Trojaner-Board - Verschlüsselungstrojaner

Guten Abend

Ein Bekannter hat sich den Verschlüsselungs-Trojaner eingefangen und mich gebeten, ihn zu beseitigen. Da der Rechner schnell wieder gebraucht wird, sollte er auch schnell wieder runter.
Es kommt die Meldung, das System sei durch einen 4096 Bit PGP-RSA Schlüssel verschlüsselt worden sei.

Das Problem: Ich kann ihn weder normal starten noch komme ich in den Abgesicherten Modus! Es kommt zwar die Meldung, dass die Dateien geladen werden, aber danach rebootet er einfach.

Ins Netz will ich den Rechner nicht lassen, am Ende sind die restlichen 5 Computer auch hier auch betroffen...

Habe jetzt mithilfe der OTLPENet.exe (also dem Reatogo-X-PE System) ein komplettes OTL-File erstellt.

Code:

OTL logfile created on: 5/1/2012 10:21:45 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free

Paging file location(s): [Binary data over 100 bytes]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = D:\Programme

Drive C: | 29.09 Gb Total Space | 1.07 Gb Free Space | 3.68% Space Free | Partition Type: FAT32

Drive D: | 436.66 Gb Total Space | 421.85 Gb Free Space | 96.61% Space Free | Partition Type: NTFS

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [On_Demand] --  -- (Datev.Framework.RemoteServices.Messaging.CentralMessagingService)

SRV - File not found [On_Demand] --  -- (Datev.Framework.RemoteServices)

SRV - File not found [Auto] --  -- (Datev.Framework.RemoteServiceModel.EnablerService)

SRV - File not found [On_Demand] --  -- (Datev.Database.Conserve)

SRV - [2011/12/08 21:20:00 | 000,079,872 | ---- | M] (DATEV eG) [Auto] -- D:\DATEV\PROGRAMM\B0001442\PSNTServ.exe -- (DatevPrintService)

SRV - [2011/07/24 21:49:00 | 000,172,640 | ---- | M] (DATEV eG) [On_Demand] -- D:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)

SRV - [2011/07/01 15:02:18 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/04/29 08:57:00 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011/04/22 10:17:16 | 001,181,328 | ---- | M] (Lavasoft) [Auto] -- D:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2009/12/09 09:23:24 | 000,069,632 | ---- | M] (Adobe Systems) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)

SRV - [2009/08/04 12:29:54 | 000,219,360 | ---- | M] (DeviceVM, Inc.) [On_Demand] -- D:\Programme\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)

SRV - [2009/07/30 12:51:02 | 000,068,136 | ---- | M] () [On_Demand] -- D:\Programme\GIGABYTE\EnergySaver\GSvr.exe -- (GEST Service)

SRV - [2006/10/23 13:50:36 | 000,046,640 | R--- | M] (AOL LLC) [Auto] -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe -- (AOL ACS)

SRV - [2003/07/28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)

DRV - File not found [Kernel | System] --  -- (PCIDump)

DRV - File not found [Kernel | System] --  -- (lbrtfdc)

DRV - File not found [Kernel | System] --  -- (i2omgmt)

DRV - File not found [Kernel | System] --  -- (Changer)

DRV - [2011/08/01 15:56:42 | 000,045,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)

DRV - [2011/07/01 21:02:18 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011/07/01 21:02:18 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010/07/04 15:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable] -- D:\Programme\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)

DRV - [2009/12/11 13:05:16 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\gdrv.sys -- (gdrv)

DRV - [2009/08/05 22:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)

DRV - [2009/06/29 12:59:14 | 000,142,592 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2009/06/25 07:07:44 | 005,095,936 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2009/06/25 07:07:40 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)

DRV - [2009/06/25 07:07:40 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)

DRV - [2009/05/11 10:12:50 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009/02/28 14:40:18 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/12/08 17:14:28] [Kernel | Auto] -- D:\Programme\CyberLink\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD})

DRV - [2009/02/13 07:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2006/11/28 21:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PDNMp50.sys -- (PDNMp50)

DRV - [2006/11/28 21:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PDNSp50.sys -- (PDNSp50)

DRV - [2003/01/10 22:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\Lepschy_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.Google.com/

IE - HKU\Lepschy_ON_C\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - D:\Programme\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)

IE - HKU\Lepschy_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Lepschy_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: d:\Programme\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: d:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.709: d:\Programme\Real Player\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.709: d:\Programme\Real Player\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.709: d:\Programme\Real Player\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: D:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/11 14:10:16 | 000,000,000 | ---D | M]

 

 

O1 HOSTS File: ([2004/08/04 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} -  File not found

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\Lepschy_ON_C\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Lexmark X1100 Series] D:\Programme\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [UnlockerAssistant] D:\Programme\Unlocker\UnlockerAssistant.exe ()

O4 - HKU\.DEFAULT..\Run: [SvrWsc]  File not found

O4 - HKU\Lepschy_ON_C..\Run: [88AB0A2F] C:\WINDOWS\system32\76691A9388AB0A2F527D.exe ()

O4 - HKU\Lepschy_ON_C..\Run: [AOL Fast Start] D:\Programme\AOL 9.0 VR\AOL.EXE (AOL, LLC.)

