Trojaner-Board - gvu trojaner auf winxp ohne gesicherten modus entfernen

Hallo, ich habe mir eben gerade auf meinem etwas älteren WINXP laptop den GVU tronjaner eingefangen. Ich habe sonst immer über den ges. modus die .exe gelöscht, aber das geht nun bei winXP nicht.

Habe mir bereits OTLPEN geladen, gebrannt, und führe dieses gerade durch. Ich werde gleich die txt datei hier reinsetzen und hoffe das mir abhilfe geschaffen werden kann!

Okay hier die txt *ich weiss nicht wie ich direkt ne txt einfuege deshalb kopier ichs einfach mal rein
Code:
OTL logfile created on: 3/2/2013 1:23:40 AM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM

Internet Explorer (Version = 7.0.5730.11)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free

3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 60.00 Gb Total Space | 33.61 Gb Free Space | 56.02% Space Free | Partition Type: NTFS

Drive E: | 172.88 Gb Total Space | 97.20 Gb Free Space | 56.22% Space Free | Partition Type: NTFS

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [On_Demand] --  -- (NMIndexingService)

SRV - [2013/03/01 18:15:52 | 000,106,496 | ---- | M] (Корпорация Майкрософт) [Auto] -- C:\Dokumente und Einstellungen\lars\6152588.dll -- (winmgmt)

SRV - [2013/02/27 08:49:15 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013/01/08 06:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2011/09/16 06:36:58 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2011/07/19 22:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2010/03/04 16:38:00 | 000,071,096 | ---- | M] () [Auto] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)

SRV - [2010/02/10 05:54:12 | 000,151,552 | ---- | M] (VMware, Inc.) [Auto] -- C:\Programme\VMware\VMware View\Client\bin\wsnm.exe -- (wsnm)

SRV - [2009/10/08 22:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Programme\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0)

SRV - [2008/03/17 23:27:12 | 000,013,312 | R--- | M] (Agere Systems) [Auto] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2006/12/02 00:28:10 | 002,805,000 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Programme\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)

SRV - [2006/10/26 07:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2006/10/26 06:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand] --  -- (WDICA)

DRV - File not found [Kernel | On_Demand] --  -- (smserial)

DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)

DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)

DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)

DRV - File not found [Kernel | System] --  -- (PCIDump)

DRV - File not found [Kernel | System] --  -- (lbrtfdc)

DRV - File not found [Kernel | System] --  -- (i2omgmt)

DRV - File not found [Kernel | System] --  -- (Changer)

DRV - [2011/12/04 09:49:55 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2010/02/10 05:48:56 | 000,026,928 | ---- | M] (VMware, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\WSUSBDMAN.sys -- (WSUSBDMAN)

DRV - [2009/11/12 07:48:56 | 000,005,504 | ---- | M] () [File_System | Auto] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2009/10/05 04:08:42 | 000,065,584 | ---- | M] (Citrix Systems, Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\ctxusbm.sys -- (ctxusbm)

DRV - [2008/07/31 08:35:00 | 004,751,872 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2008/06/30 22:27:44 | 000,108,800 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2008/06/09 06:53:00 | 000,038,304 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)

DRV - [2008/04/27 17:14:54 | 003,626,112 | R--- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel(R)

DRV - [2008/03/20 23:13:00 | 001,203,776 | R--- | M] (Agere Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2007/12/09 23:21:26 | 000,539,640 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)

DRV - [2007/11/27 02:40:38 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)

DRV - [2007/11/20 21:51:30 | 000,879,624 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)

DRV - [2007/06/28 22:38:30 | 000,156,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)

DRV - [2007/03/30 23:02:40 | 000,055,352 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwhid.sys -- (btwhid)

DRV - [2007/03/22 20:50:08 | 000,037,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)

DRV - [2007/03/12 21:12:00 | 000,255,232 | ---- | M] (Marvell) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)

DRV - [2007/02/24 17:05:24 | 002,203,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R)

DRV - [2007/01/31 20:38:54 | 000,033,792 | R--- | M] (KM Software Team) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\qkbfiltr.sys -- (qkbfiltr)

DRV - [2007/01/23 06:13:26 | 000,036,608 | R--- | M] (Infineon Technologies AG) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)

DRV - [2006/07/06 00:44:00 | 000,168,448 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)

DRV - [2005/12/01 12:43:16 | 000,062,848 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfhid.sys -- (Tosrfhid)

DRV - [2005/11/24 06:37:36 | 000,047,104 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)

