| |  nach GEMA Virus kein Zugriff auf den Rechner
 Hallo Versuche meinem Kumpel zu helfen,
folgende Symptome sind vorhanden:
Nach einem Rot-Weisen Bildschirm mit der Aufforderung der GEMA zur Zahlung war der Desktop Clean.
Der Taskmanager ist durch den Administrator gesperrt. Sämtliche Versionen des Abgesicherten Modus enden auch nur im leeren Desktop.
Hier der LOG OTL.TXT: Zitat:
OTL logfile created on: 12/14/2011 9:00:58 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
1,023.00 Mb Total Physical Memory | 823.00 Mb Available Physical Memory | 80.00% Memory free
907.00 Mb Paging File | 847.00 Mb Available in Paging File | 93.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74.52 Gb Total Space | 43.82 Gb Free Space | 58.80% Space Free | Partition Type: NTFS
Drive D: | 76.33 Gb Total Space | 75.94 Gb Free Space | 99.49% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 95.16 Gb Free Space | 40.86% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled] -- -- (HidServ)
SRV - [2011/10/11 07:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/11 07:59:39 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2011/10/11 07:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/10/15 18:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2008/04/14 00:52:46 | 000,971,952 | ---- | M] (Salfeld Computer) [Auto] -- C:\WINDOWS\system32\cchservice.exe -- (Windows-CCHook-Service)
SRV - [2007/08/09 02:27:52 | 000,073,728 | ---- | M] (HP) [Auto] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2003/07/28 05:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2011/10/11 08:00:01 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/10/11 08:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/10/11 08:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010/06/17 08:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/09/27 07:07:30 | 000,099,840 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\ACEDRV06.sys -- (ACEDRV06)
DRV - [2008/12/15 16:30:45 | 000,005,632 | ---- | M] () [File_System | System] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008/04/13 18:15:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2008/04/13 16:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2001/08/17 06:19:34 | 000,040,704 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://startsear.ch/?aff=2&cf=3c229764-179c-11e1-b313-00116b36ddc5
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Lothar_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://startsear.ch/?aff=2&cf=3c229764-179c-11e1-b313-00116b36ddc5
IE - HKU\Lothar_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Max_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Programme\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5018 [2011/06/15 13:10:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/11/11 14:56:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/11/25 14:33:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011/09/23 01:21:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
[2011/11/13 13:07:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011/11/13 13:07:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011/11/11 14:56:42 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011/10/02 23:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/27 08:45:50 | 000,083,456 | ---- | M] (LiveVDO ) -- C:\Programme\mozilla firefox\plugins\npvsharetvplg.dll
[2011/10/06 01:42:03 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/10/06 01:42:03 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011/10/06 01:42:03 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011/10/06 01:42:03 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/09/11 10:03:06 | 000,002,506 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\SearchResults.xml
[2011/10/06 01:42:03 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/10/06 01:42:03 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2001/08/23 07:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Programme\LiveVDO.tv plugin\ssBarLcher.dll (StartSearch Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (Loader Class) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Programme\LiveVDO.tv plugin\ssBarLcher.dll (StartSearch Inc.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\Lothar_ON_C\..\Toolbar\WebBrowser: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Programme\LiveVDO.tv plugin\ssBarLcher.dll (StartSearch Inc.)
O3 - HKU\Lothar_ON_C\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [6zvcaxR5ls4KB9Y] C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe (anno aliti)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ChicoSys] C:\WINDOWS\system32\cc32\webtmr.exe (Salfeld Computer)
O4 - HKU\Lothar_ON_C..\Run: [6zvcaxR5ls4KB9Y] C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe (anno aliti)
O4 - HKU\Lothar_ON_C..\Run: [CCWinTray] C:\WINDOWS\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\Lothar_ON_C..\Run: [sxr5tu7hdxyfr] C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\w4si6r57i\drx6tij7ri.exe (anno aliti)
O4 - HKU\Lothar_ON_C..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil11c_Plugin.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Lothar_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 1
O7 - HKU\Max_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Max_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\Max_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\Max_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\Max_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKU\Max_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 1
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) - C:\Programme\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) - C:\Programme\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe) - C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe (anno aliti)
O20 - HKU\Lothar_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe) - C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe (anno aliti)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/07/26 10:45:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/12/07 16:27:10 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\dwlGina3.dll
[2011/12/07 16:23:17 | 000,348,160 | ---- | C] (anno aliti) -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe
[2011/12/07 16:21:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\w4si6r57i
[2011/11/26 14:43:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lothar\Desktop\Hoftüre
[2011/11/26 09:12:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\AskToolbar
[2011/11/25 14:33:18 | 000,000,000 | ---D | C] -- C:\Programme\LiveVDO.tv plugin
[2011/11/19 06:35:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Google Earth
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp -> ]
[2 C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/12/14 14:50:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/14 14:49:43 | 1073,270,784 | -HS- | M] () -- C:\hiberfil.sys
[2011/12/14 14:44:25 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/14 14:42:00 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/10 08:34:08 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/07 16:32:19 | 000,000,860 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job
[2011/12/07 16:27:10 | 000,095,744 | ---- | M] (Kassl GmbH) -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\dwlGina3.dll
[2011/12/07 16:21:42 | 000,348,160 | ---- | M] (anno aliti) -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\hrt54is56ijfgte.exe
