Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: gema-trojaner (100 euro-version) win xp

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

 
Alt 05.03.2012, 13:47   #1
bullahoch2
 
gema-trojaner (100 euro-version) win xp - Standard

gema-trojaner (100 euro-version) win xp



hallo,

habe auch seit einigen tagen den gema-trojaner, der den zugriff auf win xp blockiert.
im abgesicherten modus zu starten geht nicht, es kommt für einen gaaaanz kurzen ein bluescreen, bevor der rechner neustartet.

ich habe nun schon - angelegt an diesen fall - OTLPENet.exe geladen, damit gebootet und den scan laufen lassen. hier das logfile der OTL.txt:

Code:
ATTFilter
OTL logfile created on: 3/5/2012 1:25:30 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 18.62 Gb Total Space | 1.41 Gb Free Space | 7.55% Space Free | Partition Type: NTFS
Drive D: | 18.63 Gb Total Space | 5.47 Gb Free Space | 29.36% Space Free | Partition Type: NTFS
Drive F: | 999.63 Mb Total Space | 855.06 Mb Free Space | 85.54% Space Free | Partition Type: FAT
Drive G: | 3.78 Gb Total Space | 1.90 Gb Free Space | 50.08% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/01/04 07:32:36 | 000,718,888 | ---- | M] (Nokia) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2011/03/18 04:06:49 | 000,072,704 | ---- | M] (Adobe Systems) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service)
SRV - [2010/04/27 09:57:32 | 000,247,152 | ---- | M] () [Auto] -- C:\Programme\Join Air\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010/04/07 07:57:42 | 000,099,896 | ---- | M] (HP) [Auto] -- C:\WINDOWS\system32\HPSIsvc.exe -- (HPSIService)
SRV - [2008/05/07 18:29:38 | 000,122,880 | ---- | M] (CrypKey (Canada) Ltd.) [Auto] -- C:\WINDOWS\System32\Crypserv.exe -- (Crypkey License)
SRV - [2008/04/24 07:40:56 | 002,562,048 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Auto] -- C:\WINDOWS\System32\hasplms.exe -- (hasplms)
SRV - [2007/05/28 11:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2006/10/26 13:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 08:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Adapter | On_Demand] --  -- (Mvhel3esepcw)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - File not found [Kernel | On_Demand] --  -- (appliandMP)
DRV - File not found [Kernel | On_Demand] --  -- (AgereSoftModem)
DRV - [2012/01/14 10:58:54 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)
DRV - [2011/11/01 04:07:26 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011/11/01 04:07:26 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011/11/01 04:07:26 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011/11/01 04:07:24 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011/03/15 06:51:03 | 000,722,416 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010/03/05 18:40:57 | 000,017,408 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mvusbews.sys -- (mvusbews)
DRV - [2010/01/05 04:31:32 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2010/01/05 04:31:30 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2010/01/05 04:31:30 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2010/01/05 04:31:30 | 000,009,216 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\massfilter.sys -- (massfilter)
DRV - [2008/08/26 03:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008/04/28 08:22:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)
DRV - [2008/03/18 10:09:16 | 000,350,720 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\aksfridge.sys -- (aksfridge)
DRV - [2008/03/17 11:45:52 | 000,019,584 | ---- | M] () [Kernel | System] -- C:\WINDOWS\system32\ckldrv.sys -- (NetworkX)
DRV - [2008/03/12 21:25:36 | 002,530,176 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R)
DRV - [2008/02/11 10:55:04 | 000,586,240 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2007/12/14 03:21:56 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
DRV - [2007/08/28 09:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
DRV - [2007/06/18 10:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007/06/18 07:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem)
DRV - [2007/05/09 07:27:00 | 000,097,280 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gtipci21.sys -- (GTIPCI21)
DRV - [2007/01/22 07:09:38 | 000,034,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wisdpen.sys -- (wisdpen)
DRV - [2006/02/27 10:45:48 | 001,342,602 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2006/02/27 10:43:36 | 000,030,189 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2006/02/27 10:43:06 | 000,057,096 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2006/02/27 10:40:16 | 000,148,168 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2005/10/26 04:01:02 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2005/09/19 08:24:20 | 000,005,760 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb)
DRV - [2005/05/09 14:08:40 | 000,033,792 | ---- | M] (Team H2O) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cledx.sys -- (CLEDX)
DRV - [2003/07/08 12:49:24 | 000,514,155 | ---- | M] (Digital Camera) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\Ca536av.sys -- (Ca536av)
DRV - [2003/05/13 18:28:14 | 000,011,048 | ---- | M] (USB BULK) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Bulk536.sys -- (USBCamera)
DRV - [2001/08/17 22:35:52 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\flo_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
IE - HKU\flo_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKU\flo_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKU\flo_ON_C\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =  [binary data]
IE - HKU\flo_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\flo_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKU\flo_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\flo_ON_C\..\URLSearchHook: {95289393-33EA-4F8D-B952-483415B9C955} - C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKU\flo_ON_C\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
IE - HKU\flo_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\flo_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\flo_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 121.204.0.2:80
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {ad48108d-92a6-4eb9-87e4-978aca1dbae4}:1.1.7
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.1.2
FF - prefs.js..keyword.URL: "hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p="
FF - prefs.js..network.proxy.backup.ftp: "10.1.0.0"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.socks: "10.1.0.0"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "10.1.0.0"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "192.168.1.1"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.http: "192.168.1.1"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: "localhost"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "192.168.1.1"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "192.168.1.1"
FF - prefs.js..network.proxy.ssl_port: 3128
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.Net\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@www.flatcast.com/FlatViewer 5.2: C:\DOKUME~1\flo\ANWEND~1\Mozilla\plugins\NpFv530.dll (1 mal 1 Software GmbH)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{5FE7198A-5950-4068-9FBF-1A60395CC4E9}: C:\Programme\1&1\1&1 SoftPhone\Firefox [2011/03/16 07:01:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fe_10.0@nokia.com: C:\Programme\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_10.0
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/02/18 06:08:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/02/11 16:45:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Programme\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012/02/29 04:24:00 | 000,000,000 | ---D | M]
 