DRV - [2005/11/22 14:29:58 | 000,108,800 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfbd.sys -- (Tosrfbd)

DRV - [2005/11/15 15:36:20 | 000,036,736 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)

DRV - [2005/11/11 08:09:52 | 000,052,864 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfsnd.sys -- (TosRfSnd) Bluetooth Audio Device (WDM)

DRV - [2005/09/15 11:06:08 | 000,036,480 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (Tosrfbnp)

DRV - [2005/08/01 09:45:08 | 000,064,896 | ---- | M] (TOSHIBA Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)

DRV - [2005/07/11 11:58:56 | 000,003,712 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\toshidpt.sys -- (toshidpt)

DRV - [2005/01/06 06:42:42 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchab.com/?aff=7&uid=2bfc1746-69b9-11e2-8ccc-00238b3de8ed

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\lars_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchab.com/?aff=7&uid=2bfc1746-69b9-11e2-8ccc-00238b3de8ed

IE - HKU\lars_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\support_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKU\support_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\support_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 172.20.21.253:8080

 

 

IE - HKU\User_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013/02/27 08:49:17 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013/02/27 08:49:02 | 000,000,000 | ---D | M]

 

[2013/02/27 08:48:52 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2013/02/27 08:49:16 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2010/03/10 18:01:02 | 000,124,272 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\CCMSDK.dll

[2010/03/10 18:02:52 | 000,070,512 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\CgpCore.dll

[2010/03/10 18:01:48 | 000,091,504 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\confmgr.dll

[2010/03/10 18:01:24 | 000,022,384 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\ctxlogging.dll

[2011/10/02 23:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2010/03/10 18:40:56 | 000,423,248 | ---- | M] () -- C:\Programme\mozilla firefox\plugins\npicaN.dll

[2010/03/10 18:02:48 | 000,023,920 | ---- | M] (Citrix Systems, Inc.) -- C:\Programme\mozilla firefox\plugins\TcpPServ.dll

[2013/02/27 08:49:11 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2013/02/27 08:49:11 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2013/02/27 08:49:11 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2013/02/27 08:49:11 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2013/02/27 08:49:11 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2013/02/27 08:49:11 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2012/03/02 04:17:45 | 000,000,882 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1 activate.adobe.com

O1 - Hosts: 127.0.0.1 practivate.adobe.com

O2 - BHO: (Zoomex) - {F613EBE1-81FB-E932-19D7-79B6B08F51A1} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zoomex\5107359c8b120.dll ()

O4 - HKLM..\Run: [AdobeAAMUpdater-1.0]  File not found

O4 - HKLM..\Run: [AdobeCS5ServiceManager]  File not found

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)

O4 - HKLM..\Run: [ConnectionCenter] C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)

O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\isuspm.exe (Macrovision Corporation)

O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (Macrovision Corporation)

O4 - HKLM..\Run: [Keyboard Manager Utility] C:\Programme\Keyboard Manager\Manager Utility\KeyboardManager.exe (Quanta Computer, INC.)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKU\Administrator_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found

O4 - HKU\lars_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found

O4 - HKU\lars_ON_C..\Run: [KB2508429]  File not found

O4 - HKU\lars_ON_C..\Run: [KB2544893-v2]  File not found

O4 - HKU\lars_ON_C..\Run: [KB951072-v2]  File not found

O4 - HKU\lars_ON_C..\Run: [KB959426]  File not found

O4 - HKU\lars_ON_C..\Run: [KB974318]  File not found

O4 - HKU\support_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found

O4 - HKU\User_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found

O4 - HKU\User_ON_C..\Run: [KB2618444-IE7]  File not found

O4 - HKU\User_ON_C..\Run: [KB973869] C:\Dokumente und Einstellungen\User\Anwendungsdaten\KB973869\KB973869.exe ()

O4 - HKU\lars_ON_C..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil11e_Plugin.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

O4 - Startup: C:\Dokumente und Einstellungen\lars\Startmenü\Programme\Autostart\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)

F3 - HKU\lars_ON_C WinNT: Load - (C:\DOKUME~1\lars\EIGENE~1\KB959426\KB959426.com) -  File not found

F3 - HKU\lars_ON_C WinNT: Run - (C:\DOKUME~1\lars\EIGENE~1\KB959426\KB959426.com) -  File not found

F3 - HKU\User_ON_C WinNT: Load - (C:\DOKUME~1\User\ANWEND~1\KB973869\KB973869.exe) - C:\DOKUME~1\User\ANWEND~1\KB973869\KB973869.exe ()

