deckbett | 24.06.2011 19:15 | So, schonmal folgende Angaben: Schritt #1
OTL-Scan durchgeführt; Neustart Code:
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{147D6308-0614-4112-89B1-31402F9B82C4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{147D6308-0614-4112-89B1-31402F9B82C4}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Recovery\ deleted successfully.
C:\ProgramData\~31842040 moved successfully.
C:\ProgramData\~31842040r moved successfully.
C:\ProgramData\31842040 moved successfully.
C:\ProgramData\31317752 moved successfully.
File %USERPROFILE%\Windows Vista Repair.lnk not found.
C:\ProgramData\~31317752 moved successfully.
C:\ProgramData\~31317752r moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler\LogonScreens\Cache folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler\LogonScreens folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler\BootScreens\Cache folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler\BootScreens folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\WinStyler folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\TuneUp Registry Editor folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\StartUp Manager folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\Disk Space Explorer folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\Dashboard folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities\Backups folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software\TuneUp Utilities folder moved successfully.
C:\Users\*****\AppData\Roaming\TuneUp Software folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\xml\schemas folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\xml\misc folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\xml\data folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\xml folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\themes\windows_theme folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\themes\frostwire_theme folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\themes\CarbonClassic_theme folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\themes folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\.NetworkShare\Incomplete folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire\.NetworkShare folder moved successfully.
C:\Users\*****\AppData\Roaming\FrostWire folder moved successfully.
ADS C:\ProgramData\TEMP:5C321E34 deleted successfully.
========== COMMANDS ==========
OTL by OldTimer - Version 3.2.24.1 log created on 06242011_181619 Schritt #2
Unhide ausgeführt; Neustart Schritt #3
GMER durchgeführt; Log-Datei gespeichert; Neustart Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-24 19:43:37
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.CP10
Running: otmx0fd8.exe; Driver: C:\Users\*****\AppData\Local\Temp\fgldqkow.sys
---- Kernel code sections - GMER 1.0.15 ----
.text C:\Windows\system32\drivers\ACEDRV09.sys section is writeable [0x80C1C000, 0x3326E, 0xE8000020]
.pklstb C:\Windows\system32\drivers\ACEDRV09.sys entry point in ".pklstb" section [0x80C61000]
.relo2 C:\Windows\system32\drivers\ACEDRV09.sys unknown last section [0x80C7D000, 0x8E, 0x42000040]
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Threads - GMER 1.0.15 ----
Thread System [4:348] 877F1E7A
Thread System [4:352] 877F4008
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Media Center\Service\Scheduler@Heartbeat 0x65 0x78 0xCA 0x83 ...
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\*****\AppData\Local\Temp\Temp1_SFBT_Park_Set_$$.zip\SFBT_Park-Set \xa7\xa7.exe 1
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\*****\AppData\Local\Temp\Temp1_SFBT_Park_Set_$.zip\SFBT_Park-Set \xa7.exe 1
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\*****\AppData\Local\Temp\Temp1_SFBT_Park_Set_$$$.zip\SFBT_Park-Set \xa7\xa7\xa7.exe 1
---- EOF - GMER 1.0.15 ---- Schritt #4
OTL durchgeführt; Log gespeichert Code:
OTL logfile created on: 24.06.2011 19:53:09 - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\*****\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,49 Gb Total Physical Memory | 2,28 Gb Available Physical Memory | 65,23% Memory free
7,16 Gb Paging File | 6,08 Gb Available in Paging File | 84,90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 292,16 Gb Total Space | 163,29 Gb Free Space | 55,89% Space Free | Partition Type: NTFS
Drive D: | 5,93 Gb Total Space | 0,88 Gb Free Space | 14,84% Space Free | Partition Type: NTFS
Computer Name: *****-PC | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\*****\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe ()
========== Modules (SafeList) ==========
MOD - C:\Users\*****\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (PSI_SVC_2) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (SBSDWSCService) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (Intel Corporation)
SRV - (Remote UI Service) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel(R) Corporation)
SRV - (MCLServiceATL) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel(R) Corporation)
SRV - (ISSM) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe (Intel(R) Corporation)
SRV - (AlertService) Intel(R) -- C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel(R) Corporation)
SRV - (DQLWinService) -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe ()
SRV - (M1 Server) Intel(R) Viiv(TM) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe ()
SRV - (IntelDHSvcConf) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe (Intel(R) Corporation)
========== Driver Services (SafeList) ==========
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (cpuz135) -- C:\Windows\System32\drivers\cpuz135_x32.sys (CPUID)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (cpudrv) -- C:\Program Files\SystemRequirementsLab\cpudrv.sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (ACEDRV09) -- C:\Windows\System32\drivers\ACEDRV09.sys (Protect Software GmbH)
DRV - (pfc) -- C:\Windows\System32\drivers\pfc.sys (Padus, Inc.)