[2011/03/15 06:42:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\mozilla\Extensions
[2012/03/01 14:58:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\mozilla\Firefox\Profiles\h2h6cuos.default\extensions
[2011/11/22 18:59:37 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\mozilla\Firefox\Profiles\h2h6cuos.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/01/13 10:57:21 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\mozilla\Firefox\Profiles\h2h6cuos.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2012/02/11 16:26:07 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\mozilla\Firefox\Profiles\h2h6cuos.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012/03/01 14:58:47 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\mozilla\Firefox\Profiles\h2h6cuos.default\extensions\staged
[2011/03/15 18:29:10 | 000,002,062 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Mozilla\Firefox\Profiles\h2h6cuos.default\searchplugins\qip-search.xml
[2011/12/25 19:33:05 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
File not found (No name found) -- 
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\FLO\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\H2H6CUOS.DEFAULT\EXTENSIONS\{AD48108D-92A6-4EB9-87E4-978ACA1DBAE4}.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\FLO\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\H2H6CUOS.DEFAULT\EXTENSIONS\ADD-TO-SEARCHBOX@MALTEKRAUS.DE.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\FLO\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\H2H6CUOS.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2012/02/18 06:08:44 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011/06/19 16:47:01 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011/09/23 08:41:48 | 002,557,440 | ---- | M] (1 mal 1 Software GmbH) -- C:\Programme\mozilla firefox\plugins\NpFp530.dll
[2009/09/21 05:00:44 | 001,447,328 | ---- | M] (1 mal 1 Software GmbH) -- C:\Programme\mozilla firefox\plugins\NpFv522.dll
[2011/09/23 08:43:02 | 001,623,552 | ---- | M] (1 mal 1 Software GmbH) -- C:\Programme\mozilla firefox\plugins\NpFv530.dll
[2012/01/12 16:38:34 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/01/12 16:38:34 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012/01/12 16:38:34 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012/01/12 16:38:34 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/01/12 16:38:34 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/01/12 16:38:34 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/02/28 07:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (QIPBHO Class) - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O3 - HKU\flo_ON_C\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Programme\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
O3 - HKU\flo_ON_C\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [H2O] C:\Programme\Syncrosoft\POS\H2O\cledx.exe (Team H2O)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TabletTip] C:\Programme\Gemeinsame Dateien\microsoft shared\ink\tabtip.exe (Microsoft Corporation)
O4 - HKLM..\Run: [UIExec] C:\Programme\Join Air\UIExec.exe ()
O4 - HKU\flo_ON_C..\Run: []  File not found
O4 - HKU\LocalService_ON_C..\Run: [TabletWizard]  File not found
O4 - HKU\NetworkService_ON_C..\Run: [TabletWizard]  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\cd-laufwerk.lnk = C:\map.bat ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Watch.lnk = C:\Programme\4.0M MPEG4 DV\Console\Watch.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\flo\Startmenü\Programme\Autostart\Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\flo_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\flo_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\flo_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\flo_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Download by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Programme\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\1&1\1&1 SoftPhone\ContextMenuHandler.html ()
O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (sfklg.dll) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\E13521A1E0A0CC59F69D.exe) - C:\WINDOWS\system32\E13521A1E0A0CC59F69D.exe (Unizeto Sp. z o.o.)
O20 - Winlogon\Notify\loginkey: DllName - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Ink\loginkey.dll - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Ink\loginkey.dll (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: 
O24 - Desktop BackupWallPaper: 
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/03/14 19:12:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{1b60351d-b14f-11e0-9fd0-0018debd900d}\Shell - "" = AutoRun
O33 - MountPoints2\{1b60351d-b14f-11e0-9fd0-0018debd900d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1b60351d-b14f-11e0-9fd0-0018debd900d}\Shell\AutoRun\command - "" = F:\SISetup.exe
O33 - MountPoints2\{5e03cac2-9cc9-11e0-9f9a-0018debd900d}\Shell - "" = AutoRun
O33 - MountPoints2\{5e03cac2-9cc9-11e0-9f9a-0018debd900d}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5e03cac2-9cc9-11e0-9f9a-0018debd900d}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{9180a4e3-de0a-11e0-a065-0016d498d8af}\Shell\AutoRun\command - "" = F:\RunClubSanDisk.exe
O33 - MountPoints2\{ba2d366a-6dc5-11e0-9ebf-0018debd900d}\Shell\AutoRun\command - "" = F:\StartPortableApps.exe
O33 - MountPoints2\{ef120711-b1f4-11e0-9fd3-0016d498d8af}\Shell\AutoRun\command - "" = IO90453\JJU294\fuiahjdfu.exe
O33 - MountPoints2\{ef120711-b1f4-11e0-9fd3-0016d498d8af}\Shell\open\command - "" = IO90453\JJU294\fuiahjdfu.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {29E7D24F-BF30-45E7-8A40-AD27AFD8F5C6} - Microsoft .NET Framework 1.0 Hotfix (KB979904)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9309DD7E-EBFE-3C95-8B47-30D3A012F606} - .NET Framework
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe
ActiveX: {E30AC7CA-ED4A-48A8-A539-A711A256B163} - Vektorgrafik-Rendering (VML)
ActiveX: {E55010A4-6F00-201C-B8B3-80AE9A1744D6} - Microsoft .NET Framework 1.0 Hotfix (KB979904)
ActiveX: {E8EA5BD6-D931-4001-ABF6-81BAA500360A} - Microsoft .NET Framework 1.0 Hotfix (KB953295)