O4 - HKU\Lepschy_ON_C..\Run: [SvrWsc]  File not found

O4 - HKU\NetworkService_ON_C..\Run: [SvrWsc]  File not found

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Basisschnittstelle Office SR V.5.02 Initialisierung.lnk = D:\DATEV\PROGRAMM\BSoffice\service\OfficeDiag.exe (DATEV eG)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\SkyUserDevmode-Update.lnk = D:\DATEV\PROGRAMM\B0001401\UpdateDevmode.exe (DATEV eG)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1

O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - D:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260279216734 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1260279313562 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\76691A9388AB0A2F527D.exe) - C:\WINDOWS\system32\76691A9388AB0A2F527D.exe ()

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found

O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found

O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found

O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - D:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/12/08 18:15:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/05/01 19:05:46 | 000,000,000 | -HSD | C] -- C:\FOUND.001

[2012/05/01 18:59:42 | 000,000,000 | -HSD | C] -- C:\FOUND.000

[2012/05/01 10:52:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Bxkur

[2012/05/01 04:51:53 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Rechnung

[2012/04/21 13:39:38 | 000,016,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll

[2012/04/21 13:23:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun

[2012/04/21 13:23:40 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java

[2012/04/21 13:23:19 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2012/04/21 13:23:18 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2012/04/21 13:23:18 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2012/04/21 13:23:18 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2012/04/21 13:23:18 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2012/04/21 13:04:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft-Maus

[2012/04/21 13:04:18 | 001,461,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WdfCoInstaller01009.dll

[2012/04/21 13:04:18 | 000,045,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\dc3d.sys

[2012/04/21 07:35:04 | 000,000,000 | ---D | C] -- D:\Programme\JDownloader

[2012/04/21 07:04:13 | 000,000,000 | ---D | C] -- D:\Programme\Microsoft IntelliPoint

[2012/04/17 03:23:38 | 000,000,000 | R--D | C] -- D:\Eigene Dateien\Eigene Bilder

[2012/04/07 11:32:19 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Lepschy\Recent

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/05/01 20:44:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/05/01 20:43:28 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012/05/01 20:42:08 | 000,215,383 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2012/05/01 20:42:08 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012/05/01 20:42:08 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-746137067-2052111302-839522115-1003.job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job

[2012/05/01 19:00:00 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{106E9005-5209-471D-A88B-1B5345A577D8}.job

[2012/05/01 18:43:34 | 000,000,054 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat

[2012/05/01 18:43:34 | 000,000,039 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat

[2012/05/01 10:54:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012/05/01 10:53:56 | 000,000,099 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\locked-default.pls.hxpr

[2012/05/01 10:53:42 | 000,000,148 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked- Klicken Sie hier*.url.ikgi

[2012/05/01 10:53:38 | 000,000,182 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Desktop\locked-IP Adresse.url.konm

[2012/05/01 10:53:36 | 000,004,703 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\locked-EmptySettings.xml.lrow

[2012/05/01 10:52:12 | 000,046,080 | -H-- | M] () -- C:\WINDOWS\System32\76691A9388AB0A2F527D.exe

[2012/05/01 10:42:18 | 000,000,363 | ---- | M] () -- C:\WINDOWS\lexstat.ini

[2012/05/01 10:16:30 | 000,002,427 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Desktop\Microsoft Office Excel 2003.lnk

[2012/05/01 04:59:01 | 005,915,616 | ---- | M] () -- D:\Eigene Dateien\locked-telemodul_rechnungswesen_v1_21.exe.yvqy

[2012/05/01 04:59:00 | 008,730,608 | ---- | M] () -- D:\Eigene Dateien\locked-telemodul_due_rechnungswesen_pak00700_2_3.exe.fmvh

[2012/05/01 04:59:00 | 000,033,995 | ---- | M] () -- D:\Eigene Dateien\locked-Rechnung.zip.lbxr

[2012/05/01 04:59:00 | 000,004,065 | ---- | M] () -- D:\Eigene Dateien\locked-LSETUP.ANW.nfcl

[2012/05/01 04:59:00 | 000,003,247 | ---- | M] () -- D:\Eigene Dateien\locked-SSETUP.ANW.rzjp

[2012/05/01 04:58:11 | 000,614,925 | ---- | M] () -- D:\Eigene Dateien\locked-EI-Rechnungswesen-Daten pro 1961-2000-20110101 15012012 001.dvsdRW.eifa

[2012/04/30 17:29:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321

[2012/04/30 17:29:30 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320

[2012/04/30 17:28:00 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323

[2012/04/30 17:26:42 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322

[2012/04/28 12:23:24 | 000,002,427 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2003.lnk

[2012/04/26 18:38:10 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh325

[2012/04/26 18:37:48 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh324

[2012/04/26 12:09:50 | 000,002,395 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003.lnk

[2012/04/21 14:32:20 | 000,250,288 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012/04/21 14:30:50 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_point32_01009.Wdf

[2012/04/21 13:45:36 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-746137067-2052111302-839522115-1003.job

