FEHLER GEMACHT(da ich mir ja nicht sicher bin, ob festplatte und umts-stick auch infiziert sind).SAGE DIES NUN,UM WEITERE ARBEIT STEUERN ZU KÖNNEN.
Vor dem cf habe ich das von dir gepostete in den texteditor eingegeben und mit der registry zusammengefügt.
hacked by apfelbaum ist seitdem weg.
jetzt zeigt der internetexplorer immer den namen der jeweiligen seite an, auf der ich gerade bin,das ist normal so, oder?
Habe diesen anblick ja länger nicht mehr gehabt.
Also ich hoffe, ich habe beim einstöpseln der externen und des umts sicks nicht das ding wieder infiziert.
Aktuell sehe ich KEIN HACKED BY APFELBAUM....im internetexplorer.
während diesem ganzen prozess kam mir die frage, wie ich denn prüfen kann, ob meine externe und mein umts sick sauber sind.dies ist eigentlich viel wichtiger als mein windows-system.da die daten auf der externen etwas wichtiger sind....und ich windows auch neu aufspielen könnte.aber ich mich dann wahrscheinlich immer wieder über meine externe infiziere.
....ja viel blabla, ich entschuldige alle eventuellen fehler.und hoffe ich habe nicht alles verbockt.
Soll ich den nun diesen rootkit-killer laufen lassen?
Warte auf anweisung..hope i didn't bring you down.
gruss
TiM

Combofix Logfile:

Code:

ComboFix 10-10-06.02 - bill gates 07.10.2010  19:29:07.1.2 - FAT32x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3052.2737 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\bill gates\Desktop\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt
 

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

F:\Autorun.inf
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-09-07 bis 2010-10-07  ))))))))))))))))))))))))))))))

.
 

2010-10-06 21:52 . 2010-10-06 21:52        --------        d-----w-        C:\_OTL

2010-10-05 21:10 . 2010-10-05 21:10        --------        d-----w-        c:\dokumente und einstellungen\bill gates\Anwendungsdaten\Malwarebytes

2010-10-05 21:09 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-05 21:09 . 2010-10-05 21:09        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-10-05 21:09 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-10-05 21:09 . 2010-10-05 21:09        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2010-10-05 20:49 . 2010-10-05 20:49        388096        ----a-r-        c:\dokumente und einstellungen\bill gates\Anwendungsdaten\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2010-10-05 20:49 . 2010-10-05 20:49        --------        d-----w-        c:\programme\Trend Micro

2010-09-16 10:38 . 2010-09-16 10:38        --------        d-s---w-        c:\dokumente und einstellungen\FOUND.000

2010-09-15 15:43 . 2010-09-15 15:43        --------        d-----w-        c:\dokumente und einstellungen\bill gates\Anwendungsdaten\Verbindungsassistent

2010-09-15 15:42 . 2010-09-15 15:42        621056        ----a-w-        c:\windows\system32\drivers\mod7700.sys

2010-09-15 15:42 . 2010-09-15 15:42        23424        ----a-w-        c:\windows\system32\drivers\ewdcsc.sys

2010-09-15 15:42 . 2010-09-15 15:42        --------        d-----w-        c:\programme\Verbindungsassistent

2010-09-15 15:42 . 2008-07-24 09:03        101760        ------w-        c:\windows\system32\drivers\ewusbmdm.sys

2010-09-11 22:06 . 2010-09-11 22:06        --------        d-----w-        c:\programme\Conduit

2010-09-11 22:06 . 2010-09-11 22:06        --------        d-----w-        c:\dokumente und einstellungen\bill gates\Lokale Einstellungen\Anwendungsdaten\Conduit

2010-09-10 07:40 . 2010-09-10 07:40        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Apple

2010-09-09 15:10 . 2010-09-09 15:10        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Threat Expert

2010-09-09 15:10 . 2010-09-09 15:10        --------        d-----r-        c:\dokumente und einstellungen\LocalService\Favoriten
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-07 17:31 . 2009-01-06 19:51        12        ----a-w-        c:\windows\bthservsdp.dat