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EA29D410-CE41-4953-A862-2DE706A1DAD7} - Microsoft .NET Framework 1.0 Service Pack 3
ActiveX: {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/03/01 09:46:47 | 000,039,424 | -H-- | C] (Unizeto Sp. z o.o.) -- C:\WINDOWS\System32\E13521A1E0A0CC59F69D.exe
[2012/02/29 04:57:46 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Nokia Suite
[2012/02/29 04:41:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Nokia Suite
[2012/02/29 04:40:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\flo\Lokale Einstellungen\Anwendungsdaten\NokiaAccount
[2012/02/29 04:37:18 | 000,016,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2012/02/29 04:25:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\flo\Lokale Einstellungen\Anwendungsdaten\Nokia
[2012/02/29 04:24:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Nokia
[2012/02/29 04:24:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2012/02/29 04:24:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\PC Suite
[2012/02/29 04:24:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nokia
[2012/02/29 04:23:58 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Nokia
[2012/02/29 04:23:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2012/02/28 07:18:11 | 000,000,000 | ---D | C] -- C:\Programme\Dropbox
[2012/02/28 06:40:45 | 000,018,816 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\pccsmcfd.sys
[2012/02/28 06:40:32 | 000,000,000 | ---D | C] -- C:\Programme\PC Connectivity Solution
[2012/02/28 06:40:13 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys
[2012/02/28 06:40:12 | 000,008,192 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\usbser_lowerflt.sys
[2012/02/28 06:40:11 | 000,023,168 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys
[2012/02/28 06:40:10 | 001,461,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfcoinstaller01009.dll
[2012/02/28 06:40:10 | 000,605,696 | ---- | C] (Nokia) -- C:\WINDOWS\System32\nmwcdcocls.dll
[2012/02/28 06:40:10 | 000,123,904 | ---- | C] (Nokia) -- C:\WINDOWS\System32\ccdcmbwu.dll
[2012/02/28 06:40:10 | 000,018,176 | ---- | C] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys
[2012/02/28 06:40:09 | 000,075,264 | ---- | C] (Nokia) -- C:\WINDOWS\System32\nmwcdcls.dll
[2012/02/28 06:37:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2012/02/28 06:35:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2012/02/28 06:35:23 | 000,000,000 | ---D | C] -- C:\Programme\Nokia
[2012/02/14 06:30:21 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2012/02/11 16:23:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Flatcast
[2012/02/11 05:31:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2012/02/11 05:29:17 | 000,737,280 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe
[2012/02/11 05:29:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Karaoke Anything!
[2012/02/11 05:29:15 | 000,000,000 | ---D | C] -- C:\Programme\Karaoke Anything!
[2012/02/11 05:27:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sibelius Software
[2012/02/11 05:27:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Sibelius Software
[2012/02/10 07:02:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Sibelius Software
[2012/02/10 07:02:59 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Scores
[2012/02/10 06:59:18 | 000,000,000 | ---D | C] -- C:\Programme\Sibelius Software
[2011/04/02 11:11:02 | 000,818,176 | ---- | C] (Image-Line) -- C:\Programme\Kopie von FL Studio VSTi.dll
[2011/03/16 07:36:36 | 000,092,064 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\flo\mqdmmdm.sys
[2011/03/16 07:36:36 | 000,079,328 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\flo\mqdmserd.sys
[2011/03/16 07:36:36 | 000,066,656 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\flo\mqdmbus.sys
[2011/03/16 07:36:36 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\flo\usbsermptxp.sys
[2011/03/16 07:36:36 | 000,022,768 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\flo\usbsermpt.sys
[2011/03/16 07:36:36 | 000,009,232 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\flo\mqdmmdfl.sys
[2011/03/16 07:36:36 | 000,006,208 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\flo\mqdmcmnt.sys
[2011/03/16 07:36:36 | 000,005,936 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\flo\mqdmwhnt.sys
[2011/03/16 07:36:36 | 000,004,048 | ---- | C] (MCCI) -- C:\Dokumente und Einstellungen\flo\mqdmcr.sys
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/03/05 07:04:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/03/05 07:04:12 | 000,449,334 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/03/05 07:04:12 | 000,433,130 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/03/05 07:04:12 | 000,080,302 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/03/05 07:04:12 | 000,067,704 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/03/05 07:03:38 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/03/05 07:03:38 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/03/03 04:28:11 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/03/01 15:29:55 | 000,020,180 | ---- | M] () -- C:\WINDOWS\System32\sfklg.dat
[2012/03/01 13:31:52 | 000,002,507 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office OneNote 2007.lnk
[2012/03/01 13:08:34 | 000,000,536 | ---- | M] () -- C:\WINDOWS\Sam9_D.INI
[2012/03/01 09:46:47 | 000,039,424 | -H-- | M] (Unizeto Sp. z o.o.) -- C:\WINDOWS\System32\E13521A1E0A0CC59F69D.exe
[2012/03/01 08:03:34 | 000,186,368 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/29 06:51:43 | 000,002,555 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2003.lnk
[2012/02/29 04:37:30 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf
[2012/02/29 04:37:27 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_user_01_09_00.Wdf
[2012/02/29 04:31:42 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012/02/29 04:31:41 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/02/29 04:31:41 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012/02/29 04:24:21 | 000,001,717 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Nokia Suite.lnk
[2012/02/29 04:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Nokia
[2012/02/28 16:37:17 | 000,001,014 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Desktop\Dropbox.lnk