F3 - HKU\User_ON_C WinNT: Run - (C:\DOKUME~1\User\ANWEND~1\KB973869\KB973869.exe) - C:\DOKUME~1\User\ANWEND~1\KB973869\KB973869.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\lars_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\lars_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: KB2508429 = C:\Dokumente und Einstellungen\lars\Eigene Dateien\KB2508429\KB2508429.com

O7 - HKU\lars_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: KB951072-v2 = C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\KB951072-v2\KB951072-v2.exe

O7 - HKU\lars_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: KB2544893-v2 = C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\KB2544893-v2\KB2544893-v2.com

O7 - HKU\lars_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: KB974318 = C:\Dokumente und Einstellungen\lars\Eigene Dateien\KB974318\KB974318.com

O7 - HKU\lars_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: KB959426 = C:\Dokumente und Einstellungen\lars\Eigene Dateien\KB959426\KB959426.com

O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\support_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\support_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1

O7 - HKU\support_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceStartMenuLogOff = 1

O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: KB2618444-IE7 = C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\KB2618444-IE7\KB2618444-IE7.exe

O7 - HKU\User_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: KB973869 = C:\Dokumente und Einstellungen\User\Anwendungsdaten\KB973869\KB973869.exe ()

O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1233235496935 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (c:\progra~1\zoomex\sprote~1.dll) - C:\Programme\ZoomEx\sprotector.dll ()

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: 

O24 - Desktop BackupWallPaper: 

O30 - LSA: Security Packages - (wsauth) - C:\WINDOWS\System32\wsauth.dll (VMware, Inc.)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007/08/01 02:30:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {01FF51E9-C771-4CD3-AD62-C9FB5AEF55A5} - Security Update für Microsoft Visual Studio 2005 Professional Edition - DEU (KB2538218)

ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)

ActiveX: {0835A5D5-91C3-4ACD-8256-30C23DEBC6F7} - Microsoft Visual Studio 2005 Professional Edition - DEU Service Pack 1 (KB926606)

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {23036C23-ECDE-47F5-A908-BEC94EE0456F} - Security Update für Microsoft Visual Studio 2005 Professional Edition - DEU (KB2251481)

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {66DA9ADD-B1C4-4891-84D6-706E216B411B} - Security Update für Microsoft Visual Studio 2005 Professional Edition - DEU (KB947738)

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework

ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {964C8238-245C-4475-BB6E-D19D2C1220F2} - Security Update für Microsoft Visual Studio 2005 Professional Edition - DEU (KB973673)

ActiveX: {9C0C5CF3-3A34-482B-B46D-839EA890F1FC} - Security Update für Microsoft Visual Studio 2005 Professional Edition - DEU (KB2548826)

ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework

ActiveX: {BECB938C-6BC2-48C6-A0A6-4B61E85F584C} - Security Update für Microsoft Visual Studio 2005 Professional Edition - DEU (KB971090)

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {ECD292A0-0347-4244-8C24-5DBCE990FB40} - Hotfix for Microsoft .NET Framework 3.0 (KB932471)

ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: winmgmt - C:\Dokumente und Einstellungen\lars\6152588.dll (Корпорация Майкрософт)

 

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013/03/01 18:15:52 | 000,106,496 | ---- | C] (Корпорация Майкрософт) -- C:\Dokumente und Einstellungen\lars\6152588.dll

[2013/02/27 08:48:47 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox

[2013/02/26 04:09:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\lars\AbiSuite

[2013/02/26 04:09:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\lars\Startmenü\Programme\AbiWord Word Processor

[2013/02/26 04:09:07 | 000,000,000 | ---D | C] -- C:\Programme\AbiWord

[2013/02/25 09:20:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe

[2013/02/25 04:19:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\lars\Anwendungsdaten\Adobe

[2013/02/24 12:59:42 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\KB2633171

[2013/02/24 12:59:39 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\KB2544521-IE7

[2013/02/24 12:58:22 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\KB973869

[2013/02/24 12:58:22 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\KB2619339

[2013/02/24 12:40:02 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\KB2618444-IE7

[2013/02/24 12:39:58 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\KB977914

[2013/02/24 12:39:55 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\KB2360937

[2013/02/24 12:39:49 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Wudf01000

[2013/02/24 12:39:40 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\KB2506212

[2013/02/24 12:39:35 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\MSI30-KB884016

[2013/02/24 12:39:31 | 000,000,000 | -HSD | C] -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\KB972270