[2012/04/21 13:39:44 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_dc3d_01009.Wdf

[2012/04/21 13:39:42 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

[2012/04/21 13:35:32 | 000,001,612 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader.lnk

[2012/04/21 13:35:32 | 000,001,556 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Deinstallationsprogramm.lnk

[2012/04/21 13:35:32 | 000,001,535 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Update.lnk

[2012/04/21 13:23:12 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2012/04/21 13:23:12 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2012/04/21 13:23:12 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2012/04/21 13:23:12 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2012/04/21 13:23:12 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2012/04/21 13:04:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft-Maus

[2012/04/17 10:53:10 | 000,000,400 | ---- | M] () -- C:\WINDOWS\ODBC.INI

[2012/04/07 11:31:22 | 000,002,395 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Desktop\Microsoft Office Word 2003.lnk

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012/05/01 19:01:25 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2012/05/01 19:01:25 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job

[2012/05/01 19:01:24 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job

[2012/05/01 19:01:24 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job

[2012/05/01 19:01:23 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job

[2012/05/01 18:43:32 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat

[2012/05/01 18:43:32 | 000,000,039 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320

[2012/05/01 10:52:10 | 000,046,080 | -H-- | C] () -- C:\WINDOWS\System32\76691A9388AB0A2F527D.exe

[2012/05/01 04:51:52 | 000,033,995 | ---- | C] () -- D:\Eigene Dateien\locked-Rechnung.zip.lbxr

[2012/04/21 14:30:49 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_point32_01009.Wdf

[2012/04/21 13:39:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_dc3d_01009.Wdf

[2012/04/21 13:39:41 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

[2012/04/21 13:35:30 | 000,001,612 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader.lnk

[2012/04/21 13:35:30 | 000,001,556 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Deinstallationsprogramm.lnk

[2012/04/21 13:35:30 | 000,001,535 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Update.lnk

[2012/01/14 14:18:18 | 000,248,914 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-746137067-2052111302-839522115-1003-0.dat

[2011/11/03 23:08:17 | 000,248,914 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011/11/03 22:17:44 | 000,004,703 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\locked-EmptySettings.xml.lrow

[2010/01/03 17:36:02 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2009/12/17 14:35:15 | 000,000,099 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\locked-default.pls.hxpr

[2009/12/17 14:34:57 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009/12/17 13:27:41 | 000,000,363 | ---- | C] () -- C:\WINDOWS\lexstat.ini

[2009/12/17 13:27:30 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbkvs.dll

[2009/12/17 13:27:28 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBKLCNP.DLL

[2009/12/17 13:27:27 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LXBKIH.EXE

[2009/12/17 13:27:23 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE

[2009/12/17 13:27:05 | 000,000,266 | ---- | C] () -- C:\WINDOWS\System32\lxbkcoin.ini

[2009/12/16 14:02:18 | 000,000,111 | ---- | C] () -- C:\WINDOWS\telephon.ini

[2009/12/16 13:26:24 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009/12/16 12:37:35 | 000,012,632 | ---- | C] () -- C:\WINDOWS\System32\skypdfmonuipro.dll

[2009/12/16 12:37:34 | 000,014,680 | ---- | C] () -- C:\WINDOWS\System32\skypdfmonpro.dll

[2009/12/16 12:27:50 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2009/12/16 12:26:36 | 000,000,021 | ---- | C] () -- C:\WINDOWS\DvInesKurusOleServer003.INI

[2009/12/16 12:25:58 | 000,000,080 | ---- | C] () -- C:\WINDOWS\dvinesinstart001.INI

[2009/12/16 12:25:58 | 000,000,080 | ---- | C] () -- C:\WINDOWS\dvinesinstalllocation001.INI

[2009/12/16 12:25:51 | 000,000,081 | ---- | C] () -- C:\WINDOWS\Startup.INI

[2009/12/16 12:23:06 | 000,000,040 | ---- | C] () -- C:\WINDOWS\WISO.INI

[2009/12/16 12:23:03 | 000,304,640 | ---- | C] () -- C:\WINDOWS\System32\gsbest32.dll

[2009/12/16 12:21:43 | 000,229,888 | ---- | C] () -- C:\WINDOWS\fpuninst.exe

[2009/12/10 08:35:17 | 000,006,656 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/12/09 10:42:25 | 000,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe

[2009/12/08 18:16:11 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009/12/08 18:13:04 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2009/12/08 17:54:27 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009/12/08 17:53:35 | 000,250,288 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009/12/08 14:39:42 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009/12/08 14:10:55 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll

[2009/12/08 14:06:06 | 000,207,400 | R--- | C] () -- C:\WINDOWS\GSetup.exe

[2009/12/08 14:06:06 | 000,000,010 | ---- | C] () -- C:\WINDOWS\GSetup.ini

[2009/09/30 12:05:48 | 000,290,816 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v60.dll

[2009/03/28 00:03:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2009/03/28 00:03:00 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2009/03/28 00:03:00 | 001,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2009/03/28 00:03:00 | 001,346,080 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2009/03/28 00:03:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2009/03/28 00:03:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2009/03/28 00:03:00 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2009/03/28 00:03:00 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe

[2008/10/30 18:00:22 | 000,048,640 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v60.dll

[2008/10/30 17:59:24 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v60.dll

[2008/05/26 22:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini

[2008/05/26 22:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini

[2008/05/26 22:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini

[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin

[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin

[2004/12/14 17:55:22 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll

[2004/12/14 17:55:22 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll

[2004/12/14 17:55:22 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll

[2004/08/04 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004/08/04 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004/08/04 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004/08/04 12:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2004/08/04 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004/08/04 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004/08/04 12:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2004/08/04 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004/08/04 12:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004/08/04 12:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004/08/04 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2004/08/04 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2003/02/20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[1999/01/19 15:18:30 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\LFPNG60N.DLL

[1999/01/19 15:18:30 | 000,046,080 | ---- | C] () -- C:\WINDOWS\System32\LFTIF60N.DLL

[1999/01/19 15:18:30 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\LTFIL60N.DLL

[1999/01/19 15:18:30 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LFPSD60N.DLL

[1999/01/19 15:18:30 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFTGA60N.DLL

[1999/01/19 15:18:30 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWPG60N.DLL

[1999/01/19 15:18:30 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWMF60N.DLL

[1999/01/19 15:18:28 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\LFFAX60N.DLL

[1999/01/19 15:18:28 | 000,141,824 | ---- | C] () -- C:\WINDOWS\System32\LFCMP60N.DLL

[1999/01/19 15:18:28 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\LFPCX60N.DLL

[1999/01/19 15:18:28 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFPCT60N.DLL

[1999/01/19 15:18:28 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFEPS60N.DLL

[1999/01/19 15:18:28 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFBMP60N.DLL

[1999/01/19 15:18:28 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\LFMSP60N.DLL

[1999/01/19 15:18:28 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\LFMAC60N.DLL

[1995/02/15 00:11:00 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL

 
 ========== LOP Check ==========

 

[2009/12/08 16:07:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Windows Desktop Search

[2009/12/08 16:58:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Windows Search

[2011/11/01 13:35:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\ImgBurn

[2011/11/01 14:44:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\DATEV

[2012/01/16 17:11:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\QuickStoresToolbar

[2012/05/01 10:52:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Bxkur

[2009/12/08 17:13:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp

[2009/12/09 10:10:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2009/12/09 10:15:24 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

[2009/12/16 12:37:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SkyCom

[2009/12/16 13:30:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint

[2009/12/17 15:37:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D800E57D-1D89-4AFD-8B05-A59C225431C4}

[2011/01/07 15:04:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DATEV

[2012/05/01 19:00:00 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{106E9005-5209-471D-A88B-1B5345A577D8}.job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

 
 ========== Purity Check ==========

 

 

< End of report >

Dann habe ich noch einen benutzerdefinierten Scan mit den vorgeschlagenen Informationen aus dem zweiten Beitrag von diesem Link erstellt: http://www.trojaner-board.de/114450-...uesselung.html

Code:

OTL logfile created on: 5/1/2012 10:24:40 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free

Paging file location(s): [Binary data over 100 bytes]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = D:\Programme

Drive C: | 29.09 Gb Total Space | 1.07 Gb Free Space | 3.68% Space Free | Partition Type: FAT32

Drive D: | 436.66 Gb Total Space | 421.85 Gb Free Space | 96.61% Space Free | Partition Type: NTFS

Drive E: | 3.69 Gb Total Space | 3.38 Gb Free Space | 91.82% Space Free | Partition Type: FAT32

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [On_Demand] --  -- (Datev.Framework.RemoteServices.Messaging.CentralMessagingService)

SRV - File not found [On_Demand] --  -- (Datev.Framework.RemoteServices)

SRV - File not found [Auto] --  -- (Datev.Framework.RemoteServiceModel.EnablerService)

SRV - File not found [On_Demand] --  -- (Datev.Database.Conserve)

SRV - [2011/12/08 21:20:00 | 000,079,872 | ---- | M] (DATEV eG) [Auto] -- D:\DATEV\PROGRAMM\B0001442\PSNTServ.exe -- (DatevPrintService)

SRV - [2011/07/24 21:49:00 | 000,172,640 | ---- | M] (DATEV eG) [On_Demand] -- D:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)

SRV - [2011/07/01 15:02:18 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011/04/29 08:57:00 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011/04/22 10:17:16 | 001,181,328 | ---- | M] (Lavasoft) [Auto] -- D:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)

SRV - [2009/12/09 09:23:24 | 000,069,632 | ---- | M] (Adobe Systems) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)

SRV - [2009/08/04 12:29:54 | 000,219,360 | ---- | M] (DeviceVM, Inc.) [On_Demand] -- D:\Programme\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)

SRV - [2009/07/30 12:51:02 | 000,068,136 | ---- | M] () [On_Demand] -- D:\Programme\GIGABYTE\EnergySaver\GSvr.exe -- (GEST Service)

SRV - [2006/10/23 13:50:36 | 000,046,640 | R--- | M] (AOL LLC) [Auto] -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe -- (AOL ACS)

SRV - [2003/07/28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2003/06/19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)