[2012/02/28 11:39:27 | 000,224,024 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/02/28 07:53:30 | 000,002,527 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2003.lnk
[2012/02/28 06:38:14 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2012/02/28 06:37:10 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2012/02/23 13:44:58 | 001,440,054 | ---- | M] () -- C:\WINDOWS\System32\winsh324
[2012/02/19 21:27:58 | 000,002,439 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Power Tab Editor 1.7.lnk
[2012/02/19 10:01:47 | 000,002,241 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2012/02/11 16:45:10 | 000,002,292 | ---- | M] () -- C:\WINDOWS\unins002.dat
[2012/02/11 16:45:08 | 000,715,038 | ---- | M] () -- C:\WINDOWS\unins002.exe
[2012/02/11 16:27:44 | 000,002,368 | ---- | M] () -- C:\WINDOWS\unins001.dat
[2012/02/11 16:27:42 | 000,715,038 | ---- | M] () -- C:\WINDOWS\unins001.exe
[2012/02/11 16:23:21 | 000,000,898 | ---- | M] () -- C:\WINDOWS\unins000.dat
[2012/02/11 16:23:18 | 000,695,578 | ---- | M] () -- C:\WINDOWS\unins000.exe
[2012/02/11 05:31:41 | 000,000,624 | -H-- | M] () -- C:\WINDOWS\System32\T4
[2012/02/11 05:29:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Karaoke Anything!
[2012/02/11 05:29:07 | 000,737,280 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe
[2012/02/11 05:27:27 | 000,000,604 | -H-- | M] () -- C:\Programme\STLL Notifier
[2012/02/10 16:52:30 | 000,002,563 | ---- | M] () -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Microsoft Office PowerPoint 2003.lnk
[2012/02/10 15:40:10 | 000,000,471 | ---- | M] () -- C:\WINDOWS\System32\Datei4
[2012/02/10 15:40:10 | 000,000,471 | ---- | M] () -- C:\WINDOWS\System32\Datei2
[2012/02/10 15:40:10 | 000,000,470 | ---- | M] () -- C:\WINDOWS\System32\Datei3
[2012/02/10 15:40:10 | 000,000,470 | ---- | M] () -- C:\WINDOWS\System32\Datei1
[2012/02/10 15:40:10 | 000,000,469 | ---- | M] () -- C:\WINDOWS\System32\Datei7
[2012/02/10 15:40:10 | 000,000,469 | ---- | M] () -- C:\WINDOWS\System32\Datei5
[2012/02/10 15:40:10 | 000,000,468 | ---- | M] () -- C:\WINDOWS\System32\Datei0
[2012/02/10 15:40:10 | 000,000,467 | ---- | M] () -- C:\WINDOWS\System32\Datei9
[2012/02/10 15:40:10 | 000,000,467 | ---- | M] () -- C:\WINDOWS\System32\Datei8
[2012/02/10 15:40:10 | 000,000,467 | ---- | M] () -- C:\WINDOWS\System32\Datei10
[2012/02/10 15:40:10 | 000,000,465 | ---- | M] () -- C:\WINDOWS\System32\Datei6
[2012/02/10 07:03:12 | 000,000,444 | ---- | M] () -- C:\WINDOWS\{17FE44E2-D21A-4F0C-BE49-798A8FBC374E}_WiseFW.ini
[2012/02/10 07:02:59 | 000,001,786 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Sibelius 6.lnk
[2012/02/10 07:02:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Sibelius Software
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/03/01 09:47:17 | 001,440,054 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/03/01 09:47:17 | 001,440,054 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/03/01 09:47:17 | 001,440,054 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/03/01 09:47:17 | 001,440,054 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/03/01 09:47:16 | 001,440,054 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/02/29 04:37:30 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf
[2012/02/29 04:37:27 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_user_01_09_00.Wdf
[2012/02/29 04:31:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
[2012/02/29 04:31:41 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2012/02/29 04:24:21 | 000,001,717 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Nokia Suite.lnk
[2012/02/28 06:37:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2012/02/11 16:45:10 | 000,715,038 | ---- | C] () -- C:\WINDOWS\unins002.exe
[2012/02/11 16:45:10 | 000,002,292 | ---- | C] () -- C:\WINDOWS\unins002.dat
[2012/02/11 16:27:43 | 000,715,038 | ---- | C] () -- C:\WINDOWS\unins001.exe
[2012/02/11 16:27:43 | 000,002,368 | ---- | C] () -- C:\WINDOWS\unins001.dat
[2012/02/11 16:23:20 | 000,695,578 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2012/02/11 16:23:20 | 000,000,898 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2012/02/11 05:31:41 | 000,000,624 | -H-- | C] () -- C:\WINDOWS\System32\T4
[2012/02/11 05:27:27 | 000,000,604 | -H-- | C] () -- C:\Programme\STLL Notifier
[2012/02/10 07:02:59 | 000,001,786 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Sibelius 6.lnk
[2012/02/10 06:59:03 | 000,000,444 | ---- | C] () -- C:\WINDOWS\{17FE44E2-D21A-4F0C-BE49-798A8FBC374E}_WiseFW.ini
[2012/01/14 11:00:00 | 000,000,004 | ---- | C] () -- C:\WINDOWS\vx86036.dat
[2012/01/14 10:59:31 | 000,000,074 | ---- | C] () -- C:\WINDOWS\Crypkey.ini
[2012/01/14 10:59:27 | 000,027,648 | R--- | C] () -- C:\WINDOWS\Setup_ck.exe
[2012/01/14 10:59:27 | 000,019,584 | ---- | C] () -- C:\WINDOWS\System32\Ckldrv.sys
[2012/01/14 10:59:27 | 000,018,432 | ---- | C] () -- C:\WINDOWS\Setup_ck.dll
[2012/01/14 10:59:27 | 000,011,776 | ---- | C] () -- C:\WINDOWS\Ckrfresh.exe
[2012/01/14 10:58:54 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2011/12/23 06:24:51 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011/12/23 02:33:11 | 000,107,520 | RHS- | C] () -- C:\WINDOWS\System32\TAKDSDecoder.dll
[2011/09/12 13:43:19 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2011/09/12 13:43:19 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2011/09/12 13:43:19 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2011/09/12 13:43:19 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2011/09/12 13:43:19 | 000,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2011/08/05 06:24:02 | 000,000,030 | ---- | C] () -- C:\Programme\Exiferupdate.ini
[2011/07/28 12:23:36 | 001,511,424 | ---- | C] () -- C:\WINDOWS\System32\HP1100SM.EXE
[2011/07/28 12:23:36 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\HP1100LM.DLL
[2011/07/28 12:23:02 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\mvusbews.dll
[2011/07/28 12:22:57 | 000,054,272 | ---- | C] () -- C:\WINDOWS\System32\HP1100SMs.dll
[2011/07/18 10:14:01 | 000,284,160 | ---- | C] () -- C:\WINDOWS\System32\mvhlewsi.dll
[2011/04/11 14:56:57 | 000,006,656 | ---- | C] () -- C:\WINDOWS\System32\CNMVS58.DLL
