Verschlüsselungs Trojaner - XP startet nicht im abgesicherten Modus

fundf

Hallo zusammen,
ich habe den Verschlüsselungs-Trojaner im im Anhang einer Mail mit angeglicher Rechung kassiert. Mein System läuft mit Windows XP.
Habe mich nun an eure Anweisungen gehalten - schreibe dies hier von einem anderen Rechner, weil der infizierte den WLAN-Stick nicht erkennt und ich von dort kein Internet habe.


Der defogger log enthält folgendes:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 03:33 on 07/06/2012 (%username%)

Checking for autostart values...
HKCU\~\Run values retrieved.
Unable to open HKLM\~\Run key (2)
HKLM\~\Run values retrieved.

Checking for services/drivers...

Dann habe ich OTL laufen lassen und bekomme nur ein otl.txt - kein extra.txt.

OTL-Log enthält folgendes:


OTL logfile created on: 6/7/2012 3:34:37 AM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

767.00 Mb Total Physical Memory | 540.00 Mb Available Physical Memory | 70.00% Memory free
707.00 Mb Paging File | 576.00 Mb Available in Paging File | 82.00% Paging File free
Paging file location(s): D:\pagefile.sys 0 0J:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 6.99 Gb Total Space | 0.86 Gb Free Space | 12.34% Space Free | Partition Type: FAT32
Drive D: | 5.30 Gb Total Space | 0.45 Gb Free Space | 8.58% Space Free | Partition Type: FAT32
Drive E: | 1.31 Gb Total Space | 0.09 Gb Free Space | 6.99% Space Free | Partition Type: FAT
Drive F: | 1.31 Gb Total Space | 0.12 Gb Free Space | 9.38% Space Free | Partition Type: FAT
Drive G: | 3.98 Gb Total Space | 0.11 Gb Free Space | 2.82% Space Free | Partition Type: FAT32
Drive H: | 5.83 Gb Total Space | 0.10 Gb Free Space | 1.79% Space Free | Partition Type: FAT32
Drive I: | 3.30 Gb Total Space | 0.09 Gb Free Space | 2.86% Space Free | Partition Type: FAT32
Drive J: | 6.34 Gb Total Space | 0.27 Gb Free Space | 4.31% Space Free | Partition Type: FAT32
Drive K: | 3.90 Gb Total Space | 0.91 Gb Free Space | 23.33% Space Free | Partition Type: FAT32
Drive L: | 3.73 Gb Total Space | 3.13 Gb Free Space | 83.87% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (gupdate) Google Update Service (gupdate)
SRV - [2012/05/08 22:50:42 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/26 00:05:08 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011/07/11 08:07:18 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/14 18:49:38 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/03/04 22:38:00 | 000,071,096 | ---- | M] () [Auto] -- D:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2007/03/26 13:06:24 | 000,292,864 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2005/11/21 11:34:24 | 000,081,920 | ---- | M] (AVM Berlin) [Auto] -- D:\Programme\FRITZ!DSL\IGDCTRL.EXE -- (AVM IGD CTRL Service)
SRV - [2005/11/21 10:48:06 | 000,315,392 | ---- | M] (AVM Berlin) [On_Demand] -- C:\Programme\Gemeinsame Dateien\AVM\De_serv.exe -- (de_serv)
SRV - [2005/11/14 01:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand] -- -- (Ser2pl)
DRV - File not found [Kernel | On_Demand] -- -- (RTCore32)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2011/07/11 08:07:20 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/11 08:07:20 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/11/12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009/05/11 12:49:20 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/05/11 10:12:50 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2007/02/22 10:15:56 | 000,137,216 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcd.sys -- (nmwcd)
DRV - [2007/02/22 10:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdcm.sys -- (nmwcdcm)
DRV - [2007/02/22 10:15:14 | 000,012,288 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdcj.sys -- (nmwcdcj)
DRV - [2007/02/22 10:15:14 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmwcdc.sys -- (nmwcdc)
DRV - [2006/04/06 01:00:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2006/03/26 14:22:16 | 000,051,200 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2006/03/13 11:38:24 | 000,006,656 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2005/11/03 16:40:08 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2004/08/03 23:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004/08/03 22:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C)
DRV - [2004/07/20 00:41:48 | 000,016,512 | ---- | M] (Adaptec) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\ASPI32.SYS -- (ASPI32)
DRV - [2001/09/27 00:32:38 | 000,285,088 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtaa.sys -- (ati2mtaa)
DRV - [2001/09/26 18:19:34 | 000,364,800 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sis7018.sys -- (SiS7018) Service for SiS7018 Driver (WDM)
DRV - [2001/08/18 04:19:46 | 000,281,984 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mpaa.sys -- (ati2mpaa)
DRV - [2001/08/17 14:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
DRV - [2001/08/10 07:00:00 | 000,003,252 | ---- | M] () [Kernel | System] -- C:\WINDOWS\System32\drivers\PQNTDRV.SYS -- (PQNTDrv)
DRV - [2001/04/27 06:08:32 | 000,038,946 | R--- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sis7012.sys -- (SiS7012) Service for AC'97 Sample Driver (WDM)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\miles_davis_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\miles_davis_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\miles_davis_ON_C\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)
IE - HKU\miles_davis_ON_C\..\URLSearchHook: {dac6ed64-8dd1-4ab8-aedf-b97892d28ffe} - C:\Programme\Multi_Media_Germany\tbMul1.dll (Conduit Ltd.)
IE - HKU\miles_davis_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\systemprofile_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: D:\Programme\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: D:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: D:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: D:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: D:\Programme\Real\RealPlayer\browserrecord [2008/11/21 09:58:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/01/22 19:47:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: D:\Programme\components [2006/08/19 15:21:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: D:\Programme\plugins [2006/08/19 15:21:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011/08/25 18:22:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2012/01/22 19:47:00 | 000,000,000 | ---D | M]