DRV - File not found [Kernel | System] --  -- (PCIDump)

DRV - File not found [Kernel | System] --  -- (lbrtfdc)

DRV - File not found [Kernel | System] --  -- (i2omgmt)

DRV - File not found [Kernel | System] --  -- (Changer)

DRV - [2011/08/01 15:56:42 | 000,045,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)

DRV - [2011/07/01 21:02:18 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011/07/01 21:02:18 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010/07/04 15:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable] -- D:\Programme\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)

DRV - [2009/12/11 13:05:16 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\gdrv.sys -- (gdrv)

DRV - [2009/08/05 22:48:42 | 000,054,752 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)

DRV - [2009/06/29 12:59:14 | 000,142,592 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2009/06/25 07:07:44 | 005,095,936 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2009/06/25 07:07:40 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)

DRV - [2009/06/25 07:07:40 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)

DRV - [2009/05/11 10:12:50 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009/02/28 14:40:18 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/12/08 17:14:28] [Kernel | Auto] -- D:\Programme\CyberLink\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD})

DRV - [2009/02/13 07:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2006/11/28 21:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PDNMp50.sys -- (PDNMp50)

DRV - [2006/11/28 21:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\PDNSp50.sys -- (PDNSp50)

DRV - [2003/01/10 22:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://alice.aol.de

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://alice.aol.de

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\Lepschy_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.Google.com/

IE - HKU\Lepschy_ON_C\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - D:\Programme\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)

IE - HKU\Lepschy_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Lepschy_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: d:\Programme\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: d:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.709: d:\Programme\Real Player\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.709: d:\Programme\Real Player\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.709: d:\Programme\Real Player\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: D:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/11 14:10:16 | 000,000,000 | ---D | M]

 

 

O1 HOSTS File: ([2004/08/04 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} -  File not found

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKU\Lepschy_ON_C\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Lexmark X1100 Series] D:\Programme\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [UnlockerAssistant] D:\Programme\Unlocker\UnlockerAssistant.exe ()

O4 - HKU\.DEFAULT..\Run: [SvrWsc]  File not found

O4 - HKU\Lepschy_ON_C..\Run: [88AB0A2F] C:\WINDOWS\system32\76691A9388AB0A2F527D.exe ()

O4 - HKU\Lepschy_ON_C..\Run: [AOL Fast Start] D:\Programme\AOL 9.0 VR\AOL.EXE (AOL, LLC.)

O4 - HKU\Lepschy_ON_C..\Run: [SvrWsc]  File not found

O4 - HKU\NetworkService_ON_C..\Run: [SvrWsc]  File not found

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Basisschnittstelle Office SR V.5.02 Initialisierung.lnk = D:\DATEV\PROGRAMM\BSoffice\service\OfficeDiag.exe (DATEV eG)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\SkyUserDevmode-Update.lnk = D:\DATEV\PROGRAMM\B0001401\UpdateDevmode.exe (DATEV eG)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\Lepschy_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1

O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - D:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1260279216734 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1260279313562 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\76691A9388AB0A2F527D.exe) - C:\WINDOWS\system32\76691A9388AB0A2F527D.exe ()

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found

O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found

O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found

O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - D:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/12/08 18:15:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {0F1D198F-E5EA-4542-930E-2FB2B099F3F3} - LanaConfigTool_3383

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {A002744A-923D-F9FF-038B-2DB4BB54C25A} - Microsoft Windows Media Player 6.4

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

ActiveX: Microsoft Base Smart Card Crypto Provider Package - 

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/05/01 19:05:46 | 000,000,000 | -HSD | C] -- C:\FOUND.001

[2012/05/01 18:59:42 | 000,000,000 | -HSD | C] -- C:\FOUND.000

[2012/05/01 10:52:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Bxkur

[2012/05/01 04:51:53 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Rechnung

[2012/04/21 13:39:38 | 000,016,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll

[2012/04/21 13:23:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun

[2012/04/21 13:23:40 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java

[2012/04/21 13:23:19 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2012/04/21 13:23:18 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2012/04/21 13:23:18 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2012/04/21 13:23:18 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2012/04/21 13:23:18 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2012/04/21 13:04:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft-Maus

[2012/04/21 13:04:18 | 001,461,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WdfCoInstaller01009.dll

[2012/04/21 13:04:18 | 000,045,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\dc3d.sys

[2012/04/21 07:35:04 | 000,000,000 | ---D | C] -- D:\Programme\JDownloader

[2012/04/21 07:04:13 | 000,000,000 | ---D | C] -- D:\Programme\Microsoft IntelliPoint

[2012/04/17 03:23:38 | 000,000,000 | R--D | C] -- D:\Eigene Dateien\Eigene Bilder

[2012/04/07 11:32:19 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Lepschy\Recent

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/05/01 20:44:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012/05/01 20:43:28 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012/05/01 20:42:08 | 000,215,383 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2012/05/01 20:42:08 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2012/05/01 20:42:08 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-746137067-2052111302-839522115-1003.job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job

[2012/05/01 19:00:00 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{106E9005-5209-471D-A88B-1B5345A577D8}.job

