Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Österreichischer Polizei Virus (https://www.trojaner-board.de/123968-osterreichischer-polizei-virus.html)

ChL 12.09.2012 15:49
Österreichischer Polizei Virus
 
Hallo Team!

Ich habe auf meinem Computer den Polizei Virus Österreich.

Da ich mich im abgesicherten Modus befinde, kann ich mein Internet über USB-Stick nicht aktivieren. Daher ist meine Anti-Malware nicht aktuell. Auch alle anderen Softwaren müssen via Stick auf anderen Computer übertragen werden.

Stellt das ein Problem dar?

Kann ich daher mit einer 71 Tage alten Version arbeiten? Wie ist die weitere Vorgehensweise? Kann ich mir den Virus mit dem USB-Stick von einem auf den anderen Computer übertragen?

Bitte alle Schritte sehr genau erklären, da ich sonst ständig nachfragen muss, wie etwas gemacht werden soll, da ich (wirklich) keine Ahnung habe.

Vielen Dank

markusg 12.09.2012 17:21
hi
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLpe Download OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

ChL 13.09.2012 10:40
Hallo

wenn ich den Doppelklick auf das OTPLE-Icon mache öffnet sich ein Fenster:

Browse for Folder
Choose Windows Directory

Was soll ich da wählen?

Habe mal die Boot-CD gewählt und folgende Meldung erhalten:

Target is not windows 2000 or later

Bitte um Aufzeigung der weiteren Vorgehensweise.

Vielen Dank

markusg 13.09.2012 17:35
klappe alles auf, suche den windows ordner, und los gehts :-)

ChL 13.09.2012 19:13
Hallo Markus!

Hat funktioniert :daumenhoc!

Untenstehend die OTL.txt Daten.

Bitte lass mich wissen, ob etwas fehlt bzw. was als nächstes zu tun ist.

:dankeschoen:


LOG:OTL Logfile:
Code:
OTL logfile created on: 9/13/2012 10:25:40 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Business Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 146.85 Gb Total Space | 43.40 Gb Free Space | 29.55% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.08 Gb Free Space | 54.02% Space Free | Partition Type: NTFS
Drive E: | 1.89 Gb Total Space | 1.89 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/08/19 13:43:22 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/18 12:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/07/18 12:04:24 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012/07/18 12:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/07/13 07:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/07/03 07:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/06/19 11:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2011/06/13 12:12:52 | 000,073,600 | ---- | M] () [Auto] -- C:\Windows\System32\ezGOSvc.dll -- (ezGOSvc)
SRV - [2009/11/23 19:53:58 | 000,113,448 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\WTouch\WTouchService.exe -- (WTouchService)
SRV - [2009/11/23 19:53:56 | 004,497,704 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2009/11/07 03:43:10 | 000,026,112 | ---- | M] () [Auto] -- C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE -- (wltrysvc)
SRV - [2009/10/12 05:45:12 | 000,312,784 | ---- | M] () [Auto] -- C:\Program Files\3DataManager\WTGService.exe -- (WTGService)
SRV - [2009/07/22 13:13:46 | 000,076,288 | ---- | M] (Smith Micro Software, Inc.) [Auto] -- C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe -- (SMManager)
SRV - [2009/07/16 07:10:22 | 000,382,752 | ---- | M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc)
SRV - [2009/06/26 04:26:20 | 000,026,984 | ---- | M] (Broadcom Corporation) [Auto] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe -- (Credential Vault Host Storage)
SRV - [2009/06/26 04:26:18 | 000,812,392 | ---- | M] (Broadcom Corporation) [Auto] -- C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe -- (Credential Vault Host Control Service)
SRV - [2009/06/11 13:43:08 | 001,622,016 | ---- | M] (Wave Systems Corp.) [Auto] -- C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe -- (TdmService)
SRV - [2009/06/03 07:15:24 | 001,019,904 | ---- | M] (Wave Systems Corp.) [On_Demand] -- C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe -- (SecureStorageService)
SRV - [2009/04/27 08:40:26 | 000,293,968 | ---- | M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe -- (buttonsvc32)
SRV - [2009/04/27 06:58:04 | 000,254,042 | ---- | M] (IDT, Inc.) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\stacsv.exe -- (STacSV)
SRV - [2009/04/27 06:57:44 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_820ff26a\AEstSrv.exe -- (AESTFilters)
SRV - [2009/02/11 12:38:40 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/11/12 08:25:48 | 001,273,856 | ---- | M] () [Auto] -- C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe -- (tcsd_win32.exe)
SRV - [2008/06/03 10:16:30 | 000,382,232 | ---- | M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe -- (alssvc)
SRV - [2008/01/20 22:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/04/19 00:56:36 | 000,133,968 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\ASF Agent\ASFAgent.exe -- (ASFAgent)
SRV - [2006/06/05 08:59:18 | 000,174,080 | ---- | M] (Nokia.) [On_Demand] -- C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (STHDA)
DRV - File not found [Kernel | Auto] --  -- (rimmptsk)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (NvtSp50)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - File not found [Kernel | Boot] --  -- (iaStor)
DRV - File not found [Kernel | On_Demand] --  -- (hwusbdev)
DRV - File not found [Kernel | On_Demand] --  -- (hwdatacard)
DRV - File not found [Kernel | On_Demand] --  -- (e1yexpress) Intel(R)
DRV - File not found [Kernel | On_Demand] --  -- (cvusbdrv)
DRV - File not found [Kernel | On_Demand] --  -- (CtClsFlt)
DRV - File not found [Kernel | On_Demand] --  -- (BCM43XX)
DRV - File not found [Kernel | On_Demand] --  -- (ApfiltrService)
DRV - [2012/07/18 12:04:42 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/07/18 12:04:42 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012/07/18 12:04:42 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012/07/03 07:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/12/08 00:22:38 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ssudserd.sys -- (ssudserd) SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.)
DRV - [2011/12/08 00:22:38 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV - [2011/12/08 00:22:38 | 000,080,184 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV - [2010/06/17 09:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/11/07 03:43:05 | 000,018,424 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\bcm42rly.sys -- (BCM42RLY)
DRV - [2009/08/27 19:06:32 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2009/07/09 13:16:24 | 000,013,480 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WacomVTHid.sys -- (WacomVTHid)
DRV - [2009/07/07 04:53:04 | 000,028,160 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)
DRV - [2009/06/26 04:23:40 | 000,012,840 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccidflt.sys -- (CCIDFILTER)
DRV - [2009/06/12 10:51:02 | 000,205,624 | ---- | M] (Wave Systems Corp.) [File_System | Auto] -- C:\Windows\System32\drivers\WavxDMgr.sys -- (WavxDMgr)
DRV - [2009/05/28 05:48:20 | 000,134,144 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\CtAudDrv.sys -- (CtAudDrv)
DRV - [2009/05/20 15:54:06 | 000,013,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009/04/11 00:38:59 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbccid.sys -- (USBCCID)
DRV - [2009/03/30 04:28:44 | 000,133,632 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Ufd.sys -- (OA001Ufd)
DRV - [2009/03/30 04:28:42 | 000,280,096 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\OA001Vid.sys -- (OA001Vid)
DRV - [2009/02/20 11:27:08 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System] -- C:\Windows\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2009/02/20 11:27:06 | 000,022,528 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot] -- C:\Windows\System32\drivers\BMLoad.sys -- (BMLoad)
DRV - [2008/07/04 06:09:00 | 007,537,824 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008/06/04 09:14:00 | 000,026,608 | ---- | M] (Dell Inc) [Kernel | Boot] -- C:\Windows\System32\drivers\PBADRV.sys -- (PBADRV)
DRV - [2008/02/20 16:19:56 | 000,030,816 | ---- | M] (Intel Corporation ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\iqvw32.sys -- (NAL)
DRV - [2008/01/20 22:23:50 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007/04/19 00:28:12 | 000,042,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Asfalrt.sys -- (AsfAlrt)
DRV - [2007/03/01 07:12:16 | 000,075,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\slabser.sys -- (slabser)
DRV - [2007/03/01 07:12:16 | 000,058,368 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\slabbus.sys -- (slabbus) CP210x USB Composite Device driver (WDM)
DRV - [2007/02/16 14:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2006/11/02 03:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/05/29 03:26:38 | 000,127,488 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nmwcd.sys -- (Nokia USB Phone Parent)
DRV - [2006/05/29 03:26:36 | 000,013,312 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nmwcdcm.sys -- (Nokia USB Modem)
DRV - [2006/05/29 03:26:36 | 000,008,704 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nmwcdc.sys -- (Nokia USB Generic)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=c4db783e000000000000000000000000&tlver=1.4.19.19&affID=17160
IE - HKLM\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Leitold_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www1.euro.dell.com/content/default.aspx?c=at&l=de&s=gen
IE - HKU\Leitold_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.at/
IE - HKU\Leitold_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Leitold_ON_C\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\Leitold_ON_C\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (Conduit Ltd.)
IE - HKU\Leitold_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "data:text/plain,browser.startup.homepage=hxxp://de.search.yahoo.com/firefox/?fr=ffbr-sfp"
FF - prefs.js..CommunityToolbar.SearchFromAddressBarSavedUrl: "data:text/plain,keyword.URL=hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=ffbr&type=moz35awe&p="
FF - prefs.js..browser.search.defaultthis.engineName: "Eazel-DE Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2096149&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.startup.homepage: "hxxp://search.avira.com/?l=dis&o=APN10397&gct=hp&dc=EU&locale=de_AT"
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100127023632
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}:3.2.5.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10397&locale=de_AT&apn_uid=61dd4475-cd15-4375-8d28-37b062e82d33&apn_ptnrs=%5EABV&apn_sauid=3BFA8207-FD50-4827-BF5D-08CAB336D270&apn_dtid=%5EYYYYYY%5EYY%5EAT&&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\3-addons\addon [2010/02/12 11:57:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/09 07:27:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/08/20 14:20:23 | 000,000,000 | ---D | M]
 