[2013/02/24 07:48:49 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\lars\Eigene Dateien\KB974318

[2013/02/24 07:48:49 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\lars\Eigene Dateien\KB959426

[2013/02/24 05:15:43 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\lars\Eigene Dateien\KB886612

[2013/02/24 05:15:43 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\KB2544893-v2

[2013/02/23 07:22:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

[2013/02/23 07:21:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AoA Audio Extractor

[2013/02/23 07:21:08 | 000,086,683 | ---- | C] (Open Source Software community project) -- C:\WINDOWS\System32\pthreadGC2.dll

[2013/02/23 07:21:08 | 000,000,000 | ---D | C] -- C:\Programme\AoA Audio Extractor

[2013/02/23 07:16:39 | 000,000,000 | ---D | C] -- C:\Fraps

[2013/02/23 07:16:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Fraps

[2013/02/23 05:18:51 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\lars\Eigene Dateien\NVIDIA Drivers

[2013/02/23 05:18:51 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\KB951072-v2

[2013/02/22 13:25:36 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\lars\Eigene Dateien\KB2508429

[2013/02/06 15:08:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Skype

[2013/02/06 15:08:12 | 000,000,000 | R--D | C] -- C:\Programme\Skype

[2013/02/06 15:08:12 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype

[2013/02/06 15:08:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013/03/01 18:35:52 | 095,023,320 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\8852516.pad

[2013/03/01 18:34:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2013/03/01 18:20:59 | 000,000,528 | -H-- | M] () -- C:\WINDOWS\tasks\ZoomExUpdaterTask{7D227F66-51AA-401C-9511-68B69EBC5EC3}.job

[2013/03/01 18:15:57 | 000,002,771 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\8852516.js

[2013/03/01 18:15:57 | 000,000,776 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Startmenü\Programme\Autostart\runctf.lnk

[2013/03/01 18:15:52 | 000,106,496 | ---- | M] (Корпорация Майкрософт) -- C:\Dokumente und Einstellungen\lars\6152588.dll

[2013/03/01 09:43:52 | 000,189,259 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2013/02/28 20:00:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-T809-3DE8ED-Blindow.job

[2013/02/28 20:00:00 | 000,000,344 | ---- | M] () -- C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-T809-3DE8ED-lars.job

[2013/02/27 11:46:30 | 000,195,094 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\kfw.pdf

[2013/02/27 11:30:40 | 000,195,369 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\Immatrikulationsbescheinigung136ace94-37e9-4c3b-ab3f-e927746943bb.pdf

[2013/02/26 20:07:30 | 000,038,739 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\ichwillmeinechipstraurig.JPG

[2013/02/26 04:07:22 | 000,017,941 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\Inhaltreflektion.abw

[2013/02/25 16:36:31 | 000,075,017 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\hurrdurr.JPG

[2013/02/25 04:15:46 | 004,864,016 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Eigene Dateien\hrnshn.psd

[2013/02/25 04:14:14 | 000,765,279 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\hrnshn.gif

[2013/02/25 04:14:14 | 000,001,456 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\Adobe Für Web speichern 12.0 Prefs

[2013/02/25 03:11:22 | 000,053,432 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\hrnshn.png.jpeg

[2013/02/23 15:15:59 | 000,012,428 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\liht.JPG

[2013/02/23 10:51:52 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk

[2013/02/23 10:51:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Skype

[2013/02/23 07:29:40 | 005,399,429 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\Beyoncé - Halo.mp3

[2013/02/23 07:22:50 | 000,306,023 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\vlc 2013-02-23 13-17-43-06.mp3

[2013/02/23 07:21:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\AoA Audio Extractor

[2013/02/23 07:18:12 | 000,004,608 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013/02/23 07:16:39 | 000,000,484 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Fraps.lnk

[2013/02/23 07:16:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Fraps

[2013/02/22 10:38:39 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2013/01/31 04:12:15 | 007,814,627 | ---- | M] () -- C:\Dokumente und Einstellungen\lars\Desktop\Röyksopp - Sparks.mp3

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013/03/01 18:15:57 | 000,002,771 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\8852516.js

[2013/03/01 18:15:57 | 000,000,776 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Startmenü\Programme\Autostart\runctf.lnk

[2013/03/01 18:15:55 | 095,023,320 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\8852516.pad

[2013/02/27 11:46:29 | 000,195,094 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\kfw.pdf

[2013/02/27 11:30:39 | 000,195,369 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\Immatrikulationsbescheinigung136ace94-37e9-4c3b-ab3f-e927746943bb.pdf