[2006/11/25 15:23:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2006/10/22 19:06:28 | 000,000,983 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\webde-websuche.xml

O1 HOSTS File: ([2012/05/06 15:14:30 | 000,442,927 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 15219 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)
O2 - BHO: (Multi_Media_Germany toolbar) - {dac6ed64-8dd1-4ab8-aedf-b97892d28ffe} - C:\Programme\Multi_Media_Germany\tbMul1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar_DE Toolbar) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Programme\uTorrentBar_DE\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Multi_Media_Germany toolbar) - {dac6ed64-8dd1-4ab8-aedf-b97892d28ffe} - C:\Programme\Multi_Media_Germany\tbMul1.dll (Conduit Ltd.)
O3 - HKU\miles_davis_ON_C\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKU\miles_davis_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\miles_davis_ON_C\..\Toolbar\WebBrowser: (Multi_Media_Germany toolbar) - {DAC6ED64-8DD1-4AB8-AEDF-B97892D28FFE} - C:\Programme\Multi_Media_Germany\tbMul1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [WinampAgent] E:\Programme\Winamp\Winampa.exe ()
O4 - HKU\miles_davis_ON_C..\Run: [F8FAD812] C:\WINDOWS\system32\199D5B5DF8FAD812799C.exe (Al Momento Non è Registrata)
O4 - HKU\miles_davis_ON_C..\Run: [SpybotSD TeaTimer] D:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\~Disabled [2007/04/27 08:04:50 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Dokumente und Einstellungen\miles davis\Startmenü\Programme\Autostart\FRITZ!DSL Startcenter.lnk = D:\Programme\FRITZ!DSL\StCenter.exe (AVM Berlin)
O4 - Startup: C:\Dokumente und Einstellungen\miles davis\Startmenü\Programme\Autostart\FRITZ!DSL Protect.lnk = D:\Programme\FRITZ!DSL\FwebProt.exe (AVM Berlin)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\miles_davis_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\miles_davis_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\miles_davis_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegedit = 1
O7 - HKU\miles_davis_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - D:\Programme\FRITZ!DSL\SARAH.DLL (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - D:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - D:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - D:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - D:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\199D5B5DF8FAD812799C.exe) - C:\WINDOWS\system32\199D5B5DF8FAD812799C.exe (Al Momento Non è Registrata)
O27 - HKLM IFEO\msconfig.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\regedit.exe: Debugger - P9KDMF.EXE File not found
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/19 13:51:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/06/07 02:08:00 | 000,000,000 | -HSD | C] -- C:\FOUND.019
[2012/06/06 23:42:30 | 000,000,000 | -HSD | C] -- C:\FOUND.018
[2012/06/06 10:53:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Wjuda
[2012/06/06 10:53:34 | 000,065,536 | -H-- | C] (Al Momento Non è Registrata) -- C:\WINDOWS\System32\199D5B5DF8FAD812799C.exe
[2012/06/02 10:16:23 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\miles davis\Recent
[2012/05/27 10:00:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Free M4a to MP3 Converter
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/07 02:08:28 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/06/07 02:08:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/06/07 02:08:12 | 804,835,328 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/06 23:49:02 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/06/06 11:16:32 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
[2012/06/06 11:15:46 | 000,000,305 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DEnuvsxslyANOV
[2012/06/06 10:55:02 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/06/06 10:53:36 | 000,065,536 | -H-- | M] (Al Momento Non è Registrata) -- C:\WINDOWS\System32\199D5B5DF8FAD812799C.exe
[2012/06/05 10:08:10 | 000,002,262 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/06/02 10:24:12 | 000,019,456 | ---- | M] () -- C:\Dokumente und Einstellungen\miles davis\Desktop\yLXDGGJryysXVVN
[2012/05/27 10:00:14 | 000,000,491 | ---- | M] () -- C:\Dokumente und Einstellungen\miles davis\Desktop\Free M4a to MP3 Converter.lnk
[2012/05/27 10:00:14 | 000,000,491 | ---- | M] () -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Free M4a to MP3 Converter.lnk
[2012/05/27 10:00:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Free M4a to MP3 Converter
[2012/05/11 21:50:50 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh323
[2012/05/11 21:50:40 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh322
[2012/05/11 21:50:32 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh321
[2012/05/11 21:50:22 | 000,481,078 | ---- | M] () -- C:\WINDOWS\System32\winsh320
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/06 10:54:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh325