[2011/12/07 16:02:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/12/07 12:49:09 | 000,000,146 | ---- | M] () -- C:\WINDOWS\System32\swctl.dll
[2011/11/30 05:51:26 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2011/11/26 14:52:35 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Lothar\Desktop\Microsoft Office Word 2003.lnk
[2011/11/19 06:35:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Google Earth
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp -> ]
[2 C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/12/14 14:41:40 | 1073,270,784 | -HS- | C] () -- C:\hiberfil.sys
[2011/07/19 12:14:01 | 000,000,012 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ReminderNextRun
[2011/06/05 05:13:35 | 000,000,528 | ---- | C] () -- C:\WINDOWS\System32\urhtps.dat
[2010/08/11 03:23:48 | 000,001,570 | RHS- | C] () -- C:\Dokumente und Einstellungen\Max\ntuser.pol
[2010/08/02 14:34:29 | 000,001,570 | RHS- | C] () -- C:\Dokumente und Einstellungen\Lothar\ntuser.pol
[2010/05/02 06:35:11 | 000,085,284 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/02/02 16:17:45 | 000,012,880 | ---- | C] () -- C:\Dokumente und Einstellungen\Lothar\mixxxtrack.xml
[2010/02/02 16:17:45 | 000,000,270 | ---- | C] () -- C:\Dokumente und Einstellungen\Lothar\mixxxbpmschemes.xml
[2010/02/02 15:57:15 | 000,001,535 | ---- | C] () -- C:\Dokumente und Einstellungen\Lothar\mixxx.cfg
[2009/09/30 09:27:38 | 000,183,040 | ---- | C] () -- C:\WINDOWS\PI.EXE
[2009/09/18 12:41:18 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\ccwt64.dat
[2009/09/18 12:11:16 | 008,090,386 | ---- | C] () -- C:\WINDOWS\System32\httpsurl.dat
[2009/09/18 12:11:16 | 000,059,671 | ---- | C] () -- C:\WINDOWS\System32\httpuurl.dat
[2009/09/18 12:11:16 | 000,001,548 | ---- | C] () -- C:\WINDOWS\System32\nogoapp.dat
[2009/09/18 12:11:15 | 000,000,145 | -H-- | C] () -- C:\WINDOWS\System32\CTLSW.INI
[2009/09/18 12:11:14 | 000,000,146 | ---- | C] () -- C:\WINDOWS\System32\swctl.dll
[2009/09/18 12:10:55 | 000,000,529 | ---- | C] () -- C:\WINDOWS\System32\nochook.ini
[2009/08/07 04:49:53 | 000,284,160 | ---- | C] () -- C:\WINDOWS\unin0407.exe
[2009/06/23 13:27:33 | 000,001,372 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2009/03/06 17:39:12 | 000,000,046 | ---- | C] () -- C:\WINDOWS\System32\imon1.dat
[2008/12/15 16:31:35 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LauncherAccess.dt
[2008/12/15 16:03:14 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2008/11/16 16:38:54 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2008/11/16 16:34:27 | 000,000,221 | ---- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini
[2008/08/31 14:24:12 | 000,113,591 | ---- | C] () -- C:\WINDOWS\hpoins07.dat
[2008/08/31 14:24:12 | 000,021,124 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat
[2008/08/23 15:16:01 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/08/04 14:31:51 | 000,001,240 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/08/03 15:51:43 | 000,031,232 | ---- | C] () -- C:\Dokumente und Einstellungen\Lothar\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/03 11:56:44 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008/08/02 08:05:15 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/07/26 17:56:09 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/07/26 17:56:09 | 000,548,864 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2008/07/26 17:56:09 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/07/26 17:56:08 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/07/26 17:56:07 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/07/26 11:31:45 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/07/26 11:30:14 | 000,346,608 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/07/26 10:49:04 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/07/26 10:41:32 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/04/14 01:06:26 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2006/12/31 00:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/02/20 10:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2001/08/23 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 07:00:00 | 000,320,094 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2001/08/23 07:00:00 | 000,314,508 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 07:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2001/08/23 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 07:00:00 | 000,049,174 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2001/08/23 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 07:00:00 | 000,040,836 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 07:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2001/08/23 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 07:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2001/07/06 08:30:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[1997/06/14 06:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
========== LOP Check ==========
[2010/02/01 17:06:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\Acoustica
[2011/11/26 09:12:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\AskToolbar
[2008/12/09 14:44:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\Image Zone Express
[2008/08/03 05:17:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\LEGO Interactive
[2011/03/14 08:27:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\LEGO Media
[2011/04/02 11:26:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\LucasArts
[2011/09/26 10:46:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\searchquband
[2011/10/20 09:48:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\searchqutoolbar
[2008/07/26 17:50:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\TextPad
[2010/11/30 02:28:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\Thunderbird
[2009/11/10 12:23:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\TOPP Druckstudio 2
[2010/09/12 06:58:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\Uniblue
[2011/10/15 09:04:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\Unity
[2011/12/07 16:23:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Lothar\Anwendungsdaten\w4si6r57i
[2009/12/12 06:52:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Max\Anwendungsdaten\Englisch
[2009/09/21 07:44:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Max\Anwendungsdaten\LEGO Interactive
[2011/09/26 10:40:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Max\Anwendungsdaten\searchquband
[2011/09/26 10:40:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Max\Anwendungsdaten\searchqutoolbar
[2011/10/05 09:51:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Max\Anwendungsdaten\Thunderbird
[2010/02/01 16:58:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acoustica
[2011/09/26 11:19:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Big Fish Games
[2011/09/12 01:21:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\boost_interprocess
[2009/09/18 12:13:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\System
[2008/07/26 18:00:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2010/04/24 14:06:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/09/11 09:57:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{94D867E5-DFF5-4374-ADEE-C3F5BE97F03A}
[2011/12/07 16:02:00 | 000,000,228 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
[2010/02/01 17:13:00 | 000,000,264 | ---- | M] () -- C:\WINDOWS\Tasks\zuluSevenDaysInit.job
[2010/02/20 13:46:01 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\zuluShakeIcon.job
========== Purity Check ==========
< End of report >
|
|
15.12.2011, 12:18
