| |  Gema-Trojaner und weitere Funde
 Hallo,
ich habe den Laptop von meiner Tante bekommen um diesen wieder zum laufen zu bekommen.
Der Gema-Trojaner hatte den Zugriff darauf blockiert. Mit Hilfe der Norton Bootable Recovery Toools CD bin ich wieder rein gekommen.
Das erste was ich festgestellt habe, war das komplette Fehlen einer Antiviren-Softare. Daraufhin habe ich Avira-Free installieren wollen. Diese meldete mir, daß ich zuerst Norton Internet Security deinstallieren müsste. Norton war aber nicht in der installierten Software vorhanen. Daher habe ich mit CC-Cleaner die Registry bereinigt (Log vorhanden falls benötigt) und Avira dann installiert.
Daraufhin wurden von Avira einige Treffer gemeldet, die dann gelöscht wurden. (Logs vorhanden falls benötigt) Zitat:
Die Datei 'C:\Windows\System32\config\systemprofile\AppData\Local\keraipx.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Spy.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde gelöscht.
Die Datei 'C:\Windows\Temp\gwqhhc\setup.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Proxy.Sefbov.E.22' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde gelöscht.
In der Datei 'C:\Users\Brigitte\M-1-52-5782-8752-5245\winsvc .exe'
wurde ein Virus oder unerwünschtes Programm 'WORM/Phorpiex.B.41' [worm] gefunden.
Ausgeführte Aktion: Zugriff verweigern
In der Datei 'C:\Users\Brigitte\M-1-54-6324-575-5275\winsvc .exe'
wurde ein Virus oder unerwünschtes Programm 'WORM/Phorpiex.B.1' [worm] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Die Datei 'C:\Users\Brigitte\M-1-52-5782-8752-5245\winsvc .exe'
enthielt einen Virus oder unerwünschtes Programm 'WORM/Phorpiex.B.41' [worm].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4a50a2e7.qua' verschoben!
Die Datei 'C:\Users\Brigitte\M-1-54-6324-575-5275\winsvc .exe'
enthielt einen Virus oder unerwünschtes Programm 'WORM/Phorpiex.B.1' [worm].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4a64bcb8.qua' verschoben!
| Auf Grund der fehlenden Antiviren-Software und der vielen Funde habe ich mich dann an dieses tolle Forum erinnert. Hoffentlich nicht zu spät.
Der Laptop wird nur zum spielen, surfen, Bildbearbeitung und Musikverwaltung genutzt. Onlienbanking und ähnliches wird nicht gemacht. Seht ihr hier noch Rettungschancen oder muß ich in den sauren Apfel beißen und neu installieren?
Vielen Dank schon mal vorab. Zitat:
OTL logfile created on: 17.11.2011 15:21:10 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Brigitte\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 69,14% Memory free
6,19 Gb Paging File | 5,22 Gb Available in Paging File | 84,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 119,76 Gb Free Space | 51,42% Space Free | Partition Type: NTFS
Drive D: | 221,16 Gb Total Space | 221,00 Gb Free Space | 99,93% Space Free | Partition Type: NTFS
Computer Name: BrigitteSPC | User Name: Brigitte | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011.11.17 15:18:11 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Brigitte\Desktop\OTL.exe
PRC - [2011.10.19 16:56:15 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.10.19 16:56:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.10.19 16:55:48 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.10.19 16:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.09.27 21:34:02 | 000,894,304 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2011.09.27 20:08:40 | 000,745,880 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Application Updater\ApplicationUpdater.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.12.09 23:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
PRC - [2008.10.21 17:57:30 | 000,307,200 | -H-- | M] (DeviceVM) -- C:\ASUS.SYS\DVMExportService.exe
PRC - [2008.07.10 01:09:26 | 000,191,032 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe
PRC - [2008.06.19 20:18:12 | 000,154,168 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
PRC - [2008.06.04 01:29:08 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe
PRC - [2008.03.31 10:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
PRC - [2008.02.01 23:17:26 | 000,233,472 | ---- | M] (ATK0100) -- C:\Program Files\ATK Hotkey\Hcontrol.exe
PRC - [2008.01.23 18:51:28 | 000,151,552 | ---- | M] () -- C:\Program Files\ATK Hotkey\WDC.exe
PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007.12.04 18:57:06 | 002,486,272 | ---- | M] () -- C:\Program Files\ATK Hotkey\ATKOSD.exe
PRC - [2007.11.05 03:48:06 | 000,106,496 | ---- | M] () -- C:\Program Files\ATK Hotkey\MsgTranAgt.exe