[2012/05/01 18:43:34 | 000,000,054 | ---- | M] () -- C:\WINDOWS\System32\rp_stats.dat

[2012/05/01 18:43:34 | 000,000,039 | ---- | M] () -- C:\WINDOWS\System32\rp_rules.dat

[2012/05/01 10:54:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2012/05/01 10:53:56 | 000,000,099 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\locked-default.pls.hxpr

[2012/05/01 10:53:42 | 000,000,148 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\locked- Klicken Sie hier*.url.ikgi

[2012/05/01 10:53:38 | 000,000,182 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Desktop\locked-IP Adresse.url.konm

[2012/05/01 10:53:36 | 000,004,703 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\locked-EmptySettings.xml.lrow

[2012/05/01 10:52:12 | 000,046,080 | -H-- | M] () -- C:\WINDOWS\System32\76691A9388AB0A2F527D.exe

[2012/05/01 10:42:18 | 000,000,363 | ---- | M] () -- C:\WINDOWS\lexstat.ini

[2012/05/01 10:16:30 | 000,002,427 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Desktop\Microsoft Office Excel 2003.lnk

[2012/05/01 04:59:01 | 005,915,616 | ---- | M] () -- D:\Eigene Dateien\locked-telemodul_rechnungswesen_v1_21.exe.yvqy

[2012/05/01 04:59:00 | 008,730,608 | ---- | M] () -- D:\Eigene Dateien\locked-telemodul_due_rechnungswesen_pak00700_2_3.exe.fmvh

[2012/05/01 04:59:00 | 000,033,995 | ---- | M] () -- D:\Eigene Dateien\locked-Rechnung.zip.lbxr

[2012/05/01 04:59:00 | 000,004,065 | ---- | M] () -- D:\Eigene Dateien\locked-LSETUP.ANW.nfcl

[2012/05/01 04:59:00 | 000,003,247 | ---- | M] () -- D:\Eigene Dateien\locked-SSETUP.ANW.rzjp

[2012/05/01 04:58:11 | 000,614,925 | ---- | M] () -- D:\Eigene Dateien\locked-EI-Rechnungswesen-Daten pro 1961-2000-20110101 15012012 001.dvsdRW.eifa

[2012/04/30 17:29:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321

[2012/04/30 17:29:30 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320

[2012/04/30 17:28:00 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323

[2012/04/30 17:26:42 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322

[2012/04/28 12:23:24 | 000,002,427 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2003.lnk

[2012/04/26 18:38:10 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh325

[2012/04/26 18:37:48 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh324

[2012/04/26 12:09:50 | 000,002,395 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003.lnk

[2012/04/21 14:32:20 | 000,250,288 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012/04/21 14:30:50 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_point32_01009.Wdf

[2012/04/21 13:45:36 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-746137067-2052111302-839522115-1003.job

[2012/04/21 13:39:44 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_dc3d_01009.Wdf

[2012/04/21 13:39:42 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

[2012/04/21 13:35:32 | 000,001,612 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader.lnk

[2012/04/21 13:35:32 | 000,001,556 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Deinstallationsprogramm.lnk

[2012/04/21 13:35:32 | 000,001,535 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Update.lnk

[2012/04/21 13:23:12 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2012/04/21 13:23:12 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2012/04/21 13:23:12 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2012/04/21 13:23:12 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2012/04/21 13:23:12 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2012/04/21 13:04:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft-Maus

[2012/04/17 10:53:10 | 000,000,400 | ---- | M] () -- C:\WINDOWS\ODBC.INI

[2012/04/07 11:31:22 | 000,002,395 | ---- | M] () -- C:\Dokumente und Einstellungen\Lepschy\Desktop\Microsoft Office Word 2003.lnk

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012/05/01 19:01:25 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

[2012/05/01 19:01:25 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job

[2012/05/01 19:01:24 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job

[2012/05/01 19:01:24 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job

[2012/05/01 19:01:23 | 000,000,470 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job

[2012/05/01 18:43:32 | 000,000,054 | ---- | C] () -- C:\WINDOWS\System32\rp_stats.dat

[2012/05/01 18:43:32 | 000,000,039 | ---- | C] () -- C:\WINDOWS\System32\rp_rules.dat

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321

[2012/05/01 10:52:24 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320

[2012/05/01 10:52:10 | 000,046,080 | -H-- | C] () -- C:\WINDOWS\System32\76691A9388AB0A2F527D.exe

[2012/05/01 04:51:52 | 000,033,995 | ---- | C] () -- D:\Eigene Dateien\locked-Rechnung.zip.lbxr

[2012/04/21 14:30:49 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_point32_01009.Wdf

[2012/04/21 13:39:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_dc3d_01009.Wdf

[2012/04/21 13:39:41 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

[2012/04/21 13:35:30 | 000,001,612 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader.lnk

[2012/04/21 13:35:30 | 000,001,556 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Deinstallationsprogramm.lnk

[2012/04/21 13:35:30 | 000,001,535 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\JDownloader Update.lnk

[2012/01/14 14:18:18 | 000,248,914 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-746137067-2052111302-839522115-1003-0.dat