[2011/04/06 10:01:20 | 000,030,461 | ---- | C] () -- C:\WINDOWS\snap099.dat
[2011/04/06 10:01:20 | 000,029,565 | ---- | C] () -- C:\WINDOWS\snap098.dat
[2011/04/06 10:01:20 | 000,028,669 | ---- | C] () -- C:\WINDOWS\snap097.dat
[2011/04/06 10:01:20 | 000,027,773 | ---- | C] () -- C:\WINDOWS\snap095.dat
[2011/04/06 10:01:20 | 000,027,773 | ---- | C] () -- C:\WINDOWS\snap094.dat
[2011/04/06 10:01:20 | 000,027,773 | ---- | C] () -- C:\WINDOWS\snap093.dat
[2011/04/06 10:01:20 | 000,027,773 | ---- | C] () -- C:\WINDOWS\snap090.dat
[2011/04/06 10:01:20 | 000,027,773 | ---- | C] () -- C:\WINDOWS\snap089.dat
[2011/04/06 10:01:20 | 000,026,877 | ---- | C] () -- C:\WINDOWS\snap096.dat
[2011/04/06 10:01:20 | 000,026,877 | ---- | C] () -- C:\WINDOWS\snap092.dat
[2011/04/06 10:01:20 | 000,025,981 | ---- | C] () -- C:\WINDOWS\snap091.dat
[2011/04/06 10:01:19 | 000,027,773 | ---- | C] () -- C:\WINDOWS\snap088.dat
[2011/04/06 10:01:19 | 000,026,877 | ---- | C] () -- C:\WINDOWS\snap087.dat
[2011/04/06 10:01:19 | 000,026,877 | ---- | C] () -- C:\WINDOWS\snap086.dat
[2011/04/06 10:01:19 | 000,025,981 | ---- | C] () -- C:\WINDOWS\snap085.dat
[2011/04/06 10:01:19 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap084.dat
[2011/04/06 10:01:19 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap083.dat
[2011/04/06 10:01:19 | 000,023,293 | ---- | C] () -- C:\WINDOWS\snap082.dat
[2011/04/06 10:01:19 | 000,022,397 | ---- | C] () -- C:\WINDOWS\snap081.dat
[2011/04/06 10:01:19 | 000,021,501 | ---- | C] () -- C:\WINDOWS\snap080.dat
[2011/04/06 10:01:19 | 000,020,605 | ---- | C] () -- C:\WINDOWS\snap079.dat
[2011/04/06 10:01:19 | 000,019,709 | ---- | C] () -- C:\WINDOWS\snap078.dat
[2011/04/06 10:01:19 | 000,019,709 | ---- | C] () -- C:\WINDOWS\snap077.dat
[2011/04/06 10:01:18 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap072.dat
[2011/04/06 10:01:18 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap069.dat
[2011/04/06 10:01:18 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap068.dat
[2011/04/06 10:01:18 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap067.dat
[2011/04/06 10:01:18 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap066.dat
[2011/04/06 10:01:18 | 000,023,293 | ---- | C] () -- C:\WINDOWS\snap073.dat
[2011/04/06 10:01:18 | 000,023,293 | ---- | C] () -- C:\WINDOWS\snap071.dat
[2011/04/06 10:01:18 | 000,023,293 | ---- | C] () -- C:\WINDOWS\snap070.dat
[2011/04/06 10:01:18 | 000,022,397 | ---- | C] () -- C:\WINDOWS\snap074.dat
[2011/04/06 10:01:18 | 000,021,501 | ---- | C] () -- C:\WINDOWS\snap075.dat
[2011/04/06 10:01:18 | 000,020,605 | ---- | C] () -- C:\WINDOWS\snap076.dat
[2011/04/06 10:01:17 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap061.dat
[2011/04/06 10:01:17 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap060.dat
[2011/04/06 10:01:17 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap059.dat
[2011/04/06 10:01:17 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap058.dat
[2011/04/06 10:01:17 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap057.dat
[2011/04/06 10:01:17 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap055.dat
[2011/04/06 10:01:17 | 000,025,085 | ---- | C] () -- C:\WINDOWS\snap053.dat
[2011/04/06 10:01:17 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap065.dat
[2011/04/06 10:01:17 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap064.dat
[2011/04/06 10:01:17 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap063.dat
[2011/04/06 10:01:17 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap062.dat
[2011/04/06 10:01:17 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap056.dat
[2011/04/06 10:01:17 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap054.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap052.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap051.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap050.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap049.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap048.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap047.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap046.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap045.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap044.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap043.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap042.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap041.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap040.dat
[2011/04/06 10:01:16 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap039.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap038.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap037.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap036.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap035.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap034.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap033.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap032.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap031.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap030.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap029.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap028.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap027.dat
[2011/04/06 10:01:15 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap026.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap025.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap024.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap023.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap022.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap021.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap020.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap019.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap018.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap017.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap016.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap015.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap014.dat
