Windows Verschlüsselungstrojaner: Versuch des abgesichterten Modus führt zu Bluescreen

 

OTL logfile created on: 5/30/2012 4:05:31 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: d.M.yyyy
 
1,023.00 Mb Total Physical Memory | 824.00 Mb Available Physical Memory | 80.00% Memory free
907.00 Mb Paging File | 851.00 Mb Available in Paging File | 94.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 25.69 Gb Total Space | 6.18 Gb Free Space | 24.06% Space Free | Partition Type: NTFS
Drive D: | 48.83 Gb Total Space | 32.21 Gb Free Space | 65.96% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (AppMgmt)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2007/08/23 21:19:12 | 000,443,776 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 08:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (USBAAPL)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (Netaapl)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2010/08/07 08:59:13 | 000,721,904 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010/07/31 09:49:54 | 000,838,930 | ---- | M] (Motorola Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2009/06/29 12:00:50 | 000,112,640 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2009/06/29 12:00:50 | 000,102,656 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewusbfake.sys -- (hwusbfake)
DRV - [2009/04/09 07:38:30 | 000,102,400 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2008/04/13 15:40:50 | 000,149,376 | ---- | M] (M-Systems) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\tffsport.sys -- (tffsport)
DRV - [2005/09/11 19:00:00 | 003,298,432 | R--- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2005/04/28 17:37:50 | 001,132,544 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/03/22 19:00:00 | 002,547,008 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/10/27 09:21:30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/02/11 19:00:00 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Ronny_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ebay.de/
IE - HKU\Ronny_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Ronny_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
IE - HKU\systemprofile_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0:  File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: D:\Programme\Portable Apps\FirefoxPortable\App\firefox\components [2012/04/29 18:06:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: D:\Programme\Portable Apps\FirefoxPortable\App\firefox\plugins
 