[2011/11/03 23:08:17 | 000,248,914 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011/11/03 22:17:44 | 000,004,703 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\locked-EmptySettings.xml.lrow

[2010/01/03 17:36:02 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2009/12/17 14:35:15 | 000,000,099 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\locked-default.pls.hxpr

[2009/12/17 14:34:57 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2009/12/17 13:27:41 | 000,000,363 | ---- | C] () -- C:\WINDOWS\lexstat.ini

[2009/12/17 13:27:30 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbkvs.dll

[2009/12/17 13:27:28 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBKLCNP.DLL

[2009/12/17 13:27:27 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\LXBKIH.EXE

[2009/12/17 13:27:23 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE

[2009/12/17 13:27:05 | 000,000,266 | ---- | C] () -- C:\WINDOWS\System32\lxbkcoin.ini

[2009/12/16 14:02:18 | 000,000,111 | ---- | C] () -- C:\WINDOWS\telephon.ini

[2009/12/16 13:26:24 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2009/12/16 12:37:35 | 000,012,632 | ---- | C] () -- C:\WINDOWS\System32\skypdfmonuipro.dll

[2009/12/16 12:37:34 | 000,014,680 | ---- | C] () -- C:\WINDOWS\System32\skypdfmonpro.dll

[2009/12/16 12:27:50 | 000,000,140 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2009/12/16 12:26:36 | 000,000,021 | ---- | C] () -- C:\WINDOWS\DvInesKurusOleServer003.INI

[2009/12/16 12:25:58 | 000,000,080 | ---- | C] () -- C:\WINDOWS\dvinesinstart001.INI

[2009/12/16 12:25:58 | 000,000,080 | ---- | C] () -- C:\WINDOWS\dvinesinstalllocation001.INI

[2009/12/16 12:25:51 | 000,000,081 | ---- | C] () -- C:\WINDOWS\Startup.INI

[2009/12/16 12:23:06 | 000,000,040 | ---- | C] () -- C:\WINDOWS\WISO.INI

[2009/12/16 12:23:03 | 000,304,640 | ---- | C] () -- C:\WINDOWS\System32\gsbest32.dll

[2009/12/16 12:21:43 | 000,229,888 | ---- | C] () -- C:\WINDOWS\fpuninst.exe

[2009/12/10 08:35:17 | 000,006,656 | ---- | C] () -- C:\Dokumente und Einstellungen\Lepschy\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009/12/09 10:42:25 | 000,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe

[2009/12/08 18:16:11 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2009/12/08 18:13:04 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2009/12/08 17:54:27 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2009/12/08 17:53:35 | 000,250,288 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2009/12/08 14:39:42 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009/12/08 14:10:55 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll

[2009/12/08 14:06:06 | 000,207,400 | R--- | C] () -- C:\WINDOWS\GSetup.exe

[2009/12/08 14:06:06 | 000,000,010 | ---- | C] () -- C:\WINDOWS\GSetup.ini

[2009/09/30 12:05:48 | 000,290,816 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v60.dll

[2009/03/28 00:03:00 | 001,724,416 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2009/03/28 00:03:00 | 001,657,376 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2009/03/28 00:03:00 | 001,503,232 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2009/03/28 00:03:00 | 001,346,080 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2009/03/28 00:03:00 | 001,101,824 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2009/03/28 00:03:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2009/03/28 00:03:00 | 000,449,056 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2009/03/28 00:03:00 | 000,436,768 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe

[2008/10/30 18:00:22 | 000,048,640 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v60.dll

[2008/10/30 17:59:24 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v60.dll

[2008/05/26 22:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini

[2008/05/26 22:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini

[2008/05/26 22:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini

[2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin

[2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin

[2004/12/14 17:55:22 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll

[2004/12/14 17:55:22 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll

[2004/12/14 17:55:22 | 000,000,019 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll

[2004/08/04 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2004/08/04 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004/08/04 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004/08/04 12:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2004/08/04 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004/08/04 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004/08/04 12:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2004/08/04 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004/08/04 12:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004/08/04 12:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2004/08/04 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2004/08/04 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2003/02/20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[1999/01/19 15:18:30 | 000,110,080 | ---- | C] () -- C:\WINDOWS\System32\LFPNG60N.DLL

[1999/01/19 15:18:30 | 000,046,080 | ---- | C] () -- C:\WINDOWS\System32\LFTIF60N.DLL

[1999/01/19 15:18:30 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\LTFIL60N.DLL

[1999/01/19 15:18:30 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LFPSD60N.DLL

[1999/01/19 15:18:30 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFTGA60N.DLL

[1999/01/19 15:18:30 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWPG60N.DLL

[1999/01/19 15:18:30 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWMF60N.DLL

[1999/01/19 15:18:28 | 000,176,128 | ---- | C] () -- C:\WINDOWS\System32\LFFAX60N.DLL

[1999/01/19 15:18:28 | 000,141,824 | ---- | C] () -- C:\WINDOWS\System32\LFCMP60N.DLL

[1999/01/19 15:18:28 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\LFPCX60N.DLL

[1999/01/19 15:18:28 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFPCT60N.DLL