[2011/02/09 07:27:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Extensions
[2012/08/20 13:51:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\extensions
[2011/02/10 08:19:05 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/02/13 14:03:42 | 000,000,000 | ---D | M] (Eazel-DE Community Toolbar) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\extensions\{69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5}
[2011/02/13 14:03:39 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\extensions\engine@conduit.com
[2011/12/01 13:23:17 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\extensions\ffxtlbr@babylon.com
[2012/06/30 05:48:54 | 000,000,000 | ---D | M] (softonic.com) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\extensions\ffxtlbra@softonic.com
[2012/08/20 15:05:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\extensions\toolbar@ask.com
[2012/08/11 13:24:25 | 000,002,344 | ---- | M] () -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\searchplugins\askcom.xml
[2011/02/13 14:06:05 | 000,000,921 | ---- | M] () -- C:\Users\Leitold\AppData\Roaming\Mozilla\Firefox\Profiles\98k5vjwo.default\searchplugins\conduit.xml
[2012/06/24 12:25:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/02/09 07:27:23 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files\Mozilla Firefox\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/06/24 12:26:16 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/05/09 03:28:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/15 15:53:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2012/03/09 12:55:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012/03/09 12:55:05 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/11/22 10:43:38 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/12/01 13:23:18 | 000,002,423 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2010/11/22 10:43:38 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010/11/22 10:43:38 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/11/22 10:43:38 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010/11/22 10:43:38 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Softonic Helper Object) - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files\Softonic\Softonic\1.5.24.3\bh\Softonic.dll (Softonic.com)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files\Softonic\Softonic\1.5.24.3\SoftonicTlbr.dll (Softonic.com)
O3 - HKLM\..\Toolbar: (Eazel-DE Toolbar) - {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - C:\Program Files\Eazel-DE\tbEaze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\Leitold_ON_C\..\Toolbar\WebBrowser: (Eazel-DE Toolbar) - {69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - C:\Program Files\Eazel-DE\tbEaze.dll (Conduit Ltd.)
O3 - HKU\Leitold_ON_C\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.)
O4 - HKLM..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DellConnectionManager] C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe (Smith Micro Software, Inc.)
O4 - HKLM..\Run: [DellControlPoint] C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe (Dell Inc.)
O4 - HKLM..\Run: [EPSON Product Registrierungserinnerung] C:\Windows\Temp\RegModule.exe (Seiko Epson Corporation)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe (Broadcom Corporation)
O4 - HKLM..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe (Wave Systems Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\Leitold_ON_C..\Run: [] C:\Users\Leitold\AppData\Local\Temp\omtsijcbdnrzv.exe (Hama Photo)
O4 - HKU\Leitold_ON_C..\Run: [ANT Agent] C:\Program Files\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
O4 - HKU\Leitold_ON_C..\Run: [gStart] C:\Program Files\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKU\Leitold_ON_C..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\Leitold_ON_C..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe (Samsung)
O4 - HKU\Leitold_ON_C..\Run: [syshost32] C:\Users\Leitold\AppData\Local\{5B21D56F-81A8-C13D-701F-83B64FDEFB92}\syshost.exe (Viking InterWorks)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\Leitold\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk =  File not found
O4 - Startup: C:\Users\Leitold\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pfeifen - Verknüpfung.lnk = C:\Users\Leitold\Desktop\Wolfi\Veranstaltungen, Gernot,\Pfeifen.xlsx ()
O4 - Startup: C:\Users\Leitold\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Veranstaltungen - Verknüpfung.lnk = C:\Users\Leitold\Desktop\Wolfi\Veranstaltungen, Gernot,\Veranstaltungen.xlsx ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB (Reg Error: Key error.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O30 - LSA: Authentication Packages - (wvauth) - C:\Windows\System32\wvauth.dll (Wave Systems Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{1be0ef30-1a39-11df-88ae-0024e8d0057a}\Shell - "" = AutoRun
O33 - MountPoints2\{1be0ef30-1a39-11df-88ae-0024e8d0057a}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{36e9225d-5f06-11e1-905a-b8e6bef6ab4b}\Shell - "" = AutoRun
O33 - MountPoints2\{36e9225d-5f06-11e1-905a-b8e6bef6ab4b}\Shell\AutoRun\command - "" = F:\SamsungKiesInstaller.exe
O33 - MountPoints2\{7cfba570-6716-11df-9155-0ceee6bc1674}\Shell - "" = AutoRun
O33 - MountPoints2\{7cfba570-6716-11df-9155-0ceee6bc1674}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{8a42c2fd-0918-11df-90c2-0024e8d0057a}\Shell - "" = AutoRun
O33 - MountPoints2\{8a42c2fd-0918-11df-90c2-0024e8d0057a}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{afc1dbcc-17ef-11df-a6d2-0ceee6bc1674}\Shell - "" = AutoRun
O33 - MountPoints2\{afc1dbcc-17ef-11df-a6d2-0ceee6bc1674}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
NetSvcs: ezGOSvc - C:\Windows\System32\ezGOSvc.dll ()
NetSvcs: em:id>{ec8030f7-c20a-464f-9b0e-13a3a9e97384}</em:id>
        <em:minVersion>1.0</em:minVersion>
        <em:maxVersion>5.0+</em:maxVersion>
      </Description>
    </em:targetApplication>
  </Description>     
</RDF>