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (HCWU2DTD) -- C:\Windows\System32\drivers\hcwu2dtd.sys (Hauppauge Computer Works)
DRV - (Ps2) -- C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (HCWU2DTL) -- C:\Windows\System32\drivers\hcwu2dtl.sys (Hauppauge Computer Works)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 A8 69 2B 2C 24 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de) "
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.tagesschau.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: add-to-searchbox@maltekraus.de:2.0
FF - prefs.js..extensions.enabledItems: googlesharing@extension.thoughtcrime.org:0.21
FF - prefs.js..extensions.enabledItems: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {71328583-3CA7-4809-B4BA-570A85818FBB}:0.6.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6
FF - prefs.js..keyword.URL: "hxxp://www.google.de/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
FF - HKLM\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.03 07:18:06 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.18 12:23:09 | 000,000,000 | ---D | M]
[2010.11.10 16:26:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions
[2011.06.01 21:17:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions
[2011.02.15 13:42:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}-trash
[2011.06.01 21:17:48 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2011.06.01 21:17:49 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2011.04.05 07:28:12 | 000,000,000 | ---D | M] (GoogleSharing) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions\googlesharing@extension.thoughtcrime.org
[2011.04.05 07:28:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions\googlesharing@extension.thoughtcrime.org\chrome
[2011.04.05 07:28:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions\googlesharing@extension.thoughtcrime.org\components
[2011.04.05 07:28:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\azp24t3h.default\extensions\googlesharing@extension.thoughtcrime.org\defaults
[2010.11.10 17:28:16 | 000,001,094 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\abkuerzungende.xml
[2010.11.10 17:28:46 | 000,001,211 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\amazonde-.xml
[2010.11.10 17:31:05 | 000,001,788 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\ardapedia.xml
[2010.11.10 17:28:58 | 000,001,887 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\bookbutler.xml
[2010.11.10 17:31:46 | 000,001,167 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\club300-fotos-d.xml
[2010.11.10 17:32:08 | 000,001,169 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\club300-fotos-wp.xml
[2010.11.10 17:29:49 | 000,001,036 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\dictcc-de---en.xml
[2010.11.10 17:30:10 | 000,000,451 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\filmstartsde.xml
[2010.11.10 17:29:11 | 000,000,924 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\jokersde.xml
[2010.11.10 17:30:34 | 000,001,490 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\lastfm.xml
[2010.11.10 17:30:47 | 000,001,603 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\lautde.xml
[2010.11.10 17:29:33 | 000,001,884 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\leo-de---en.xml
[2011.01.28 19:49:47 | 000,001,707 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\naturguckerde.xml
[2010.11.10 17:27:05 | 000,001,162 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\wikipedia-de-.xml
[2010.11.10 17:27:18 | 000,001,151 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\wikipedia-en.xml
[2010.11.10 17:27:54 | 000,001,156 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\wiktionary.xml
[2010.11.10 17:26:30 | 000,000,723 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\azp24t3h.default\searchplugins\wissende.xml
[2011.05.03 07:18:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2011.02.15 15:56:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\USERS\*****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AZP24T3H.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2011.06.01 11:03:51 | 000,435,945 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 15001 more lines...