[2013/02/26 20:07:30 | 000,038,739 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\ichwillmeinechipstraurig.JPG

[2013/02/26 04:07:21 | 000,017,941 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\Inhaltreflektion.abw

[2013/02/25 16:36:31 | 000,075,017 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\hurrdurr.JPG

[2013/02/25 04:15:38 | 004,864,016 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Eigene Dateien\hrnshn.psd

[2013/02/25 04:14:14 | 000,001,456 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\Adobe Für Web speichern 12.0 Prefs

[2013/02/25 04:14:13 | 000,765,279 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\hrnshn.gif

[2013/02/25 03:11:17 | 000,053,432 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\hrnshn.png.jpeg

[2013/02/23 15:15:59 | 000,012,428 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\liht.JPG

[2013/02/23 07:29:32 | 005,399,429 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\Beyoncé - Halo.mp3

[2013/02/23 07:22:44 | 000,306,023 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\vlc 2013-02-23 13-17-43-06.mp3

[2013/02/23 07:18:11 | 000,004,608 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2013/02/23 07:16:39 | 000,000,484 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Fraps.lnk

[2013/02/06 15:08:12 | 000,002,243 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk

[2013/01/31 04:12:14 | 007,814,627 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Desktop\Röyksopp - Sparks.mp3

[2012/12/26 19:03:11 | 000,438,272 | ---- | C] () -- C:\WINDOWS\System32\PaintX.dll

[2012/12/24 11:46:53 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\lars\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2012/04/30 09:06:08 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2011/12/25 12:48:01 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2011/12/09 11:56:08 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys

[2011/12/08 06:09:02 | 000,012,288 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/12/06 14:05:02 | 000,058,876 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2011/11/30 08:09:46 | 000,185,443 | ---- | C] () -- C:\WINDOWS\hphins25.dat

[2011/11/30 08:09:45 | 000,000,795 | ---- | C] () -- C:\WINDOWS\hphmdl25.dat

[2011/09/16 06:33:55 | 000,000,051 | ---- | C] () -- C:\WINDOWS\smsts.ini

[2008/06/09 06:53:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2008/06/09 06:53:00 | 001,630,208 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2008/06/09 06:53:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2008/06/09 06:53:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2008/06/09 06:53:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2008/06/09 06:53:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2008/06/09 06:53:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2008/02/01 11:11:57 | 000,002,732 | RHS- | C] () -- C:\Dokumente und Einstellungen\support\ntuser.pol

[2008/02/01 11:11:53 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\support\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2007/12/20 10:56:26 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll

[2007/08/15 03:13:36 | 000,000,028 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007/08/14 04:42:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2007/08/14 04:25:39 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI

[2007/08/14 03:22:05 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\User\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2007/08/14 03:21:58 | 000,000,146 | ---- | C] () -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2007/08/01 08:31:47 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2007/08/01 03:26:12 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2007/08/01 03:25:39 | 000,280,536 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2007/08/01 03:17:30 | 001,018,748 | ---- | C] () -- C:\WINDOWS\System32\nvucode.bin

[2007/08/01 03:17:02 | 000,002,480 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2007/08/01 03:16:51 | 000,463,354 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2007/08/01 03:16:51 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2007/08/01 03:16:51 | 000,086,180 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2007/08/01 03:16:51 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2007/08/01 03:16:39 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2007/08/01 03:16:37 | 000,444,810 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2007/08/01 03:16:37 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2007/08/01 03:16:37 | 000,072,686 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2007/08/01 03:16:37 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2007/08/01 03:16:37 | 000,004,518 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2007/08/01 03:16:36 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2007/08/01 03:16:34 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2007/08/01 03:16:30 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2007/08/01 03:16:30 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2007/08/01 03:16:26 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2007/08/01 03:16:22 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2007/08/01 02:42:45 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2007/08/01 02:39:33 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2007/08/01 02:34:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2007/08/01 02:28:43 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2001/11/14 06:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

 
 ========== LOP Check ==========

 

[2008/02/04 06:06:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Infineon

[2013/01/28 21:09:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\lars\Anwendungsdaten\Canneverbe Limited

[2013/01/03 11:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\lars\Anwendungsdaten\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2012/12/24 11:47:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\lars\Anwendungsdaten\ICAClient

[2008/02/04 06:06:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\lars\Anwendungsdaten\Infineon

[2013/03/01 06:39:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\lars\Anwendungsdaten\TS3Client