 -  File not found
NetSvcs: aData -->
    <em:name>Default</em:name>
    <em:description>The default theme.</em:description>

    <!-- EXTENSION AUTHORS!
        DO NOT COPY THIS PROPERTY INTO YOUR INSTALL RDF FILES
        It will cause -  File not found
 
MsConfig - StartUpReg: ANT Agent - hkey= - key= - C:\Program Files\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.)
MsConfig - State: "startup" - 2
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/09/13 12:12:18 | 000,000,000 | ---D | C] -- C:\3-addons
[2012/09/06 07:55:18 | 000,000,000 | ---D | C] -- C:\Users\Leitold\AppData\Local\{5B21D56F-81A8-C13D-701F-83B64FDEFB92}
[2012/08/21 06:48:01 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012/08/21 06:48:00 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/08/21 06:48:00 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/08/21 06:47:59 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/08/21 06:47:59 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/08/21 06:47:59 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/08/21 06:47:58 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/08/21 06:47:58 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012/08/21 06:47:49 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/08/21 03:17:08 | 000,623,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012/09/13 04:50:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/13 04:50:53 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012/09/13 04:50:39 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/13 04:50:39 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/13 04:50:37 | 000,028,029 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012/09/13 04:50:25 | 3745,443,840 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/13 04:44:32 | 000,000,000 | ---- | M] () -- C:\Users\Leitold\AppData\Local\WavXMapDrive.bat
[2012/09/13 04:44:10 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/09/12 10:25:13 | 000,631,488 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/09/12 10:25:13 | 000,598,512 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/09/12 10:25:13 | 000,127,102 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/09/12 10:25:13 | 000,104,526 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/09/12 10:22:16 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/12 10:22:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/12 05:43:17 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/06 12:32:14 | 000,028,029 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012/09/06 10:02:00 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/24 12:08:14 | 000,399,496 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/08/20 14:20:23 | 000,002,425 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012/08/19 13:43:21 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012/08/19 13:43:21 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
 