PRC - [2007.10.12 05:44:28 | 000,106,496 | ---- | M] (ASUS) -- C:\Windows\System32\ASUSTPE.exe
PRC - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe
PRC - [2007.08.15 19:20:16 | 000,106,496 | ---- | M] () -- C:\Program Files\ATK Hotkey\KBFiltr.exe
PRC - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe
PRC - [2005.07.06 23:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe
PRC - [2005.01.21 16:44:06 | 000,065,536 | ---- | M] (OLYMPUS IMAGING CORP.) -- C:\Windows\System32\MrobeService.exe
========== Modules (No Company Name) ==========
MOD - [2008.10.24 14:13:01 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2007.06.15 18:28:36 | 000,147,456 | ---- | M] () -- C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
MOD - [2007.06.02 01:08:18 | 000,143,360 | ---- | M] () -- C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
========== Win32 Services (SafeList) ==========
SRV - [2011.10.19 16:56:01 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.19 16:55:48 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.09.27 20:08:40 | 000,745,880 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2008.10.21 17:57:30 | 000,307,200 | -H-- | M] (DeviceVM) [Auto | Running] -- C:\ASUS.SYS\DVMExportService.exe -- (MDES)
SRV - [2008.03.31 10:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.10.03 05:53:00 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2007.08.08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2005.01.21 16:44:06 | 000,065,536 | ---- | M] (OLYMPUS IMAGING CORP.) [Auto | Running] -- C:\Windows\System32\MrobeService.exe -- (MrobeService)
========== Driver Services (SafeList) ==========
DRV - [2011.10.19 16:56:15 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.10.19 16:56:15 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.19 16:56:15 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.10.24 17:16:31 | 004,017,152 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.08.11 03:14:11 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.06.03 07:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2008.05.29 18:21:02 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\lullaby.sys -- (lullaby)
DRV - [2008.05.02 09:07:53 | 000,048,128 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SiSGB6.sys -- (SiSGbeLH)
DRV - [2008.04.27 19:07:44 | 000,909,824 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.08.11 04:19:26 | 000,029,752 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm)
DRV - [2007.07.24 19:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2006.12.14 08:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.7\dealioToolbarIE.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.03.27 20:45:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
[2010.01.04 16:17:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brigitte\AppData\Roaming\mozilla\Extensions
[2010.01.04 16:17:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Brigitte\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
========== Chrome ==========
Hosts file not found
O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.7\dealioToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe Reader) - {147FEC3F-6DE9-437C-8FC1-6B8A20AA0A72} - C:\Users\Brigitte\AppData\Roaming\AdobeReader\IE\AdobeReader.dll (Adobe Systems, Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.7\dealioToolbarIE.dll (Spigot, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ASUSTPE] C:\Windows\System32\ASUSTPE.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ISUSScheduler] -start File not found
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [StartCCC] MSRun File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1250BE79-04B2-47E0-8C54-ED163386EFEA}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\keraipx: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O24 - Desktop WallPaper: C:\Users\Brigitte\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Brigitte\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player 9 ActiveX
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {tkILaiAG-Z968-IeXL-outj-7zkVqmn5RUHY} -
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011.11.17 19:49:51 | 000,000,000 | ---D | C] -- C:\NBRT
[2011.11.17 15:18:04 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Brigitte\Desktop\OTL.exe
[2011.11.17 15:05:13 | 000,000,000 | -H-D | C] -- C:\dvmexp
[2011.11.17 14:18:50 | 000,000,000 | ---D | C] -- C:\Users\Brigitte\AppData\Roaming\Avira