[2012/06/06 10:54:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh324
[2012/06/06 10:54:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh323
[2012/06/06 10:54:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh322
[2012/06/06 10:54:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh321
[2012/06/06 10:54:21 | 000,481,078 | ---- | C] () -- C:\WINDOWS\System32\winsh320
[2012/06/02 10:24:10 | 000,019,456 | ---- | C] () -- C:\Dokumente und Einstellungen\miles davis\Desktop\yLXDGGJryysXVVN
[2012/05/27 10:00:13 | 000,000,491 | ---- | C] () -- C:\Dokumente und Einstellungen\miles davis\Desktop\Free M4a to MP3 Converter.lnk
[2012/05/27 10:00:13 | 000,000,491 | ---- | C] () -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Free M4a to MP3 Converter.lnk
[2011/09/25 12:31:45 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2011/09/25 12:28:17 | 000,107,520 | RHS- | C] () -- C:\WINDOWS\System32\TAKDSDecoder.dll
[2011/05/13 10:18:44 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010/06/21 16:44:12 | 000,005,097 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\gtleEnQvUfTpqjrgsxe
[2010/04/08 09:46:54 | 000,000,012 | ---- | C] () -- C:\WINDOWS\bthservsdp.dat
[2010/03/28 01:25:07 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\miles davis\Lokale Einstellungen\Anwendungsdaten\vTUjlOjGJlxLXvnVrpfye
[2010/03/01 11:09:08 | 000,000,050 | ---- | C] () -- C:\WINDOWS\MegaManager.INI
[2009/04/24 08:07:19 | 000,001,168 | ---- | C] () -- C:\WINDOWS\System32\kbdro098m.dll
[2008/11/20 21:04:44 | 000,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2008/10/01 08:21:17 | 000,000,010 | ---- | C] () -- C:\Dokumente und Einstellungen\miles davis\qaptxuvAqDsUfgrLo
[2008/02/25 11:07:45 | 000,399,360 | ---- | C] () -- C:\WINDOWS\System32\Smab.dll
[2008/02/25 11:07:38 | 000,066,560 | ---- | C] () -- C:\WINDOWS\MOTA113.exe
[2008/02/25 11:07:36 | 000,240,128 | ---- | C] () -- C:\WINDOWS\System32\x.264.exe
[2008/02/25 11:07:35 | 000,502,784 | ---- | C] () -- C:\WINDOWS\x2.64.exe
[2008/02/25 11:07:33 | 000,217,073 | ---- | C] () -- C:\WINDOWS\meta4.exe
[2008/02/25 11:06:40 | 000,151,040 | -HS- | C] () -- C:\WINDOWS\System32\VistaUltm.dll
[2008/02/25 11:06:40 | 000,027,648 | -HS- | C] () -- C:\WINDOWS\System32\Smab0.dll
[2008/01/17 22:59:49 | 000,029,696 | ---- | C] () -- C:\WINDOWS\System32\asutl8.dll
[2007/12/18 15:32:09 | 000,000,073 | ---- | C] () -- C:\WINDOWS\MediaManager.INI
[2007/10/20 01:56:16 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2007/07/07 08:25:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SelSet.INI
[2007/06/07 09:55:20 | 000,012,288 | ---- | C] () -- C:\WINDOWS\impborl.dll
[2007/06/05 21:36:33 | 000,000,012 | ---- | C] () -- C:\WINDOWS\dirsaver.ini
[2007/05/09 08:06:44 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\gEETTUdgOjjllxxJJLLXX
[2007/05/09 08:05:24 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/05/09 08:05:23 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/04/06 13:16:33 | 000,000,041 | ---- | C] () -- C:\WINDOWS\DexCompress.ini
[2007/03/15 07:47:15 | 000,097,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin
[2007/01/14 14:13:47 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2006/10/11 21:45:26 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2006/10/09 23:33:30 | 000,001,763 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2006/09/27 08:56:50 | 000,002,992 | ---- | C] () -- C:\WINDOWS\tm.ini
[2006/09/23 22:11:30 | 001,262,956 | ---- | C] () -- C:\WINDOWS\System32\XMNT2001.EXE
[2006/09/23 22:11:30 | 000,003,252 | ---- | C] () -- C:\WINDOWS\System32\drivers\PQNTDRV.SYS
[2006/09/16 21:25:20 | 000,007,582 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/08/22 14:43:16 | 000,005,363 | ---- | C] () -- C:\WINDOWS\Imagine.INI
[2006/08/20 15:45:55 | 000,000,154 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2006/08/20 13:50:35 | 000,000,061 | ---- | C] () -- C:\WINDOWS\URLPROXY.INI
[2006/08/19 15:48:57 | 000,044,032 | ---- | C] () -- C:\Dokumente und Einstellungen\miles davis\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/08/19 15:21:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006/08/19 15:21:10 | 000,004,325 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006/08/19 15:15:33 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DEnuvsxslyANOV
[2006/08/19 14:17:32 | 000,065,104 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinrvxx.sys
[2006/08/19 14:17:32 | 000,060,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinbtxx.sys
[2006/08/19 14:17:32 | 000,032,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinraxx.sys
[2006/08/19 14:17:32 | 000,032,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinxsxx.sys
[2006/08/19 14:17:32 | 000,032,336 | ---- | C] () -- C:\WINDOWS\System32\drivers\atintuxx.sys
[2006/08/19 14:17:32 | 000,020,960 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinttxx.sys
[2006/08/19 14:17:32 | 000,011,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinpdxx.sys