[2008/02/04 06:06:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\support\Anwendungsdaten\Infineon

[2012/10/11 09:48:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\.purple

[2011/12/09 11:56:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Canneverbe Limited

[2011/12/04 09:50:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\DAEMON Tools Lite

[2011/11/26 06:40:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\ICAClient

[2008/02/04 06:06:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Infineon

[2013/02/24 12:39:55 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\KB2360937

[2013/02/24 12:58:23 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\KB973869

[2011/11/26 11:08:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\LolClient

[2011/11/29 08:39:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\TS3Client

[2011/11/29 07:45:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\ts3overlay

[2011/12/09 11:56:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited

[2011/11/26 06:36:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Citrix

[2013/01/28 21:11:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ClickIT

[2011/12/04 08:58:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite

[2012/03/02 04:53:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\espionServerData

[2008/02/04 06:06:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Infineon

[2013/01/28 21:11:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\InstallMate

[2011/12/01 09:58:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files

[2013/01/28 21:11:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Premium

[2013/02/23 07:22:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

[2013/02/24 15:41:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zoomex

[2013/03/01 18:20:59 | 000,000,528 | -H-- | M] () -- C:\WINDOWS\Tasks\ZoomExUpdaterTask{7D227F66-51AA-401C-9511-68B69EBC5EC3}.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2013/02/26 04:09:22 | 000,000,000 | -H-D | M] -- C:\Config.Msi

[2012/12/24 11:46:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen

[2008/02/01 03:22:54 | 000,000,000 | -H-D | M] -- C:\Drivers

[2013/02/23 07:17:32 | 000,000,000 | ---D | M] -- C:\Fraps

[2011/09/17 06:42:32 | 000,000,000 | ---D | M] -- C:\Install

[2009/01/29 07:01:26 | 000,000,000 | ---D | M] -- C:\Intel

[2013/02/27 09:11:29 | 000,000,000 | R--D | M] -- C:\Programme

[2012/12/24 11:47:22 | 000,000,000 | -HSD | M] -- C:\RECYCLER

[2011/09/16 06:38:29 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2013/03/01 18:27:36 | 000,000,000 | ---D | M] -- C:\WINDOWS

 
 < %PROGRAMFILES%\*.exe >

 

Invalid Environment Variable: %LOCALAPPDATA%\*.exe

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: AGP440.SYS  >

[2006/02/28 07:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008/04/14 01:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2008/04/14 01:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008/04/13 17:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008/04/13 17:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2006/02/28 07:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008/04/14 01:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2008/04/14 01:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008/04/13 17:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008/04/13 18:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys

[2008/04/13 18:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2008/04/13 17:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0029\DriverFiles\i386\atapi.sys

[2008/04/13 18:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0030\DriverFiles\i386\atapi.sys

[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

[2006/02/28 07:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008/04/14 00:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008/04/14 00:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2006/02/28 07:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: EXPLORER.EXE  >

[2007/06/13 08:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe

[2008/04/14 00:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe

[2008/04/14 00:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe

[2007/06/13 08:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

 
 < MD5 for: IASTOR.SYS  >

[2007/02/12 06:36:54 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\WINDOWS\OemDir\iaStor.sys

[2007/02/12 06:36:54 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\WINDOWS\system32\drivers\iaStor.sys

 
 < MD5 for: NETLOGON.DLL  >

[2008/04/14 00:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008/04/14 00:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2006/02/28 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008/04/14 00:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008/04/14 00:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2006/02/28 07:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007/03/08 10:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005/03/02 13:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2007/03/08 10:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008/04/14 00:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008/04/14 00:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008/04/14 00:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008/04/14 00:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2006/02/28 07:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2006/02/28 07:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008/04/14 00:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008/04/14 00:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2006/02/28 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2006/02/28 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2007/08/01 04:25:12 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2007/08/01 04:25:12 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2007/08/01 04:25:11 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\system32\*.dll /lockedfiles >

[2011/03/03 01:54:43 | 000,149,504 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll

[2012/02/29 20:15:30 | 006,076,928 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ieframe.dll

[2012/02/29 20:15:30 | 000,268,288 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iertutil.dll

[2008/04/14 00:52:20 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll

[2008/04/14 00:52:22 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll

[2008/04/14 00:52:24 | 000,023,040 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\psapi.dll

[2011/01/21 09:44:10 | 008,503,296 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

 

Invalid Environment Variable: %USERPROFILE%\*.*

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe

 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll

 

Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe

< End of report >