[2011/04/06 10:01:14 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap013.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap012.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap011.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap010.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap009.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap008.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap007.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap006.dat
[2011/04/06 10:01:13 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap005.dat
[2011/04/06 10:00:41 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap004.dat
[2011/04/06 10:00:41 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap003.dat
[2011/04/06 10:00:30 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap002.dat
[2011/04/06 10:00:29 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap001.dat
[2011/04/06 10:00:29 | 000,024,189 | ---- | C] () -- C:\WINDOWS\snap000.dat
[2011/04/06 09:58:29 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\MKCoInstaller.dll
[2011/04/06 09:58:25 | 000,002,042 | ---- | C] () -- C:\WINDOWS\Ca536a.ini
[2011/03/23 13:39:32 | 000,000,038 | -HS- | C] () -- C:\WINDOWS\camcodec100.ini
[2011/03/23 13:39:32 | 000,000,028 | -HS- | C] () -- C:\WINDOWS\lagarith.ini
[2011/03/23 13:39:18 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2011/03/23 12:39:14 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\pxhpinst.exe
[2011/03/21 11:04:31 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Kopie von musicmaker.INI
[2011/03/21 10:16:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\musicmaker.INI
[2011/03/21 10:13:46 | 000,000,024 | ---- | C] () -- C:\WINDOWS\magix.ini
[2011/03/21 09:54:10 | 000,038,912 | ---- | C] () -- C:\WINDOWS\System32\mgxasio.dll
[2011/03/19 17:57:53 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/03/18 03:55:30 | 000,000,536 | ---- | C] () -- C:\WINDOWS\Sam9_D.INI
[2011/03/18 03:51:58 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2011/03/18 03:51:19 | 000,001,208 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2011/03/18 03:48:46 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/03/17 12:46:25 | 000,020,180 | ---- | C] () -- C:\WINDOWS\System32\sfklg.dat
[2011/03/16 07:36:36 | 000,009,913 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\MCCI_MDM.INF
[2011/03/16 07:36:36 | 000,009,232 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\USB_MOT_BRIT.INF
[2011/03/16 07:36:36 | 000,007,201 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\USBMOT2000.INF
[2011/03/16 07:36:36 | 000,006,989 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\MCCI_BUS.INF
[2011/03/16 07:36:36 | 000,006,141 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\USBMOT2000XP.INF
[2011/03/16 07:36:36 | 000,005,960 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\USB_MOT_A1000.INF
[2011/03/16 07:36:36 | 000,005,880 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\USB_CMCS_2000.INF
[2011/03/16 07:36:36 | 000,004,477 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\MCCI_SDM.INF
[2011/03/15 18:09:20 | 000,186,368 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/15 06:42:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/03/14 20:28:05 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2011/03/14 19:19:29 | 000,000,136 | ---- | C] () -- C:\Dokumente und Einstellungen\flo\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2011/03/14 19:14:57 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/03/14 19:04:58 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011/03/14 18:41:58 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/03/14 18:40:35 | 000,224,024 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/04/01 03:48:16 | 000,053,478 | ---- | C] () -- C:\WINDOWS\mvtcpui.ini
[2006/02/28 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006/02/28 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/02/28 07:00:00 | 000,449,334 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006/02/28 07:00:00 | 000,433,130 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/02/28 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/02/28 07:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006/02/28 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/02/28 07:00:00 | 000,080,302 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006/02/28 07:00:00 | 000,067,704 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/02/28 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/02/28 07:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006/02/28 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/02/28 07:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/02/28 07:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006/02/28 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2006/02/28 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2006/02/27 10:51:36 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll
[2005/03/06 01:06:02 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\sfklgcp.exe.vir
[2005/03/06 01:05:56 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\sfklg.dll.vir
[2004/01/13 12:46:34 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll
[2001/11/14 06:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2011/10/31 05:21:44 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Anwendungsdaten\Application Updater
[2011/10/17 12:15:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\.oit
[2011/06/09 10:04:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\1&1
[2012/01/21 08:54:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\ASCOMP Software
[2011/07/21 05:33:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\avidemux
[2012/02/10 05:32:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Azureus
[2012/01/22 04:19:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\DesktopIconForAmazon
[2011/07/02 14:44:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Downloadr
[2012/02/28 16:37:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Dropbox
[2011/10/31 05:41:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\DVDVideoSoft
[2011/10/31 05:41:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\DVDVideoSoftIEHelpers
[2012/02/11 16:23:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Flatcast