========== Files Created - No Company Name ==========
 
[2012/09/13 04:40:53 | 3745,443,840 | -HS- | C] () -- C:\hiberfil.sys
[2012/09/12 10:22:16 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/31 13:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012/01/31 13:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2012/01/31 13:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2012/01/31 13:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2012/01/31 13:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2011/12/01 13:23:33 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2011/07/03 13:46:36 | 000,073,600 | ---- | C] () -- C:\Windows\System32\ezGOSvc.dll
[2010/03/23 11:02:41 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2010/03/03 15:08:29 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/03/03 15:08:29 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/03/03 15:07:20 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010/02/20 15:44:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/01/17 14:56:41 | 000,000,967 | ---- | C] () -- C:\Windows\3dpokerbandit.INI
[2010/01/17 14:51:09 | 000,000,004 | ---- | C] () -- C:\Windows\wintov10.ini
[2010/01/06 07:13:06 | 000,007,592 | ---- | C] () -- C:\Users\Leitold\AppData\Local\d3d9caps.dat
[2009/12/02 10:18:59 | 000,024,206 | ---- | C] () -- C:\Users\Leitold\AppData\Roaming\UserTile.png
[2009/12/01 08:02:27 | 000,028,029 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/12/01 08:02:27 | 000,028,029 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/11/21 04:22:23 | 000,000,216 | ---- | C] () -- C:\Windows\cgw44a.ini
[2009/11/21 04:22:23 | 000,000,023 | ---- | C] () -- C:\Windows\cis.ini
[2009/11/15 08:52:22 | 000,081,408 | ---- | C] () -- C:\Users\Leitold\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/15 08:22:17 | 000,061,440 | ---- | C] () -- C:\Windows\System32\cdTextCtl.dll
[2009/11/15 08:09:13 | 000,000,182 | ---- | C] () -- C:\Windows\System32\EBPPORT4.DAT
[2009/11/15 08:08:58 | 000,000,025 | ---- | C] () -- C:\Windows\CDER300Euro.ini
[2009/11/15 07:40:51 | 000,096,768 | ---- | C] () -- C:\Windows\SlantAdj.dll
[2009/11/15 07:40:51 | 000,003,136 | ---- | C] () -- C:\Windows\Ade001.bin
[2009/11/15 07:40:51 | 000,000,072 | ---- | C] () -- C:\Windows\System32\epDPE.ini
[2009/11/15 07:40:34 | 000,000,022 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009/11/15 07:40:33 | 000,030,605 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2009/11/15 07:40:33 | 000,027,030 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2009/11/15 07:40:15 | 000,065,793 | ---- | C] () -- C:\Windows\System32\esfw43.bin
[2009/11/15 07:39:51 | 000,000,027 | ---- | C] () -- C:\Windows\CDE P4180EGD.ini
[2009/11/15 06:25:16 | 000,000,667 | ---- | C] () -- C:\Windows\ODBC.INI
[2009/11/15 06:12:44 | 000,000,268 | RH-- | C] () -- C:\ProgramData\PPD Plugins
[2009/11/15 06:12:44 | 000,000,268 | RH-- | C] () -- C:\Users\Leitold\AppData\Roaming\Organic
[2009/11/15 06:12:44 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2009/11/15 06:12:44 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Piano Hard
[2009/11/15 06:10:40 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Overdrive
[2009/11/15 06:10:40 | 000,000,268 | RH-- | C] () -- C:\Users\Leitold\AppData\Roaming\NetServices
[2009/11/15 06:10:40 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2009/11/15 06:10:40 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Percussion Kit
[2009/11/14 02:24:18 | 000,000,000 | ---- | C] () -- C:\Users\Leitold\AppData\Local\WavXMapDrive.bat
[2009/11/07 03:43:32 | 000,055,296 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2009/11/07 03:43:32 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
[2009/11/07 03:42:44 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2009/11/07 03:36:22 | 000,279,888 | ---- | C] () -- C:\Windows\System32\brcmbsp.dll
[2009/11/07 03:33:16 | 000,080,368 | ---- | C] () -- C:\Windows\System32\pbadrvdll.dll
[2009/08/03 10:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 10:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/07/22 13:03:06 | 000,143,360 | R--- | C] () -- C:\Windows\System32\preflib.dll
[2009/06/05 10:41:18 | 000,557,056 | ---- | C] () -- C:\Windows\System32\AmRes_fr.dll
[2009/06/05 10:41:18 | 000,528,384 | ---- | C] () -- C:\Windows\System32\AmRes_en.dll
[2009/06/05 10:41:16 | 000,552,960 | ---- | C] () -- C:\Windows\System32\AmRes_it.dll
[2009/06/05 10:41:16 | 000,552,960 | ---- | C] () -- C:\Windows\System32\AmRes_es.dll
[2009/06/05 10:41:16 | 000,536,576 | ---- | C] () -- C:\Windows\System32\AmRes_ja.dll
[2009/06/05 10:41:14 | 000,540,672 | ---- | C] () -- C:\Windows\System32\AmRes_pt-BR.dll
[2009/06/05 10:41:14 | 000,520,192 | ---- | C] () -- C:\Windows\System32\AmRes_ko.dll
[2009/06/05 10:41:12 | 000,581,632 | ---- | C] () -- C:\Windows\System32\AmRes_ru.dll
[2009/06/05 10:41:12 | 000,491,520 | ---- | C] () -- C:\Windows\System32\AmRes_zh-CHT.dll
[2009/06/05 10:41:12 | 000,491,520 | ---- | C] () -- C:\Windows\System32\AmRes_zh-CHS.dll
[2009/06/05 10:41:10 | 000,557,056 | ---- | C] () -- C:\Windows\System32\AmRes_nl.dll
[2009/06/05 10:41:10 | 000,540,672 | ---- | C] () -- C:\Windows\System32\AmRes_cs.dll
[2009/06/05 10:41:10 | 000,528,384 | ---- | C] () -- C:\Windows\System32\AmRes_da.dll