[2006/08/19 14:17:32 | 000,011,280 | ---- | C] () -- C:\WINDOWS\System32\drivers\atinmdxx.sys
[2006/08/19 14:17:26 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2006/08/19 13:55:55 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/08/19 13:48:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/08/19 13:39:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/08/19 13:38:52 | 000,160,344 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/09 12:33:42 | 000,002,120 | ---- | C] () -- C:\WINDOWS\System32\SETUP.INI
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2001/08/23 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 12:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/18 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/18 12:00:00 | 000,411,266 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2001/08/18 12:00:00 | 000,397,560 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/18 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/18 12:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2001/08/18 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/18 12:00:00 | 000,072,684 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2001/08/18 12:00:00 | 000,059,780 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/18 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/18 12:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2001/08/18 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/18 12:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2001/08/18 12:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2001/08/18 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2000/04/05 17:03:20 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\Ati2evxx.exe
[1996/12/09 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[1996/12/09 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2006/08/19 15:10:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\FRITZ!
[2010/03/25 00:06:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\LogoManager
[2009/12/01 15:31:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\DVD2AVI Ripper Professional
[2012/01/22 19:53:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\DDMSettings
[2011/05/13 10:19:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Canneverbe Limited
[2006/09/01 22:56:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\uTorrent
[2006/10/11 21:45:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\concept design
[2006/11/11 17:35:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\flightgear.org
[2006/11/20 11:50:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Ashampoo Photo Commander 4
[2011/08/25 18:22:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Thunderbird
[2007/04/12 11:03:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\PC Suite
[2011/11/24 22:51:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\OpenOffice.org
[2007/04/12 11:05:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Nokia
[2012/06/06 10:54:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Wjuda
[2007/06/13 08:46:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\ICQ Toolbar
[2007/08/07 14:58:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\1&1
[2007/09/29 17:58:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\BitTorrent
[2007/11/15 21:22:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\NCH Swift Sound
[2008/01/17 23:00:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Anvil Studio
[2008/01/24 00:49:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Leadertech
[2008/05/05 20:36:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\foobar2000
[2008/12/17 10:37:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Uniblue
[2009/11/22 10:52:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\Megaupload
[2010/06/21 16:44:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\miles davis\Anwendungsdaten\MOVAVI
[2006/11/20 11:50:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2006/11/25 15:24:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Web.de Firefox
[2007/04/12 11:00:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2007/04/12 11:05:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2007/04/14 09:05:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Downloaded Installations
[2007/11/15 21:24:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound
[2008/03/30 12:37:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Grisoft
[2008/12/17 10:37:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DriverScanner
[2011/05/13 10:19:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited

========== Purity Check ==========


< End of report >


Ich würd mich freuen, wenn ihr mir weiterhelfen könntet. Ich bin etwas überfordert, bislang hab ich aber alles einigermassen verstanden und hoffe, mein Vorgehen war richtig.
Sobald ich wieder vernünftigen Zugang auf meinen Rechner habe, leite ich die Mail mit dem infizierten Anhang weiter.

Vielen Dank für die Hilfe und Gruß