[2011/07/22 03:44:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\GARMIN
[2011/07/18 06:32:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\GetRightToGo
[2011/03/15 18:07:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\GrabPro
[2011/04/02 04:48:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Gutscheinmieze
[2011/03/21 11:23:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\MAGIX
[2012/02/29 04:41:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Nokia
[2012/02/29 04:41:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Nokia Suite
[2011/11/26 06:40:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Opera
[2012/02/28 08:01:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Orbit
[2012/02/29 04:40:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\PC Suite
[2011/03/28 03:23:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\PDF Writer
[2011/03/15 18:08:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\ProgSense
[2011/03/15 18:11:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\QIP
[2011/03/15 18:29:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\QipGuard
[2011/07/21 11:17:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Vara Software
[2011/08/22 07:57:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\flo\Anwendungsdaten\Wirecast
[2011/06/09 10:02:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\1&1
[2011/06/12 15:48:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Applian
[2011/03/21 16:47:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
[2011/03/25 17:52:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GARMIN
[2011/03/22 16:30:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2011/09/12 13:43:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Minnetonka Audio Software
[2012/02/29 04:23:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2012/02/28 06:35:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2012/02/29 04:36:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2011/03/28 03:23:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PDF Writer
[2012/01/17 16:20:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Stardraw.com Ltd
[2011/07/21 11:17:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Telestream
[2012/02/11 05:53:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011/04/11 14:56:50 | 000,000,000 | -H-D | M] -- C:\BJPrinter
[2011/03/14 19:19:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2012/01/05 06:10:40 | 000,000,000 | ---D | M] -- C:\downloads
[2011/03/15 17:57:40 | 000,000,000 | ---D | M] -- C:\Garmin
[2011/03/14 20:27:57 | 000,000,000 | ---D | M] -- C:\Intel
[2011/03/15 07:34:45 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011/05/27 01:09:38 | 000,000,000 | ---D | M] -- C:\Program Files
[2012/02/28 07:18:11 | 000,000,000 | R--D | M] -- C:\Programme
[2011/03/14 19:39:39 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2011/04/21 06:03:15 | 000,000,000 | ---D | M] -- C:\SWSetup
[2012/03/01 18:15:24 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011/03/14 21:03:24 | 000,000,000 | ---D | M] -- C:\Temp
[2012/03/05 07:03:40 | 000,000,000 | ---D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2006/02/28 07:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2011/03/19 17:47:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2011/03/19 17:47:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\dllcache\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2006/02/28 07:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2011/03/19 17:47:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2011/03/19 17:47:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 16:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2006/02/28 07:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008/04/13 21:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 21:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2006/02/28 07:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2006/02/28 07:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008/04/13 21:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008/04/13 21:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008/04/13 21:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 21:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2006/02/28 07:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009/02/06 13:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 13:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008/04/13 21:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 21:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2006/02/28 07:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2006/02/28 07:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2008/04/13 21:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008/04/13 21:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008/04/13 21:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 21:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2006/02/28 07:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006/02/28 07:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 21:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 21:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006/02/28 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2006/02/28 07:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2011/03/14 19:39:49 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2011/03/14 19:39:49 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2011/03/14 19:39:49 | 000,450,560 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\system32\*.dll /lockedfiles >
[2008/06/20 12:46:10 | 000,147,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dnsapi.dll
[2008/04/13 21:22:18 | 000,280,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\mstask.dll
[2008/04/13 21:22:20 | 000,067,072 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\ntdsapi.dll
[2010/04/16 11:06:44 | 001,509,888 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shdocvw.dll
[2008/06/17 14:00:59 | 008,502,272 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\shell32.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 122 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C8B8CEBD
< End of report >
         