[2009/06/05 10:41:08 | 000,544,768 | ---- | C] () -- C:\Windows\System32\AmRes_pl.dll
[2009/06/05 10:41:08 | 000,532,480 | ---- | C] () -- C:\Windows\System32\AmRes_sv.dll
[2009/06/05 10:41:08 | 000,528,384 | ---- | C] () -- C:\Windows\System32\AmRes_no.dll
[2009/06/05 10:41:06 | 000,552,960 | ---- | C] () -- C:\Windows\System32\AmRes_el.dll
[2009/06/05 10:41:06 | 000,524,288 | ---- | C] () -- C:\Windows\System32\AmRes_ar.dll
[2009/06/05 10:41:04 | 000,548,864 | ---- | C] () -- C:\Windows\System32\AmRes_pt-PT.dll
[2009/06/05 10:41:04 | 000,544,768 | ---- | C] () -- C:\Windows\System32\AmRes_hu.dll
[2009/06/05 10:41:04 | 000,536,576 | ---- | C] () -- C:\Windows\System32\AmRes_fi.dll
[2009/06/05 10:41:04 | 000,516,096 | ---- | C] () -- C:\Windows\System32\AmRes_he.dll
[2009/06/05 10:41:02 | 000,548,864 | ---- | C] () -- C:\Windows\System32\AmRes_ro.dll
[2009/06/05 10:41:00 | 000,540,672 | ---- | C] () -- C:\Windows\System32\AmRes_tr.dll
[2009/06/05 10:31:18 | 000,561,152 | ---- | C] () -- C:\Windows\System32\AmRes_de.dll
[2009/06/03 08:08:48 | 000,098,304 | ---- | C] () -- C:\Windows\System32\Internationalization_tr.dll
[2009/06/03 08:08:46 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_ro.dll
[2009/06/03 08:08:46 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_pt-BR.dll
[2009/06/03 08:08:44 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_hu.dll
[2009/06/03 08:08:42 | 000,098,304 | ---- | C] () -- C:\Windows\System32\Internationalization_fi.dll
[2009/06/03 08:08:42 | 000,094,208 | ---- | C] () -- C:\Windows\System32\Internationalization_he.dll
[2009/06/03 08:08:40 | 000,106,496 | ---- | C] () -- C:\Windows\System32\Internationalization_el.dll
[2009/06/03 08:08:38 | 000,098,304 | ---- | C] () -- C:\Windows\System32\Internationalization_cs.dll
[2009/06/03 08:08:36 | 000,094,208 | ---- | C] () -- C:\Windows\System32\Internationalization_ar.dll
[2009/06/03 08:08:36 | 000,081,920 | ---- | C] () -- C:\Windows\System32\Internationalization_zh-CHT.dll
[2009/06/03 08:08:34 | 000,081,920 | ---- | C] () -- C:\Windows\System32\Internationalization_zh-CHS.dll
[2009/06/03 08:08:32 | 000,098,304 | ---- | C] () -- C:\Windows\System32\Internationalization_sv.dll
[2009/06/03 08:08:32 | 000,098,304 | ---- | C] () -- C:\Windows\System32\Internationalization_ru.dll
[2009/06/03 08:08:30 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_pt.dll
[2009/06/03 08:08:28 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_pl.dll
[2009/06/03 08:08:28 | 000,098,304 | ---- | C] () -- C:\Windows\System32\Internationalization_no.dll
[2009/06/03 08:08:26 | 000,106,496 | ---- | C] () -- C:\Windows\System32\Internationalization_nl.dll
[2009/06/03 08:08:24 | 000,090,112 | ---- | C] () -- C:\Windows\System32\Internationalization_ko.dll
[2009/06/03 08:08:24 | 000,090,112 | ---- | C] () -- C:\Windows\System32\Internationalization_ja.dll
[2009/06/03 08:08:22 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_it.dll
[2009/06/03 08:08:20 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_fr.dll
[2009/06/03 08:08:20 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_es.dll
[2009/06/03 08:08:16 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_de.dll
[2009/06/03 08:08:16 | 000,102,400 | ---- | C] () -- C:\Windows\System32\Internationalization_da.dll
[2009/06/03 07:07:50 | 000,010,752 | ---- | C] () -- C:\Windows\System32\Wavx_ESC_Logging.dll
[2009/05/18 03:34:04 | 000,249,856 | ---- | C] () -- C:\Windows\System32\wxvault.dll
[2009/05/05 05:34:22 | 000,839,680 | ---- | C] () -- C:\Windows\System32\DemoLicense.dll
[2009/04/28 17:16:38 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/04/28 06:21:03 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008/09/19 07:14:16 | 000,024,056 | ---- | C] () -- C:\Windows\System32\providers.bin
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008/04/28 06:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008/03/25 04:46:00 | 000,077,536 | ---- | C] () -- C:\Windows\System32\xltZlib.dll
[2008/01/21 04:31:48 | 000,631,488 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/01/21 04:31:48 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/01/21 04:31:48 | 000,127,102 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/01/21 04:31:48 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007/04/19 00:52:16 | 000,080,720 | ---- | C] () -- C:\Windows\System32\AsfBios.dll
[2007/04/19 00:28:10 | 000,025,424 | ---- | C] () -- C:\Windows\System32\drivers\netamsg.dll
[2006/11/02 08:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:43 | 000,399,496 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 06:33:01 | 000,598,512 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,104,526 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/06/30 07:58:44 | 000,176,128 | R--- | C] () -- C:\Windows\System32\bioapi_mds300.dll
[2006/06/30 07:58:44 | 000,126,976 | R--- | C] () -- C:\Windows\System32\bioapi100.dll
[2005/12/07 07:31:00 | 000,202,752 | R--- | C] () -- C:\Windows\System32\CddbCdda.dll
[2004/09/10 08:34:00 | 000,917,504 | ---- | C] () -- C:\Windows\System32\lmgr10.dll
[2004/09/10 08:34:00 | 000,057,344 | ---- | C] () -- C:\Windows\System32\ADsSecurity.dll
[2001/11/14 07:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
[1999/01/22 14:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL
 
