|
Weißer Bildschirm Win XP Reatogo durchgeführt Habe den Scan durchgeführt. Was ist nun zu tun ? OTL logfile created on: 3/30/2012 8:22:31 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 479.00 Mb Total Physical Memory | 282.00 Mb Available Physical Memory | 59.00% Memory free 383.00 Mb Paging File | 297.00 Mb Available in Paging File | 77.00% Paging File free Paging file location(s): C:\pagefile.sys 720 1440 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 37.25 Gb Total Space | 26.14 Gb Free Space | 70.16% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - File not found [Disabled] -- -- (HidServ) SRV - File not found [On_Demand] -- -- (AppMgmt) SRV - [2006/10/23 08:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto] -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe -- (AOL ACS) SRV - [2003/08/27 04:29:46 | 000,065,536 | ---- | M] (America Online, Inc.) [Auto] -- C:\WINDOWS\wanmpsvc.exe -- (WANMiniportService) WAN Miniport (ATW) SRV - [2003/08/10 23:28:42 | 000,045,056 | ---- | M] ( ) [Auto] -- C:\WINDOWS\System32\slserv.exe -- (SLService) SRV - [2003/03/09 16:31:02 | 000,065,795 | R--- | M] (HP) [On_Demand] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2002/02/21 08:12:30 | 000,049,152 | ---- | M] (Advanced Micro Devices) [Auto] -- C:\Program Files\AMD\PowerNow!\GemServ.exe -- (GemServ) AMD PowerNow! (tm) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (ulisa) Telekom ISDN-Adapter (USB) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | On_Demand] -- -- (dtwmnic5) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2004/08/03 17:31:36 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC) DRV - [2004/08/03 17:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) DRV - [2004/08/03 17:29:52 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3SavageNB) DRV - [2004/08/03 17:29:52 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3Psddr) DRV - [2004/02/26 14:36:09 | 000,082,380 | ---- | M] (Oak Technology Inc.) [Kernel | System] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K) DRV - [2004/02/26 13:42:00 | 000,008,552 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM) DRV - [2003/12/19 08:07:50 | 000,541,548 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2003/12/11 11:54:14 | 000,391,424 | ---- | M] (Sensaura Ltd) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS) DRV - [2003/09/15 03:45:40 | 001,302,192 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm) DRV - [2003/09/11 00:40:12 | 000,550,088 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slntamr.sys -- (Slntamr) DRV - [2003/08/17 21:35:32 | 000,086,512 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal) DRV - [2003/08/10 21:35:34 | 000,167,352 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ntmtlfax.sys -- (NtMtlFax) DRV - [2003/07/16 00:30:26 | 000,221,736 | ---- | M] ( ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5) DRV - [2003/07/02 04:12:52 | 000,039,348 | ---- | M] (Vireo Software) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup) DRV - [2003/04/23 13:52:16 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW) DRV - [2003/04/02 02:02:26 | 000,007,040 | ---- | M] (EnE Technology Inc.) [Kernel | Boot] -- C:\WINDOWS\System32\drivers\ENECBPTH.sys -- (ENECBPTH) DRV - [2002/08/28 17:59:26 | 000,154,624 | ---- | M] (Lucent Technologies) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wlluc48.sys -- (wlluc48) DRV - [2002/03/19 16:20:00 | 000,027,648 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\VIAAGP1.SYS -- (viaagp1) DRV - [2001/11/14 09:13:04 | 000,009,696 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINDOWS\system32\drivers\gemwdm.sys -- (gemwdm) AMD PowerNow! (tm) DRV - [2001/10/22 04:31:06 | 000,029,696 | ---- | M] (VIA Technologies, Inc. ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\fetnd5a.sys -- (FETNDIS) DRV - [2000/07/23 19:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\BrPar.sys -- (BrPar) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de IE - HKLM\..\URLSearchHook: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Thomas_Röhling_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&seamless=novl&offerId=webmail-de-de&authLev=0&siteState=ver%3A4%7Crt%3ASTANDARD%7Cat%3ASNS%7Cld%3Amail.aol.de%7Cuv%3AAOL%7Clc%3Ade-de%7Cmt%3AANGELIA%7Csnt%3AScreenName%7Csid%3Af6a33574-32cc-4f6c-9e32-b91adbe03696&locale=de IE - HKU\Thomas_Röhling_ON_C\..\URLSearchHook: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) IE - HKU\Thomas_Röhling_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google) FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () O1 HOSTS File: ([2005/11/07 17:22:37 | 000,000,847 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O3 - HKU\Thomas_Röhling_ON_C\..\Toolbar\WebBrowser: (no name) - {46AE04C0-BCFA-4728-90E7-00EB4A8B3863} - No CLSID value found. O3 - HKU\Thomas_Röhling_ON_C\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O4 - HKLM..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe (AOL LLC) O4 - HKLM..\Run: [BX6kRBeYBXtpN21] C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe (vGHFK) O4 - HKLM..\Run: [HostManager] C:\Programme\Gemeinsame Dateien\aol\1185915038\ee\aolsoftware.exe (America Online, Inc.) O4 - HKLM..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe () O4 - HKLM..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [routcnf] File not found O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe () O4 - HKU\Thomas_Röhling_ON_C..