wie soll ich weiter vorgehen?

danke schonmal + gruß, flo.

 

Themen zu gema-trojaner (100 euro-version) win xp
0x00000001, adobe, alternate, bho, bluescreen, conduit, desktop, disabletaskmgr, downloader, einstellungen, error, excel, explorer, firefox, format, google, helper, logfile, microsoft office word, port, registry, rundll, scan, senden, services.exe, software, starten, studio, tablet, windows, windows xp, winlogon.exe




Ähnliche Themen: gema-trojaner (100 euro-version) win xp


  1. Verschlüsselungstrojaner eingefangen (Gema 50 Euro Trojaner, Whitescreen nach Anmeldung)
    Log-Analyse und Auswertung - 20.10.2012 (10)
  2. GEMA-Virus aufgetreten, PC bis zur Zahlung von 100 Euro gesperrt
    Plagegeister aller Art und deren Bekämpfung - 11.05.2012 (15)
  3. Virus blockiert PC! Gema Bundestrojaner Virus - 50 euro Ukash?
    Plagegeister aller Art und deren Bekämpfung - 06.05.2012 (4)
  4. Gema / 50 Euro - Trojaner - OTL LOG - bitte auswerten...
    Log-Analyse und Auswertung - 02.05.2012 (3)
  5. Auf Windows Vista: GEMA-Virus will 50 Euro + abnow.com - Weiterleitung bei google
    Log-Analyse und Auswertung - 28.03.2012 (3)
  6. Computer gesperrt!! GEMA verlangt 100 Euro
    Log-Analyse und Auswertung - 24.03.2012 (1)
  7. Trojaner: Aus Sicherheitsgründen wurde Ihre Windows Version gesperrt - 50 euro zahlen!
    Plagegeister aller Art und deren Bekämpfung - 12.03.2012 (21)
  8. Gema Paysafe Trojaner 50 Euro
    Log-Analyse und Auswertung - 21.02.2012 (11)
  9. 100-Euro-wegen-illegaler-Windows-Version
    Plagegeister aller Art und deren Bekämpfung - 11.02.2012 (8)
  10. Windows illegale Version , 100 Euro bezahlen
    Plagegeister aller Art und deren Bekämpfung - 10.02.2012 (11)
  11. 50-Euro-Gema-Dings auf XP-Notebook
    Log-Analyse und Auswertung - 09.02.2012 (8)
  12. Security Center - nicht lizensierte windows version 100 euro strafe
    Plagegeister aller Art und deren Bekämpfung - 06.02.2012 (1)
  13. nicht lizensierte windows version 100 euro strafe
    Log-Analyse und Auswertung - 03.02.2012 (8)
  14. 50 Euro Gema Virus Frage zur Datenrettung
    Plagegeister aller Art und deren Bekämpfung - 28.01.2012 (1)
  15. Gema-Trojaner bzw. Gema Meldung mit blockiertem Rechner
    Log-Analyse und Auswertung - 09.01.2012 (13)
  16. Win 7, gespeert durch die Gema 50 Euro bezahlen
    Log-Analyse und Auswertung - 30.12.2011 (5)
  17. Gema-Trojaner bzw. Gema Meldung mit blockiertem Rechner
    Plagegeister aller Art und deren Bekämpfung - 04.12.2011 (9)

Zum Thema gema-trojaner (100 euro-version) win xp - hallo, habe auch seit einigen tagen den gema-trojaner, der den zugriff auf win xp blockiert. im abgesicherten modus zu starten geht nicht, es kommt für einen gaaaanz kurzen ein bluescreen, - gema-trojaner (100 euro-version) win xp...
Archiv
Du betrachtest: gema-trojaner (100 euro-version) win xp auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.