========== LOP Check ==========
 
[2012/09/05 09:59:56 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\3DataManager
[2009/11/14 02:24:15 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Broadcom
[2010/01/06 06:47:30 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Datalayer
[2012/09/13 04:46:15 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Dropbox
[2012/04/02 13:18:36 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\EPSON
[2009/12/31 14:30:15 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Farm Mania
[2009/11/21 05:30:50 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\GARMIN
[2012/01/06 14:16:47 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\go
[2010/05/13 06:00:52 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Nikon
[2010/01/06 07:38:13 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Nokia
[2011/07/31 03:32:00 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Nokia Multimedia Player
[2010/01/06 07:30:45 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\PC Suite
[2010/01/06 06:55:09 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\PeerNetworking
[2010/02/12 11:57:31 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Program Files
[2012/06/30 05:52:50 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Rovio
[2012/02/16 09:23:57 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Samsung
[2010/04/14 04:00:32 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Smart Panel
[2009/11/15 09:37:13 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Transcend
[2009/11/14 02:24:17 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\Wave Systems Corp
[2010/10/05 15:30:35 | 000,000,000 | ---D | M] -- C:\Users\Leitold\AppData\Roaming\WTouch
[2010/11/24 13:30:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Alwil Software
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2010/10/05 15:31:08 | 000,000,000 | ---D | M] -- C:\ProgramData\AppData
[2009/11/07 03:45:58 | 000,000,000 | ---D | M] -- C:\ProgramData\AT&T
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2010/01/06 07:57:49 | 000,000,000 | ---D | M] -- C:\ProgramData\Downloaded Installations
[2012/01/06 14:16:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Easybits GO
[2009/11/15 06:12:44 | 000,000,000 | ---D | M] -- C:\ProgramData\EnterNHelp
[2010/12/05 14:24:24 | 000,000,000 | ---D | M] -- C:\ProgramData\FarmFrenzy2
[2011/01/11 10:44:39 | 000,000,000 | ---D | M] -- C:\ProgramData\FarmFrenzy3_America
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/11/21 05:30:50 | 000,000,000 | ---D | M] -- C:\ProgramData\GARMIN
[2010/02/19 04:51:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Intenium
[2011/05/11 11:33:25 | 000,000,000 | ---D | M] -- C:\ProgramData\kD01835GpEnO01835
[2009/11/15 06:11:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Nikon
[2009/11/07 03:47:17 | 000,000,000 | ---D | M] -- C:\ProgramData\NTRU Cryptosystems
[2009/11/15 08:43:12 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2012/02/16 08:24:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Samsung
[2011/06/01 11:51:11 | 000,000,000 | ---D | M] -- C:\ProgramData\SBT
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2009/11/15 08:12:59 | 000,000,000 | ---D | M] -- C:\ProgramData\UDL
[2009/11/15 06:12:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Ultima_T15
[2009/11/07 03:55:06 | 000,000,000 | ---D | M] -- C:\ProgramData\Uninstall
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2010/06/29 11:18:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Wave Systems Corp
[2011/10/14 09:57:53 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2011/02/13 14:04:07 | 000,000,000 | ---D | M] -- C:\ProgramData\WinZip
[2010/02/20 16:24:14 | 000,000,000 | ---D | M] -- C:\ProgramData\Zylom
[2012/09/13 04:50:53 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2009/11/14 02:24:07 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012/09/13 12:12:18 | 000,000,000 | ---D | M] -- C:\3-addons
[2010/03/08 16:55:02 | 000,000,000 | -HSD | M] -- C:\Boot
[2010/11/29 05:46:26 | 000,000,000 | ---D | M] -- C:\CGW440A
[2009/11/15 08:36:52 | 000,000,000 | ---D | M] -- C:\DELL
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009/11/21 05:29:32 | 000,000,000 | ---D | M] -- C:\Garmin
[2009/11/07 03:38:18 | 000,000,000 | ---D | M] -- C:\Intel
[2009/11/22 08:20:37 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2008/01/20 22:33:10 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012/08/21 03:06:00 | 000,000,000 | R--D | M] -- C:\Program Files
[2012/08/20 14:22:10 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2009/11/14 02:21:59 | 000,000,000 | -HSD | M] -- C:\Programme
[2012/09/06 08:57:07 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/02/24 12:51:54 | 000,000,000 | ---D | M] -- C:\Temp
[2009/11/14 02:23:20 | 000,000,000 | R--D | M] -- C:\Users
[2012/09/11 14:10:09 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2008/01/20 22:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008/01/20 22:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008/01/20 22:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/20 22:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/20 22:23:26 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006/11/02 05:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/04/28 16:59:44 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\drivers\atapi.sys
[2009/04/28 16:59:44 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys
[2009/04/28 16:59:44 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 02:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/03/06 00:21:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2209DBCD72FD45199BAE483DDBCA5D75 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_bdffb04d\atapi.sys
[2008/03/06 00:21:17 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2209DBCD72FD45199BAE483DDBCA5D75 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22130_none_dda155213abfc239\atapi.sys
[2008/01/20 22:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/20 22:23:26 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2008/03/06 00:24:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=49996882C3272D944D027E03FCD89F6B -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_fbc3e716\atapi.sys
[2008/03/06 00:24:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=49996882C3272D944D027E03FCD89F6B -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20786_none_db8b089b3dbc5507\atapi.sys
[2006/11/02 05:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2009/04/28 16:59:44 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_853be412\atapi.sys
[2009/04/28 16:59:44 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006/11/02 05:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 05:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2009/04/28 17:14:20 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009/04/28 17:14:20 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009/04/28 17:14:19 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009/04/28 17:14:20 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/20 22:24:50 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2009/02/11 12:26:18 | 000,407,576 | ---- | M] (Intel Corporation) MD5=1ADAA4F16073FD0C7270F451FD024E97 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/02/11 12:26:18 | 000,407,576 | ---- | M] (Intel Corporation) MD5=1ADAA4F16073FD0C7270F451FD024E97 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/02/11 12:11:50 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/02/11 12:11:50 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/04/28 02:25:58 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_ea118ff5\iaStor.sys
[2009/04/28 02:25:58 | 000,329,752 | ---- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_c491546e\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008/01/20 22:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008/01/20 22:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/20 22:23:47 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 05:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/04/11 02:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009/04/11 02:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/20 22:24:31 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006/11/02 05:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/20 22:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008/01/20 22:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/20 22:23:45 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008/01/20 22:25:18 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009/04/11 02:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009/04/11 02:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009/04/11 02:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008/01/20 22:24:47 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008/01/20 22:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008/01/20 22:25:16 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2012/07/03 07:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2012/07/03 07:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/01/20 22:25:17 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008/01/20 22:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008/01/20 22:25:11 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008/01/20 23:20:25 | 017,223,680 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 23:20:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 23:20:25 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009/04/11 02:28:19 | 000,142,336 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\fontext.dll
[2012/06/08 13:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\shell32.dll
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
< End of report >
--- --- ---