[2011.11.17 14:14:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.11.17 14:13:41 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.11.17 14:13:40 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.11.17 14:13:40 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.11.17 14:13:40 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.11.17 14:13:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.11.17 14:13:39 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.11.17 14:08:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.11.17 14:08:07 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.11.14 18:57:36 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Users\Brigitte\AppData\Roaming\dwlGina3.dll
[2011.11.13 20:43:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DEUTSCHLAND SPIELT
[2011.11.13 20:43:52 | 000,000,000 | ---D | C] -- C:\Program Files\DEUTSCHLAND SPIELT
[2011.11.13 20:43:27 | 000,000,000 | ---D | C] -- C:\Program Files\OXXOGames
[2011.11.13 20:41:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Purplehills
[2011.11.07 19:01:38 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater
[2011.11.07 19:01:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2011.11.07 19:01:36 | 000,000,000 | ---D | C] -- C:\Program Files\Dealio Toolbar
[2008.06.03 07:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
========== Files - Modified Within 30 Days ==========
[2011.11.17 15:21:04 | 000,000,921 | ---- | M] () -- C:\Users\Brigitte\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.website
[2011.11.17 15:18:11 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Brigitte\Desktop\OTL.exe
[2011.11.17 15:13:24 | 000,623,904 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.11.17 15:13:24 | 000,591,854 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.11.17 15:13:24 | 000,123,918 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.11.17 15:13:24 | 000,102,126 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.11.17 15:06:11 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.11.17 15:05:01 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2011.11.17 15:04:50 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.11.17 15:04:49 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.17 15:04:49 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.17 15:04:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.17 15:04:30 | 3220,463,616 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.17 14:52:39 | 000,000,000 | ---- | M] () -- C:\Users\Brigitte\defogger_reenable
[2011.11.17 14:50:46 | 000,050,477 | ---- | M] () -- C:\Users\Brigitte\Desktop\Defogger.exe
[2011.11.17 14:41:00 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At15.job
[2011.11.17 14:14:00 | 000,001,854 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.11.17 14:09:51 | 000,143,458 | ---- | M] () -- C:\Users\Brigitte\Documents\registry_backup_17_11_2011.reg
[2011.11.14 18:57:36 | 000,095,744 | ---- | M] (Kassl GmbH) -- C:\Users\Brigitte\AppData\Roaming\dwlGina3.dll
[2011.11.14 18:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At19.job
[2011.11.13 21:41:03 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At22.job
[2011.11.13 21:19:25 | 000,000,931 | ---- | M] () -- C:\Users\Public\Desktop\GAME CENTER.lnk
[2011.11.13 21:19:24 | 000,001,046 | ---- | M] () -- C:\Users\Public\Desktop\Mini Golf Pro.lnk
[2011.11.13 21:16:43 | 000,000,982 | ---- | M] () -- C:\Users\Public\Desktop\3D Pool Billiard.lnk
[2011.11.13 20:43:55 | 000,001,031 | ---- | M] () -- C:\Users\Public\Desktop\Super Puzzle.lnk
[2011.11.13 20:41:06 | 000,001,031 | ---- | M] () -- C:\Users\Brigitte\Desktop\Rune of Fate.lnk
[2011.11.13 20:41:00 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At21.job
[2011.11.13 19:41:00 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At20.job
[2011.11.13 17:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At18.job
[2011.11.13 15:41:07 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At16.job
[2011.11.13 15:17:52 | 000,000,129 | ---- | M] () -- C:\Windows\System32\MRT.INI
[2011.11.12 23:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At24.job
[2011.11.06 22:59:15 | 000,373,456 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.11.06 22:51:03 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2011.11.06 22:51:03 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2011.11.06 22:50:45 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011.11.06 22:41:04 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At23.job