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\*****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\*****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2cf1e437-7876-11df-bbfb-001a92eb8022}\Shell - "" = AutoRun
O33 - MountPoints2\{2cf1e437-7876-11df-bbfb-001a92eb8022}\Shell\AutoRun\command - "" = J:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{8842034a-1f22-11dc-8034-001a92eb8022}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL J:\Recycled\ctfmon.exe
O33 - MountPoints2\{8842034a-1f22-11dc-8034-001a92eb8022}\Shell\Open(&0)\command - "" = J:\Recycled\ctfmon.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player 9 ActiveX
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - State: "startup" - 2
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011.06.24 18:16:19 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.06.24 09:14:40 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2011.06.23 19:28:14 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Malwarebytes
[2011.06.23 19:28:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.06.23 19:27:59 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.06.23 19:27:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.06.23 19:27:50 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.06.23 19:26:13 | 009,435,312 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\*****\Desktop\mbam-setup-1.51.0.1200.exe
[2011.06.23 13:39:01 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Repair
[2011.06.20 17:49:04 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Klausuren_PhyGeo_WiGeo
[2011.06.18 12:22:59 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.06.04 14:43:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Corel
[2011.06.04 14:43:07 | 000,000,000 | ---D | C] -- C:\ProgramData\CorelDRAW Home & Student Suite X5
[2011.06.04 08:30:45 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\Meine Paletten
[2011.06.04 08:30:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Protexis
[2011.06.02 11:53:25 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\vlc
[2011.06.02 11:36:13 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\System32\CSVer.dll
[2011.06.02 11:27:00 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2011.06.02 11:20:54 | 000,022,504 | ---- | C] (CPUID) -- C:\Windows\System32\drivers\cpuz135_x32.sys
[2011.06.02 11:20:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPU-Z
[2011.06.02 11:20:53 | 000,000,000 | ---D | C] -- C:\Program Files\CPU-Z
[2011.06.01 23:00:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2011.06.01 22:59:48 | 000,000,000 | ---D | C] -- C:\Program Files\VLC
[2011.06.01 21:30:21 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Opera
[2011.06.01 21:29:55 | 000,000,000 | R--D | C] -- C:\Users\*****\Downloads
[2011.06.01 10:57:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011.05.31 07:41:12 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2011.05.27 22:59:13 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Nokia Ovi Suite
[2011.05.27 22:12:36 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
[2011.05.27 22:12:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[2011.05.27 22:12:33 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Notepad++
[2011.05.27 22:12:33 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad++
[2011.05.27 21:51:41 | 000,000,000 | ---D | C] -- C:\ProgramData\NokiaAccount
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.06.24 19:49:47 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.06.24 19:48:17 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.24 19:48:17 | 000,003,568 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.24 19:48:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.24 19:46:11 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.06.24 18:38:02 | 000,302,592 | ---- | M] () -- C:\Users\*****\Desktop\otmx0fd8.exe
[2011.06.24 18:32:52 | 000,302,592 | ---- | M] () -- C:\Users\*****\Desktop\058qfw4t.exe
[2011.06.24 18:21:14 | 000,302,592 | ---- | M] () -- C:\Users\*****\Desktop\n7b0d346.exe
[2011.06.24 18:19:18 | 000,684,297 | ---- | M] () -- C:\Users\*****\Desktop\unhide.exe
[2011.06.24 09:08:22 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2011.06.23 19:29:17 | 000,638,510 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.23 19:29:17 | 000,604,126 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.23 19:29:17 | 000,130,462 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.23 19:29:17 | 000,107,562 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.23 19:28:00 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.23 19:20:34 | 009,435,312 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\*****\Desktop\mbam-setup-1.51.0.1200.exe
[2011.06.23 13:39:03 | 000,000,593 | ---- | M] () -- C:\Users\*****\Desktop\Windows Vista Repair.lnk
[2011.06.20 13:18:54 | 000,000,030 | ---- | M] () -- C:\Windows\Iedit_.INI