[1999/01/19 15:18:28 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFEPS60N.DLL

[1999/01/19 15:18:28 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFBMP60N.DLL

[1999/01/19 15:18:28 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\LFMSP60N.DLL

[1999/01/19 15:18:28 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\LFMAC60N.DLL

[1995/02/15 00:11:00 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\IMPLODE.DLL

 
 ========== LOP Check ==========

 

[2009/12/08 16:07:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Windows Desktop Search

[2009/12/08 16:58:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Windows Search

[2011/11/01 13:35:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\ImgBurn

[2011/11/01 14:44:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\DATEV

[2012/01/16 17:11:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\QuickStoresToolbar

[2012/05/01 10:52:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lepschy\Anwendungsdaten\Bxkur

[2009/12/08 17:13:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp

[2009/12/09 10:10:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}

[2009/12/09 10:15:24 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

[2009/12/16 12:37:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SkyCom

[2009/12/16 13:30:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Viewpoint

[2009/12/17 15:37:10 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D800E57D-1D89-4AFD-8B05-A59C225431C4}

[2011/01/07 15:04:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DATEV

[2012/05/01 19:00:00 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{106E9005-5209-471D-A88B-1B5345A577D8}.job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job

[2012/05/01 19:01:26 | 000,000,470 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2009/12/08 17:48:46 | 000,000,000 | ---D | M] -- C:\WINDOWS

[2009/12/08 17:53:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen

[2009/12/08 18:14:30 | 000,000,000 | R--D | M] -- C:\Programme

[2009/12/08 18:38:04 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2012/05/01 18:59:42 | 000,000,000 | -HSD | M] -- C:\FOUND.000

[2009/12/16 13:43:12 | 000,000,000 | ---D | M] -- C:\DASSDVS

[2012/01/17 08:38:02 | 000,000,000 | ---D | M] -- C:\DATEV

[2012/05/01 19:05:46 | 000,000,000 | -HSD | M] -- C:\FOUND.001

[2009/12/08 14:07:22 | 000,000,000 | ---D | M] -- C:\Intel

[2009/12/08 14:33:20 | 000,000,000 | -HSD | M] -- C:\Recycled

 
 < %PROGRAMFILES%\*.exe >

 

Invalid Environment Variable: %LOCALAPPDATA%\*.exe

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\agp440.sys

[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\atapi.sys

[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004/08/04 12:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys

[2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008/04/14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\eventlog.dll

[2008/04/14 07:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

 
 < MD5 for: EXPLORER.EXE  >

[2008/04/14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe

[2008/04/14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\explorer.exe

 
 < MD5 for: NETLOGON.DLL  >

[2008/04/14 03:22:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\netlogon.dll

[2008/04/14 07:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008/04/14 03:22:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\scecli.dll

[2008/04/14 07:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2008/04/14 03:22:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\user32.dll

[2008/04/14 07:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008/04/14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\userinit.exe

[2008/04/14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2008/04/14 03:23:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\a746b2abbbec3e139e29152ba22decd1\winlogon.exe

[2008/04/14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2004/08/04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004/08/04 12:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2009/12/08 17:52:46 | 000,446,464 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

[2009/12/08 17:52:46 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2009/12/08 17:52:46 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2007/10/25 09:28:30 | 000,222,720 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\wmasf.dll

[2009/09/25 06:35:26 | 001,509,888 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shdocvw.dll

[2008/04/14 07:52:08 | 001,025,024 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\browseui.dll

[2008/04/14 07:52:10 | 000,102,912 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\cscdll.dll

[2008/04/14 07:52:10 | 000,025,600 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\davclnt.dll

[2008/04/14 07:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\drprov.dll

[2008/04/14 07:52:20 | 000,011,776 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\netrap.dll

[2006/10/18 21:47:08 | 000,276,992 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\audiodev.dll

[2009/06/25 09:25:24 | 000,056,832 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\secur32.dll

[2006/10/18 21:47:18 | 000,284,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\PortableDeviceApi.dll

[2006/10/18 21:47:22 | 002,603,008 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\WpdShext.dll

[2011/03/03 08:54:44 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll

[2008/04/14 07:52:20 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll

[2011/01/21 15:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll

[2008/04/14 07:52:26 | 000,068,096 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shgina.dll

[2011/08/23 01:41:32 | 002,000,384 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll

[2011/08/23 17:41:32 | 011,081,728 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll

[2008/04/14 07:52:22 | 000,044,032 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntlanman.dll

[2008/04/14 07:52:22 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll

[2008/04/14 07:52:22 | 000,245,760 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\netui1.dll

[2008/04/14 07:52:22 | 000,081,920 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\netui0.dll

[2008/04/14 07:52:10 | 000,334,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\cscui.dll

[2008/04/14 07:52:24 | 000,064,000 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\samlib.dll

[2010/04/06 04:52:46 | 002,462,720 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\WMVCore.dll

[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 

Invalid Environment Variable: %USERPROFILE%\*.*

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll

 

Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe

< End of report >

Ich hoffe, jemand kann mit den zwei Log-Files etwas anfangen und mir helfen.

Vielen Dank schonmal im voraus.