 
O1 HOSTS File: ([2011/12/04 15:01:02 | 000,000,864 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -  File not found
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [iTunesHelper]  File not found
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [TrayServer] D:\Programme\Magix\Programmdateien\Trayserver.exe (MAGIX AG)
O4 - HKU\Ronny_ON_C..\Run: [70364FDF] C:\WINDOWS\system32\22E0D47C70364FDF7864.exe (The Code::Blocks Team)
O4 - HKU\Ronny_ON_C..\Run: [BrowserChoice] C:\WINDOWS\System32\browserchoice.exe (Microsoft Corporation)
O4 - HKU\Ronny_ON_C..\Run: [DAEMON Tools Lite] D:\Programme\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Ronny\Startmenü\Programme\Autostart\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = D:\Programme\Office 2007 Enterprise\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Ronny_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Ronny_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Ronny_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\Ronny_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\systemprofile_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Office 2007 Enterprise\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programme\Office 2007 Enterprise\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} -  File not found
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} -  File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Office 2007 Enterprise\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} hxxp://download.microsoft.com/download/7/4/9/749b0dc5-2175-4d5b-a6dd-9c4bc923683e/Selfhelpcontrol.cab (Microsoft Genuine Advantage Self Support Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1009841289140 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} -  File not found
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\22E0D47C70364FDF7864.exe) - C:\WINDOWS\system32\22E0D47C70364FDF7864.exe (The Code::Blocks Team)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/21 09:34:06 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/24 05:03:31 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2012/05/24 05:03:29 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/05/24 04:59:42 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\LocalService\Eigene Dateien
[2012/05/24 02:33:42 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\LocalService\Recent
[2012/05/23 19:22:27 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012/05/17 15:02:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Onvfpjgx
[2012/05/17 15:01:46 | 000,034,477 | -H-- | C] (The Code::Blocks Team) -- C:\WINDOWS\System32\22E0D47C70364FDF7864.exe
[2012/05/17 15:01:26 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2012/05/13 09:01:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ronny\Lokale Einstellungen\Anwendungsdaten\Identities
[2012/05/05 07:40:10 | 000,476,960 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012/05/05 07:40:10 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012/05/05 07:40:10 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012/05/05 07:40:10 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012/05/05 07:40:10 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012/05/04 12:35:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Ronny\Desktop\unfall bilder
[2004/11/24 15:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll
[17 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/24 08:57:53 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/24 08:57:53 | 000,000,256 | ---- | M] () -- C:\WINDOWS\tasks\RegistryBooster.job
[2012/05/24 08:57:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/24 08:57:25 | 1073,139,712 | -HS- | M] () -- C:\hiberfil.sys
[2012/05/23 23:06:54 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/05/23 22:11:12 | 000,498,050 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012/05/23 22:11:12 | 000,473,794 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/05/23 22:11:12 | 000,102,102 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012/05/23 22:11:12 | 000,085,474 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/05/23 16:26:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/17 15:01:46 | 000,034,477 | -H-- | M] (The Code::Blocks Team) -- C:\WINDOWS\System32\22E0D47C70364FDF7864.exe
[2012/05/13 17:28:05 | 000,050,455 | ---- | M] () -- C:\Dokumente und Einstellungen\Ronny\Desktop\UOAesQEXVryDGJnTUOA
[2012/05/13 14:40:09 | 000,010,959 | ---- | M] () -- C:\Dokumente und Einstellungen\Ronny\Eigene Dateien\aoutsqrfXnvxlAgdTo
[2012/05/13 03:32:40 | 000,348,992 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/12 18:00:15 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/05/12 01:18:58 | 000,085,504 | ---- | M] () -- C:\Dokumente und Einstellungen\Ronny\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/11 15:50:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/05/11 15:50:40 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/05/11 15:50:32 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/05/11 15:50:22 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[2012/05/07 14:52:14 | 000,000,775 | ---- | M] () -- C:\Dokumente und Einstellungen\Ronny\Desktop\Neustarten.lnk
[2012/05/07 14:51:18 | 000,001,575 | ---- | M] () -- C:\Dokumente und Einstellungen\Ronny\Desktop\Ruhezustand.lnk
[2012/05/05 07:39:55 | 000,476,960 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\npdeployJava1.dll
[2012/05/05 07:39:55 | 000,472,864 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2012/05/05 07:39:55 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012/05/05 07:39:55 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012/05/05 07:39:55 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012/05/05 07:39:55 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012/05/05 06:15:27 | 000,000,825 | ---- | M] () -- C:\Dokumente und Einstellungen\Ronny\Desktop\Verknüpfung mit FirefoxPortable.exe.lnk
[2012/05/05 02:39:36 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/05/04 14:30:00 | 000,001,031 | ---- | M] () -- C:\Dokumente und Einstellungen\Ronny\Desktop\Verknüpfung mit ThunderbirdPortable.exe.lnk
[17 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/05/17 15:02:42 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325
[2012/05/17 15:02:42 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/05/17 15:02:42 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/05/17 15:02:42 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/05/17 15:02:42 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/05/17 15:02:42 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/05/05 06:15:31 | 000,000,825 | ---- | C] () -- C:\Dokumente und Einstellungen\Ronny\Desktop\Verknüpfung mit FirefoxPortable.exe.lnk
[2012/05/04 14:30:06 | 000,001,031 | ---- | C] () -- C:\Dokumente und Einstellungen\Ronny\Desktop\Verknüpfung mit ThunderbirdPortable.exe.lnk
[2012/04/29 16:29:31 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2010/12/18 11:53:39 | 000,000,213 | ---- | C] () -- C:\WINDOWS\VideodeLuxe.INI
[2010/12/18 11:33:39 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2010/12/18 11:22:03 | 000,003,037 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2010/10/31 15:40:40 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/08/29 04:55:43 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS61.DLL
[2010/08/21 06:40:45 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/08/04 17:33:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/09/21 10:24:42 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/09/21 10:23:29 | 000,348,992 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/09/21 09:40:22 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/09/21 09:37:53 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2009/09/21 09:31:15 | 000,023,504 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/09/03 17:14:27 | 000,000,138 | ---- | C] () -- C:\Dokumente und Einstellungen\Ronny\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2009/09/03 05:19:25 | 000,085,504 | ---- | C] () -- C:\Dokumente und Einstellungen\Ronny\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 09:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2008/12/19 11:15:58 | 004,338,246 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2008/12/17 13:41:18 | 000,884,237 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2008/12/17 13:22:58 | 000,093,184 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2008/12/17 13:22:48 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/12/17 13:17:34 | 000,239,247 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2008/12/17 12:59:54 | 000,560,802 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2007/04/27 04:43:58 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2006/11/02 12:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe
[2006/01/20 03:11:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll
[2006/01/20 03:11:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll
[2006/01/20 03:11:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll
[2006/01/20 03:11:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll
[2006/01/20 03:11:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll
[2006/01/20 03:11:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll
[2006/01/20 03:11:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll
[2006/01/20 03:11:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll
[2006/01/20 03:11:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll
[2004/10/03 13:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll
[2004/08/04 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 08:00:00 | 000,498,050 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/04 08:00:00 | 000,473,794 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 08:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/04 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 08:00:00 | 000,102,102 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/04 08:00:00 | 000,085,474 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 08:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/04 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 08:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/04 08:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/04 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/07/30 05:48:28 | 000,004,711 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/07/30 04:49:22 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/12/31 18:56:42 | 000,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2001/12/31 18:56:42 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2001/12/31 18:37:09 | 000,087,540 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[1601/02/13 04:28:18 | 000,002,184 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\syutpnrVlAvGTog
[1601/02/13 04:28:18 | 000,002,184 | ---- | C] () -- C:\Dokumente und Einstellungen\Ronny\QoadryetvnpVgjlxu
[1601/02/13 04:28:18 | 000,001,082 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\OdsyQspnrfDjvGToO
[1601/02/13 04:28:18 | 000,000,213 | ---- | C] () -- C:\Dokumente und Einstellungen\Ronny\GrqXfQoesOjTUJnDG
 
========== LOP Check ==========
 
[2010/08/03 14:03:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Bytemobile
[2010/08/03 13:54:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Vodafone
[2012/04/29 16:22:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\3v
[2011/12/17 08:35:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Ashampoo
[2010/08/03 13:55:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Bytemobile
[2012/05/17 15:09:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\DAEMON Tools Lite
[2012/05/17 15:09:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\DAEMON Tools Pro
[2011/11/20 10:09:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\DVDVideoSoft
[2012/05/17 15:09:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\DVDVideoSoftIEHelpers
[2010/08/05 13:50:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Foxit Software
[2011/12/10 09:50:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\MAGIX
[2012/05/17 15:02:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Onvfpjgx
[2012/04/29 16:22:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\OpenCandy
[2012/05/17 15:09:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\TeamViewer
[2012/05/17 14:56:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Thunderbird
[2012/02/01 11:39:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Uniblue
[2010/08/03 13:54:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ronny\Anwendungsdaten\Vodafone
[2010/08/07 09:04:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2011/12/10 09:50:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2012/05/17 15:09:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone
[2011/08/30 16:03:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/05/17 15:09:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
[2012/05/17 15:09:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}
[2012/05/24 08:57:53 | 000,000,256 | ---- | M] () -- C:\WINDOWS\Tasks\RegistryBooster.job
 
========== Purity Check ==========
 
 
< End of report >