[2011.06.02 11:42:26 | 000,508,128 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.06.01 12:35:02 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2011.06.01 12:35:02 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2011.06.01 12:34:42 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011.06.01 11:03:51 | 000,435,945 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.27 23:00:44 | 000,022,016 | ---- | M] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.06.24 18:38:12 | 000,302,592 | ---- | C] () -- C:\Users\*****\Desktop\otmx0fd8.exe
[2011.06.24 18:32:46 | 000,302,592 | ---- | C] () -- C:\Users\*****\Desktop\n7b0d346.exe
[2011.06.24 18:32:46 | 000,302,592 | ---- | C] () -- C:\Users\*****\Desktop\058qfw4t.exe
[2011.06.24 18:26:53 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.06.24 18:26:53 | 000,000,733 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr - Verknüpfung.lnk
[2011.06.24 18:26:49 | 000,002,425 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011.06.24 18:26:49 | 000,001,830 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2011.06.24 18:26:49 | 000,000,860 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.06.24 18:21:00 | 000,684,297 | ---- | C] () -- C:\Users\*****\Desktop\unhide.exe
[2011.06.23 13:39:03 | 000,000,593 | ---- | C] () -- C:\Users\*****\Desktop\Windows Vista Repair.lnk
[2011.06.01 12:34:42 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.01.10 12:09:35 | 000,393,256 | ---- | C] () -- C:\Windows\System32\CNQ2414N.DAT
[2010.03.25 18:11:47 | 000,000,000 | ---- | C] () -- C:\Windows\OpPrintServer.INI
[2010.03.25 18:06:34 | 000,007,680 | ---- | C] () -- C:\Windows\System32\CNMVS61.DLL
[2010.03.01 20:03:40 | 000,000,030 | ---- | C] () -- C:\Windows\Iedit_.INI
[2010.02.19 22:48:59 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2009.08.06 18:48:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.06 18:46:30 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008.11.16 01:41:16 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.06.18 20:51:06 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1504.dll
[2008.03.25 16:56:08 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1461.dll
[2007.11.30 13:43:22 | 000,073,216 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2007.11.28 21:05:39 | 000,000,120 | ---- | C] () -- C:\Users\*****\AppData\Roaming\wklnhst.dat
[2007.11.06 09:55:50 | 000,000,021 | ---- | C] () -- C:\Windows\PMK35_SETUP.ini
[2007.10.31 18:54:28 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1364.dll
[2007.10.23 14:03:27 | 000,064,466 | ---- | C] () -- C:\Users\*****\AppData\Roaming\mdb.bin
[2007.10.12 17:01:07 | 000,000,096 | ---- | C] () -- C:\Users\*****\AppData\Local\fusioncache.dat
[2007.10.02 13:52:25 | 000,217,088 | R--- | C] () -- C:\Windows\System32\MafiaSetup.exe
[2007.10.02 13:41:18 | 000,217,088 | R--- | C] () -- C:\Users\*****\AppData\Roaming\MafiaSetup.exe
[2007.08.24 20:46:48 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll
[2007.06.30 19:41:36 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2007.06.30 19:41:23 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2007.06.30 19:41:22 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2007.06.30 19:41:20 | 000,151,552 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll
[2007.06.30 19:39:58 | 000,002,796 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2007.06.26 16:47:14 | 000,000,533 | ---- | C] () -- C:\Windows\eReg.dat
[2007.06.24 09:43:44 | 000,114,938 | ---- | C] () -- C:\Windows\hpqins13.dat
[2007.06.21 10:22:42 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.06.18 15:22:31 | 000,022,016 | ---- | C] () -- C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.06.16 23:40:17 | 000,028,915 | ---- | C] () -- C:\Users\*****\AppData\Roaming\UserTile.png
[2007.06.16 16:39:55 | 000,097,312 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
[2007.03.23 05:31:29 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1132.dll
[2007.03.23 05:28:35 | 000,638,510 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2007.03.23 05:28:35 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2007.03.23 05:28:35 | 000,130,462 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2007.03.23 05:28:35 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007.03.22 20:45:35 | 000,061,440 | ---- | C] () -- C:\Windows\System32\OsdRemove.exe
[2007.03.22 20:42:25 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom24.dll
[2007.03.22 20:42:25 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes24.dll
[2007.03.06 11:49:42 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1227.dll
[2007.01.10 13:56:34 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,508,128 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,604,126 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,107,562 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.08.11 00:00:40 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006.08.11 00:00:40 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006.06.23 11:09:34 | 000,019,968 | R--- | C] () -- C:\Windows\System32\cpuinf32.dll
[2002.03.21 14:39:02 | 000,073,728 | R--- | C] () -- C:\Windows\System32\UNACEV2.DLL
[2002.03.20 21:01:06 | 000,006,688 | R--- | C] () -- C:\Windows\System32\Digita.sys