[2011.11.06 00:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\At1.job
[2011.11.02 20:07:32 | 000,001,978 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.10.19 16:56:15 | 000,134,344 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.10.19 16:56:15 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.10.19 16:56:15 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
========== Files Created - No Company Name ==========
[2011.11.17 14:52:39 | 000,000,000 | ---- | C] () -- C:\Users\Brigitte\defogger_reenable
[2011.11.17 14:52:02 | 000,000,921 | ---- | C] () -- C:\Users\Brigitte\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.website
[2011.11.17 14:50:46 | 000,050,477 | ---- | C] () -- C:\Users\Brigitte\Desktop\Defogger.exe
[2011.11.17 14:14:00 | 000,001,854 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.11.17 14:09:43 | 000,143,458 | ---- | C] () -- C:\Users\Brigitte\Documents\registry_backup_17_11_2011.reg
[2011.11.17 10:11:42 | 3220,463,616 | -HS- | C] () -- C:\hiberfil.sys
[2011.11.13 21:16:43 | 000,000,982 | ---- | C] () -- C:\Users\Public\Desktop\3D Pool Billiard.lnk
[2011.11.13 20:48:03 | 000,001,046 | ---- | C] () -- C:\Users\Public\Desktop\Mini Golf Pro.lnk
[2011.11.13 20:43:56 | 000,000,931 | ---- | C] () -- C:\Users\Public\Desktop\GAME CENTER.lnk
[2011.11.13 20:43:55 | 000,001,031 | ---- | C] () -- C:\Users\Public\Desktop\Super Puzzle.lnk
[2011.11.13 20:41:06 | 000,001,031 | ---- | C] () -- C:\Users\Brigitte\Desktop\Rune of Fate.lnk
[2011.11.06 22:50:45 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.11.06 20:43:34 | 000,000,129 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2011.09.20 18:17:32 | 000,000,112 | ---- | C] () -- C:\ProgramData\rp6acykG.dat
[2010.08.11 19:25:49 | 000,053,248 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010.01.11 19:46:42 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.01.11 19:46:42 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.10.02 18:12:02 | 000,014,848 | ---- | C] () -- C:\Users\Brigitte\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.09.18 20:39:42 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.09.18 19:24:31 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2009.04.11 10:45:16 | 000,033,136 | ---- | C] () -- C:\Windows\ASScrPro .exe
[2009.04.11 10:45:06 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog .exe
[2009.04.11 10:15:27 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009.04.11 09:52:55 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.10.28 22:16:00 | 000,362,029 | ---- | C] () -- C:\Windows\System32\sqlite3.dll
[2008.10.24 14:13:01 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2008.10.24 13:36:05 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2008.10.21 04:39:59 | 000,081,920 | ---- | C] () -- C:\Windows\System32\ATIODE.exe
[2008.10.21 04:39:59 | 000,045,056 | ---- | C] () -- C:\Windows\System32\ATIODCLI.exe
[2008.08.14 05:42:21 | 000,176,214 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008.08.11 03:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008.07.02 03:28:38 | 000,061,440 | ---- | C] () -- C:\Program Files\Common Files\CPInstallAction.dll
[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files\Common Files\banner.jpg
[2008.05.12 04:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.04.16 12:11:34 | 000,623,904 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.04.16 12:11:34 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.04.16 12:11:34 | 000,123,918 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.04.16 12:11:34 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.04.16 11:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2007.08.06 18:18:31 | 000,081,920 | ---- | C] () -- C:\Windows\PGMonitor.exe
[2007.07.23 09:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007.07.23 09:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2007.07.23 09:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,373,456 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,591,854 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,102,126 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.03.09 02:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
========== LOP Check ==========
[2009.10.02 18:19:31 | 000,000,000 | ---D | M] -- C:\Users\Brigitte\AppData\Roaming\EleFun Games
[2010.08.19 18:53:37 | 000,000,000 | ---D | M] -- C:\Users\Brigitte\AppData\Roaming\FreeAudioPack