\Run: [BX6kRBeYBXtpN21] C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe (vGHFK) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0\aoltray.exe (America Online, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Thomas_Röhling_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Thomas_Röhling_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1 O7 - HKU\Thomas_Röhling_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKU\Thomas_Röhling_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - File not found O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Programme\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} hxxp://www3.snapfish.de/SnapfishActivia.cab (Snapfish Activia) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe) - C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe (vGHFK) O20 - HKLM Winlogon: UserInit - (C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe) - C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe (vGHFK) O20 - HKU\Thomas_Röhling_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe) - C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe (vGHFK) O20 - HKU\Thomas_Röhling_ON_C Winlogon: UserInit - (C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe) - C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe (vGHFK) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player ActiveX: {057997dd-71e4-43cc-b161-3f8180691a9e} - Q824145 ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608555} - Internet Explorer Classes for Java ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - Q837009 ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {588A559B-BBC9-4148-A2C0-96A33D1DBC26} - Microsoft .NET Framework 1.0 Hotfix (KB928367) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {61r1K7Zg-HMWm-14l4-knLL-DFbthPjzcAFc} - ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {65289DE3-4C1A-11D6-B6E1-00B0D049139F} - Microsoft .NET Framework 1.0 Service Pack 2 (KB867461) ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {78705f0d-e8db-4b2d-8193-982bdda15ecd} - .NET Framework ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167 ActiveX: {839117ee-2132-4bae-a56a-42b50204c9b9} - KB889293 ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider ActiveX: {9BFBE94F-2FAF-11D6-8712-0002B3281F8B} - Microsoft .NET Framework 1.0 Service Pack 1 (KB867461) ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player ActiveX: {D82A39FB-1784-4608-BFE8-1ACBFF3079C1} - Microsoft .NET Framework 1.0 Service Pack 3 (KB867461) ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894 ActiveX: {F279058C-50B2-4BE4-60C9-369CACF06821} - .NET Framework ActiveX: {F5776D81-AE53-4935-8E84-B0B283D8BCEF} - Q330994 ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^AOL 8.0 Tray-Symbol.lnk - - File not found MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk - C:\Programme\Microsoft Office\Office\OSA9.EXE - (Microsoft Corporation) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 ========== Files/Folders - Created Within 30 Days ========== [2012/03/29 15:33:02 | 000,233,472 | ---- | C] (vGHFK) -- C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe [2004/01/12 08:39:34 | 000,550,088 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slntamr.sys [2004/01/12 08:39:34 | 000,167,352 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys [2004/01/12 08:39:34 | 000,086,512 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slnthal.sys [2004/01/12 08:39:34 | 000,045,056 | ---- | C] ( ) -- C:\WINDOWS\System32\slserv.exe [2004/01/12 08:39:33 | 001,302,192 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlstrm.sys [2004/01/12 08:39:33 | 000,221,736 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/03/30 12:25:32 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012/03/30 12:25:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012/03/29 15:32:57 | 000,233,472 | ---- | M] (vGHFK) -- C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\y6drxuj c7ti.exe [2012/03/25 04:36:28 | 000,373,114 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2012/03/25 04:36:28 | 000,365,410 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012/03/25 04:36:28 | 000,056,056 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2012/03/25 04:36:28 | 000,046,414 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2012/03/14 13:06:26 | 000,141,240 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2012/03/13 16:37:29 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/02/16 16:53:14 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2008/08/02 12:35:57 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2008/06/27 06:09:02 | 000,000,012 | ---- | C] () -- C:\WINDOWS\dirsaver.ini [2008/06/27 06:08:58 | 000,028,672 | ---- | C] () -- C:\WINDOWS\gscr.dll [2008/04/25 10:40:37 | 000,000,111 | ---- | C] () -- C:\WINDOWS\telephon.ini [2007/07/24 12:09:40 | 000,000,313 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI [2007/07/24 12:09:40 | 000,000,142 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI [2007/07/24 12:09:40 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini [2007/07/24 12:09:40 | 000,000,000 | ---- | C] () -- C:\WINDOWS\bw5150d.ini [2007/07/24 12:09:40 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini [2007/07/24 12:09:39 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL [2007/07/24 12:09:39 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL [2007/07/24 12:09:39 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL [2007/07/24 12:09:38 | 000,015,108 | ---- | C] () -- C:\WINDOWS\HL-5150D.INI [2007/07/24 12:09:34 | 000,000,416 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2007/07/24 12:09:33 | 000,000,052 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2007/07/24 12:09:26 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\BRSS01A.ini [2007/06/09 17:53:43 | 000,009,728 | ---- | C] () -- C:\Dokumente und Einstellungen\Thomas Röhling\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006/08/18 15:22:26 | 000,000,026 | ---- | C] () -- C:\WINDOWS\HNetCtrl.INI [2006/08/18 15:22:06 | 000,000,463 | ---- | C] () -- C:\WINDOWS\Capictrl.INI [2005/05/11 11:02:31 | 000,000,044 | ---- | C] () -- C:\WINDOWS\NewSaver.ini [2004/11/01 13:40:17 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll [2004/08/02 09:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004/04/16 05:20:57 | 000,000,731 | ---- | C] () -- C:\WINDOWS\aolback.exe.lnk [2004/02/27 12:42:05 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2004/02/26 14:01:30 | 000,000,059 | ---- | C] () -- C:\WINDOWS\WINPHONE.INI [2004/02/26 13:40:57 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2004/02/26 13:40:02 | 000,000,147 | ---- | C] () -- C:\Dokumente und Einstellungen\Thomas Röhling\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2004/01/22 07:00:28 | 000,012,635 | ---- | C] () -- C:\WINDOWS\System32\DAntivirus.ini [2004/01/12 08:48:10 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004/01/12 08:39:34 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\slextspk.dll [2004/01/12 08:39:34 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\SLGen.dll [2004/01/12 08:39:34 | 000,024,576 | ---- | C] () -- C:\WINDOWS\slrundll.exe [2004/01/12 08:39:33 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\coinst.dll [2004/01/12 08:38:40 | 000,028,779 | ---- | C] () -- C:\WINDOWS\System32\javaw.exe [2004/01/12 08:38:40 | 000,024,681 | ---- | C] () -- C:\WINDOWS\System32\java.exe [2004/01/12 08:36:35 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2004/01/12 08:36:31 | 000,001,032 | ---- | C] () -- C:\WINDOWS\System32\drivers\alcxinit.dat [2004/01/12 08:35:39 | 000,001,052 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/03/28 17:35:02 | 000,002,068 | ---- | C] () -- C:\WINDOWS\Ca533a.ini [2003/03/27 10:28:44 | 000,004,955 | ---- | C] () -- C:\WINDOWS\System32\DProg.ini [2003/03/09 16:31:04 | 000,561,152 | ---- | C] () -- C:\WINDOWS\System32\hpotscl.dll [2002/09/17 00:40:10 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2002/09/17 00:38:41 | 000,141,240 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2002/09/17 00:33:29 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2002/09/17 00:30:04 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2002/09/16 23:57:36 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2002/09/16 23:48:55 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2002/09/16 14:22:23 | 000,373,114 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2002/09/16 14:22:23 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2002/09/16 14:22:23 | 000,056,056 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2002/09/16 14:22:23 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2002/09/16 14:21:47 | 000,365,410 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2002/09/16 14:21:47 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2002/09/16 14:21:46 | 000,046,414 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2002/09/16 14:21:46 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2002/09/16 14:21:45 | 000,004,678 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2002/09/16 14:21:44 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2002/09/16 14:21:41 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2002/09/16 14:21:31 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2002/09/16 14:21:31 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2002/09/16 14:21:16 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2002/09/16 14:21:04 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin ========== LOP Check ========== [2004/02/27 12:34:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\InterVideo [2008/06/18 17:49:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\Snapfish [2005/01/16 07:42:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Thomas Röhling\Anwendungsdaten\WholeSecurity [2004/04/16 05:20:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2004/01/12 08:41:24 | 000,000,000 | ---D | M] -- C:\AddOn [2004/02/26 13:39:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2002/09/16 14:25:55 | 000,000,000 | ---D | M] -- C:\i386 [2004/02/26 13:42:00 | 000,000,000 | ---D | M] -- C:\My Music [2004/05/29 10:07:10 | 000,000,000 | ---D | M] -- C:\Norman [2004/01/12 08:40:05 | 000,000,000 | ---D | M] -- C:\NormanAV [2004/01/12 08:39:25 | 000,000,000 | ---D | M] -- C:\Program Files [2011/02/25 18:08:12 | 000,000,000 | R--D | M] -- C:\Programme [2004/02/26 17:49:52 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2005/01/29 10:27:44 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012/03/14 13:06:38 | 000,000,000 | ---D | M] -- C:\WINDOWS [2004/05/20 10:09:15 | 000,000,000 | ---D | M] -- C:\WUTemp < %PROGRAMFILES%\*.exe > Invalid Environment Variable: %LOCALAPPDATA%\*.exe < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2004/08/03 20:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008/10/25 13:14:03 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2004/08/03 20:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys [2008/10/25 13:14:03 