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportUSB.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportSerial.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportIrDA.dll
[2002.03.20 21:00:20 | 000,049,152 | R--- | C] () -- C:\Windows\System32\TransportIrCOMM.dll
========== LOP Check ==========
[2007.06.27 20:27:29 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ACD Systems
[2011.04.20 11:18:41 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\AeroSnapApp
[2010.03.14 22:29:21 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Amazon
[2007.09.19 17:24:33 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Audacity
[2011.01.10 12:30:25 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Canon
[2010.11.24 15:35:25 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\CD-LabelPrint
[2011.02.20 16:13:52 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.01.28 09:41:39 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Gutscheinmieze
[2007.10.10 16:19:12 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICAClient
[2011.06.21 19:04:52 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICQ
[2007.06.16 21:16:37 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICQ Toolbar
[2007.06.16 21:18:45 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ICQLite
[2010.08.29 17:47:45 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\InfoRapid KnowledgeMap
[2007.11.06 14:43:52 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Nikon
[2011.06.02 13:40:04 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Nokia
[2011.06.02 13:40:05 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Nokia Ovi Suite
[2011.05.27 22:12:59 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Notepad++
[2009.08.07 10:02:18 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\OpenOffice.org
[2011.06.01 21:41:54 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Opera
[2010.12.02 15:44:22 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Orbit
[2011.01.09 21:33:13 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\PC Suite
[2007.06.16 23:46:17 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\PeerNetworking
[2010.12.02 15:41:15 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\ProgSense
[2011.02.05 11:12:26 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Software4u
[2011.02.09 15:08:45 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Swiss Academic Software
[2007.06.16 20:43:58 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Template
[2007.06.20 17:13:43 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Thunderbird
[2009.12.22 12:45:36 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Ulead Systems
[2007.06.18 13:45:32 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\WinBatch
[2011.06.24 19:47:18 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2010.07.16 12:31:06 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.08.06 19:12:18 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.06.18 16:42:41 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2007.06.16 16:18:13 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.12.02 15:42:57 | 000,000,000 | ---D | M] -- C:\Downloads
[2008.05.17 13:23:25 | 000,000,000 | ---D | M] -- C:\hp
[2007.07.11 13:12:27 | 000,000,000 | ---D | M] -- C:\Intel
[2010.01.12 13:06:11 | 000,000,000 | R--D | M] -- C:\MSOCache
[2007.06.30 19:42:47 | 000,000,000 | ---D | M] -- C:\MyVideos
[2008.05.28 13:06:51 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.06.23 19:27:50 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.06.24 18:16:20 | 000,000,000 | ---D | M] -- C:\ProgramData
[2008.05.17 13:26:09 | 000,000,000 | RHSD | M] -- C:\Recycled
[2011.05.20 13:49:04 | 000,000,000 | ---D | M] -- C:\Swsetup
[2011.06.24 19:55:31 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.01.23 11:11:37 | 000,000,000 | R--D | M] -- C:\Users
[2011.06.24 18:30:46 | 000,000,000 | ---D | M] -- C:\Windows
[2011.06.24 18:16:19 | 000,000,000 | ---D | M] -- C:\_OTL
< %PROGRAMFILES%\*.exe >
< %PROGRAMFILES%\*. >
[2011.02.02 18:23:09 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010.02.21 13:16:40 | 000,000,000 | ---D | M] -- C:\Program Files\Amazon
[2010.11.10 16:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010.03.25 10:06:59 | 000,000,000 | ---D | M] -- C:\Program Files\Avira
[2010.11.10 16:52:04 | 000,000,000 | ---D | M] -- C:\Program Files\Bonjour
[2011.01.10 12:11:32 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
[2011.01.10 12:09:24 | 000,000,000 | ---D | M] -- C:\Program Files\CanonBJ
[2011.06.01 10:51:45 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2010.11.24 15:35:17 | 000,000,000 | ---D | M] -- C:\Program Files\CD-LabelPrint
[2009.07.05 08:49:38 | 000,000,000 | ---D | M] -- C:\Program Files\ClearProg
[2011.06.04 14:43:27 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2011.04.06 17:16:55 | 000,000,000 | ---D | M] -- C:\Program Files\Corel
[2011.06.02 11:20:54 | 000,000,000 | ---D | M] -- C:\Program Files\CPU-Z
[2007.10.02 13:52:26 | 000,000,000 | ---D | M] -- C:\Program Files\Creative
[2007.06.16 16:18:13 | 000,000,000 | -HSD | M] -- C:\Program Files\Gemeinsame Dateien
[2011.01.14 00:57:49 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2011.04.06 17:26:48 | 000,000,000 | ---D | M] -- C:\Program Files\gs