[2010.03.23 16:08:14 | 000,000,000 | ---D | M] -- C:\Users\Brigitte\AppData\Roaming\OLYMPUS
[2010.01.04 16:17:46 | 000,000,000 | ---D | M] -- C:\Users\Brigitte\AppData\Roaming\Thunderbird
[2009.09.18 20:07:22 | 000,000,000 | ---D | M] -- C:\Users\Brigitte\AppData\Roaming\Zylom
[2011.09.19 19:41:23 | 000,000,224 | ---- | M] () -- C:\Windows\Tasks\1c6bbdb0.job
[2011.11.06 00:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At1.job
[2011.09.20 18:41:33 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At10.job
[2011.09.20 18:41:33 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At11.job
[2011.09.20 18:41:33 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At12.job
[2011.09.20 18:41:33 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At13.job
[2011.09.20 18:41:33 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At14.job
[2011.11.17 14:41:00 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At15.job
[2011.11.13 15:41:07 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At16.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At17.job
[2011.11.13 17:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At18.job
[2011.11.14 18:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At19.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At2.job
[2011.11.13 19:41:00 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At20.job
[2011.11.13 20:41:00 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At21.job
[2011.11.13 21:41:03 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At22.job
[2011.11.06 22:41:04 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At23.job
[2011.11.12 23:40:59 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At24.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At3.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At4.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At5.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At6.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At7.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At8.job
[2011.09.20 18:41:34 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\At9.job
[2011.11.17 14:57:53 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2009.09.18 19:38:15 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2009.09.19 18:19:35 | 000,000,000 | -H-D | M] -- C:\ASUS.DAT
[2009.04.11 10:57:12 | 000,000,000 | -H-D | M] -- C:\ASUS.SYS
[2011.09.02 21:40:29 | 000,000,000 | -HSD | M] -- C:\Boot
[2009.09.18 19:10:28 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.11.17 15:05:13 | 000,000,000 | -H-D | M] -- C:\dvmexp
[2010.03.23 20:07:08 | 000,000,000 | ---D | M] -- C:\Free WMA MP3 Converter
[2009.04.11 09:25:59 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011.11.17 22:06:30 | 000,000,000 | ---D | M] -- C:\NBRT
[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2010.08.11 18:51:25 | 000,000,000 | ---D | M] -- C:\Program Brigitte
[2011.11.17 14:13:39 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.11.17 14:13:39 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2009.10.02 19:26:13 | 000,000,000 | ---D | M] -- C:\Programme
[2011.11.17 15:23:10 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.11.17 15:05:13 | 000,000,000 | -H-D | M] -- C:\temp
[2009.09.18 19:24:08 | 000,000,000 | R--D | M] -- C:\Users
[2011.11.17 14:34:18 | 000,000,000 | ---D | M] -- C:\Windows
< %PROGRAMFILES%\*.exe >
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< %systemroot%\system32\*.manifest /3 >
< MD5 for: EXPLORER.EXE >
[2009.04.11 10:04:38 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009.04.11 10:04:38 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009.04.11 10:04:38 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SoftwareDistribution\Download\15d05090e6f876555f2419af621dda9f\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009.04.11 10:04:38 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
< MD5 for: REGEDIT.EXE >
[2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.21 03:24:53 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
< MD5 for: USERINIT.EXE >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
< MD5 for: WININIT.EXE >
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 03:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
< MD5 for: WINLOGON.EXE >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\15d05090e6f876555f2419af621dda9f\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-11-17 13:57:48
< End of report >
|
|
18.11.2011, 10:04
Baum-Darstellung