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004/08/03 18:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys < MD5 for: ATAPI.SYS > [2002/08/29 08:00:00 | 010,180,476 | ---- | M] () .cab file -- C:\i386\sp1.cab:atapi.sys [2002/08/29 08:00:00 | 010,180,476 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys [2004/08/03 20:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008/10/25 13:14:03 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2004/08/03 20:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys [2008/10/25 13:14:03 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004/08/03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys < MD5 for: EVENTLOG.DLL > [2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008/04/13 22:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2004/08/03 19:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: EXPLORER.EXE > [2004/08/03 19:57:54 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe [2007/06/13 09:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [2008/04/13 22:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008/04/13 22:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2007/06/13 09:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe < MD5 for: NETLOGON.DLL > [2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008/04/13 22:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2004/08/03 19:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: SCECLI.DLL > [2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008/04/13 22:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2004/08/03 19:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll < MD5 for: USER32.DLL > [2003/07/08 06:50:04 | 000,530,944 | ---- | M] (Microsoft Corporation) MD5=0A10ED933F76DE06A408989AB563B7E8 -- C:\WINDOWS\$NtUninstallKB824141$\user32.dll [2004/06/17 13:55:43 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=34280AB3C7BEC4BA2E423567F6045369 -- C:\WINDOWS\$NtUninstallKB891711$\user32.dll [2005/03/02 14:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll [2007/03/08 11:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2005/03/02 14:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2004/08/03 19:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll [2007/03/08 11:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2003/09/25 12:52:01 | 000,561,664 | ---- | M] (Microsoft Corporation) MD5=8D928268AFBF31F8A34CE610DA175352 -- C:\WINDOWS\$NtUninstallKB840987$\user32.dll [2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008/04/13 22:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008/04/13 22:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2004/08/03 19:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: WINLOGON.EXE > [2004/08/03 19:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2002/08/29 08:00:00 | 000,521,728 | ---- | M] (Microsoft Corporation) MD5=616896B708286DA98D6A099293F181D7 -- C:\WINDOWS\$NtUninstallKB840987$\winlogon.exe [2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008/04/13 22:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2002/08/29 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2002/08/29 08:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2002/09/17 01:38:05 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2002/09/17 01:38:05 | 000,606,208 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2002/09/17 01:38:04 | 000,401,408 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\system32\*.dll /lockedfiles > [2011/03/03 02:54:43 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll [2011/12/18 09:43:24 | 011,082,240 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll [2011/12/17 15:43:23 | 002,000,384 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll [2008/04/13 22:22:18 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll [2008/04/13 22:22:20 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll [2011/01/21 10:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] Invalid Environment Variable: %USERPROFILE%\*.* Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe < End of report > |
hi auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort rein: Code: :OTLdieses speicherst du auf nem usb stick als fix.txt nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist. • Klicke nun bitte auf den Fix Button. es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick. wenn dies nicht funktioniert, bitte den fix manuell eintragen. dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen, log posten bitte. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
|
Hallo! Danke für deine Hilfe. Der Trojaner scheint weg zu sein, aber ich habe keine Desktop-Icons. Auf den Befehl (rechte Maustaste) reagiert der Rechner leider nicht. Den Taskmanager kann ich auch nicht öffnen. Noch einen Tipp? Vielen Dank und Grüße! Thomas Zitat:
Code: OTL logfile created on: 4/2/2012 12:45:53 AM - Run |
führe erst mal combofix aus, dann starte neu, dann kannst du die symbole einblenden und bitte den upload von moved files durchführen. Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
|
Hallo, vielen Dank für die Hilfe, Desktopsymbole sind wieder da Gruß Thomas Combofix Logfile: Code: ComboFix 12-04-01.03 - Thomas Röhling 03.04.2012 4:45.1.1 - x86 |
öffne mal bitte arbeitsplatz, c: rechtsklick qoobox. bitte packen und im upload channel hochladen, wenn erledigt bescheid geben. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 09:39 Uhr. |
Copyright ©2000-2025, Trojaner-Board