[2007.06.24 09:44:01 | 000,000,000 | ---D | M] -- C:\Program Files\Hewlett-Packard
[2007.03.22 20:58:54 | 000,000,000 | ---D | M] -- C:\Program Files\HP
[2011.05.20 09:25:42 | 000,000,000 | ---D | M] -- C:\Program Files\ICQ7.5
[2011.01.14 16:37:49 | 000,000,000 | ---D | M] -- C:\Program Files\INKAR 2009
[2011.05.20 09:24:40 | 000,000,000 | ---D | M] -- C:\Program Files\InstallShield Installation Information
[2011.06.02 11:36:13 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2011.06.15 19:12:40 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2011.01.30 14:23:32 | 000,000,000 | ---D | M] -- C:\Program Files\iPod
[2011.01.30 14:25:03 | 000,000,000 | ---D | M] -- C:\Program Files\iTunes
[2011.02.15 15:55:58 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2011.06.23 19:28:04 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Games
[2009.03.16 17:50:43 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ICE
[2010.02.19 16:31:57 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2011.05.18 15:29:55 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010.06.25 17:57:27 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2010.08.12 21:09:07 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2011.05.19 13:01:25 | 000,000,000 | ---D | M] -- C:\Program Files\MozBackup
[2011.06.22 19:31:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010.09.22 13:42:59 | 000,000,000 | ---D | M] -- C:\Program Files\MP3Gain
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2011.05.31 07:41:12 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
[2007.06.16 18:44:49 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2011.06.02 13:43:42 | 000,000,000 | ---D | M] -- C:\Program Files\Nokia
[2011.05.27 22:12:39 | 000,000,000 | ---D | M] -- C:\Program Files\Notepad++
[2007.03.22 21:04:12 | 000,000,000 | ---D | M] -- C:\Program Files\Online-Dienste
[2007.11.15 18:43:05 | 000,000,000 | ---D | M] -- C:\Program Files\Panorama Maker 3
[2011.06.02 12:03:43 | 000,000,000 | ---D | M] -- C:\Program Files\PC-Doctor 5 for Windows
[2010.11.17 11:00:27 | 000,000,000 | ---D | M] -- C:\Program Files\PDF24
[2011.01.20 20:19:24 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2008.04.14 11:01:48 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2007.03.22 20:56:33 | 000,000,000 | ---D | M] -- C:\Program Files\Roxio
[2010.02.28 14:30:58 | 000,000,000 | ---D | M] -- C:\Program Files\Spybot - Search & Destroy
[2011.06.01 10:53:29 | 000,000,000 | ---D | M] -- C:\Program Files\SpywareBlaster
[2011.06.02 11:27:00 | 000,000,000 | ---D | M] -- C:\Program Files\SystemRequirementsLab
[2009.12.22 12:41:13 | 000,000,000 | ---D | M] -- C:\Program Files\Ulead Systems
[2006.11.02 15:01:55 | 000,000,000 | ---D | M] -- C:\Program Files\Uninstall Information
[2011.06.01 23:00:08 | 000,000,000 | ---D | M] -- C:\Program Files\VLC
[2009.08.06 19:05:41 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Calendar
[2009.08.06 19:05:38 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Collaboration
[2009.08.06 19:05:28 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Defender
[2009.08.06 19:05:37 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Journal
[2011.06.15 18:49:26 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Mail
[2010.10.23 13:54:33 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2007.06.16 16:18:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2009.08.06 19:05:34 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Photo Gallery
[2009.11.21 13:00:57 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Portable Devices
[2009.08.06 19:05:39 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Sidebar
[2008.02.19 18:49:44 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< MD5 for: EXPLORER.EXE >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2007.11.14 19:02:56 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2007.11.14 19:02:55 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SoftwareDistribution\Download\c8769c0a3306661ec8d7dc7ef7231b1c\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
< MD5 for: REGEDIT.EXE >
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
< MD5 for: SVCHOST.EXE >
[2006.11.02 11:45:47 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=10DA15933D582D2FEDCF705EFE394B09 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6000.16386_none_b38497a50862ad11\svchost.exe
[2008.01.19 09:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\System32\svchost.exe
[2008.01.19 09:33:32 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe
< MD5 for: USERINIT.EXE >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
< MD5 for: WININIT.EXE >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
< MD5 for: WINLOGON.EXE >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\c8769c0a3306661ec8d7dc7ef7231b1c\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-24 17:54:23
< End of report > Ich habe das Programm jetzt noch NICHT geschlossen, den Rechner noch NICHT neu gestartet! Muss ich das jetzt tun, bevor ich die Fragen beantworten soll?
Sehen die Log-Dateien überhaupt gut aus? |