2010-10-07 13:22 . 2008-04-14 10:00        70976        ----a-w-        c:\windows\system32\perfc007.dat

2010-10-07 13:22 . 2008-04-14 10:00        405692        ----a-w-        c:\windows\system32\perfh007.dat

2010-09-04 17:22 . 2010-09-04 17:22        --------        d-----w-        c:\dokumente und einstellungen\bill gates\Anwendungsdaten\Philipp Winterberg

2010-09-04 17:22 . 2010-09-04 17:22        --------        d-----w-        c:\programme\RarZilla Free Unrar

2010-09-04 17:07 . 2010-09-04 17:07        --------        d-----w-        c:\programme\Gemeinsame Dateien\InstallShield Shared

2010-09-04 17:07 . 2010-09-04 17:07        --------        d-----w-        c:\programme\ASGvis

2010-08-23 23:34 . 2010-08-23 23:34        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-15 8527872]

"nwiz"="nwiz.exe" [2008-04-15 1626112]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-15 81920]

"RTHDCPL"="RTHDCPL.EXE" [2008-04-15 16855552]

"IRW"="c:\windows\system32\IRW.exe" [2008-04-15 147456]

"Apple_KbdMgr"="c:\programme\Boot Camp\KbdMgr.exe" [2008-04-15 423216]

"Lexmark X1100 Series"="c:\programme\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

"Adobe Acrobat Speed Launcher"="c:\programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]

"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           \0
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@="Driver Group"
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Bonjour\\mDNSResponder.exe"=

"c:\\Programme\\Gemeinsame Dateien\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3703:TCP"= 3703:TCP:*:Disabled:Adobe Version Cue CS4 Server

"3704:TCP"= 3704:TCP:*:Disabled:Adobe Version Cue CS4 Server

"51000:TCP"= 51000:TCP:*:Disabled:Adobe Version Cue CS4 Server

"51001:TCP"= 51001:TCP:*:Disabled:Adobe Version Cue CS4 Server
 

R2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [15.04.2008 15:43 132400]

R2 AppleTimeSrv;Apple-Time-Server;c:\windows\system32\AppleTimeSrv.exe [15.04.2008 15:43 99632]

R2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [15.04.2008 15:31 5504]

R2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [15.04.2008 15:30 6528]

R2 WTGService;WTGService;c:\programme\Verbindungsassistent\WTGService.exe [15.09.2010 17:42 296400]

R3 applemtm;Apple Multitouch Mouse;c:\windows\system32\drivers\applemtm.sys [06.01.2009 21:42 10496]

R3 applemtp;Apple Multitouch;c:\windows\system32\drivers\applemtp.sys [06.01.2009 21:42 15616]

R3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\drivers\IRFilter.sys [06.01.2009 21:41 16512]

R3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\drivers\KeyMagic.sys [06.01.2009 21:41 19968]

S2 lxqndpd;Config Server;c:\windows\system32\svchost.exe -k netsvcs [14.04.2008 12:00 14336]

S2 wcmrojpd;Monitor Center;c:\windows\system32\svchost.exe -k netsvcs [14.04.2008 12:00 14336]

S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.08.2008 05:46 284016]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07.01.2009 15:14 717296]
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

wcmrojpd

lxqndpd

.

Inhalt des "geplante Tasks" Ordners
 

2010-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uInternet Settings,ProxyOverride = *.local

IE: An vorhandene PDF-Datei anfügen - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

.

.

------- Dateityp-Verknüpfung -------

.

.scr=AutoCADScriptFile

.txt=

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\LEXBCES.EXE

c:\windows\system32\LEXPPS.EXE

c:\windows\system32\rundll32.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\RTHDCPL.EXE

c:\programme\Lexmark X1100 Series\lxbkbmon.exe

c:\programme\Bonjour\mDNSResponder.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-10-07  19:42:08 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-10-07 17:42
 

Vor Suchlauf: 4.345.397.248 Bytes frei

Nach Suchlauf: 4.343.005.184 Bytes frei
 

- - End Of File - - 7E2B1F8B28D6A4AA670C80D2C6DB4F10

--- --- ---