markusg 14.09.2012 19:58
aloa,
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O4 - HKU\Leitold_ON_C..\Run: [syshost32] C:\Users\Leitold\AppData\Local\{5B21D56F-81A8-C13D-701F-83B64FDEFB92}\syshost.exe (Viking InterWorks)
O4 - HKU\Leitold_ON_C..\Run: [] C:\Users\Leitold\AppData\Local\Temp\omtsijcbdnrzv.exe (Hama Photo)
 :Files
C:\Users\Leitold\AppData\Local\{5B21D56F-81A8-C13D-701F-83B64FDEFB92}
C:\Users\Leitold\AppData\Local\Temp\omtsijcbdnrzv.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

ChL 15.09.2012 20:44
Wenn ich gefragt werde, ob ich neu starten will, hängt sich der Computer auf - sprich er reagiert nicht mehr egal was ich klicke oder ob ich STRG-Alt-Entf mache.

Tipp?

Habe den computer ganz ausgeschaltet und normal starten versucht, jedoch kann die Reparatur bzw. Systemwiederherstellung nicht durchgeführt werden.

Danke

markusg 17.09.2012 18:45
poste mal ein neues otl log bitte

ChL 18.09.2012 08:17
Bin diese Woche leider beruflich unterwegs und erst naechste Woche Dienstag wieder zu Hause.

Ist das Log auch unter dem gebootetem System zu sehen wenn ich reboote? DENN:

Wie gesagt, wenn ich den Fix-Scan durchfuehre, werde ich zum Neustart aufgefordert und da haengt sich der Computer jedesmal auf.

markusg 19.09.2012 20:15
ne du sollst ja ein neues log, wie am anfang, erstellen bitte

ChL 25.09.2012 14:23
Zip file sollte hochgeladen sein, sonst lass es mich bitte wissen.

Warte auf nächste Instruktionen

zip file sollte hochgeladen sein, falls nicht lass es mich bitte wissen

warte auf nächste Anweisungen

markusg 25.09.2012 17:33
hi ich wollte nen neues log hier im thema

markusg 25.09.2012 18:55
bzw wenn der pc wieder startet:
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

ChL 25.09.2012 18:56
Also run scan durchführen? Mit welchem code? mit dem vom 12.9.?

Wie gesagt habe ich keine ahnung also wie komme zu diesem neuen log?

da computer nicht mehr normal startet soll ich im REATOGO-X-PE Desktop modus compofix.exe durchführen? verstehe ich das richtig?, denn zu meinem desktop komme ich nicht mehr

markusg 27.09.2012 16:53
hast du getestet ob du auf den desktop kommst, falls das wirklich nicht geht, müsste es aber eigendlich, neues otl log posten


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:57 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58