"Bka" Trojaner eingefangen
Hallo,
ich habe mir vorgestern den Trojaner, der vorgibt vom Bka zu sein und 100 euro verlangt, eingefangen. Ich habe mich daraufhin im Internet schlau gemacht und mir auf dem Laptop die Kaspersky Rescue CD erstellt. Mit dieser habe ich dann gebootet und den Scanner laufn lassn. Der fand 2 Trojaner und die habe ich gelöscht. Als er fertig war habe ich denk PC ganz normal starten lassn aber das Bka festern kam dennoch. Ich habde dann nochmal den Scanner laufn lassn der diesmal allerdings nichts fand. Als ich den
PC danach nochmal gestartet hab habe ich den TaskManager geöffnet und Prozesse die mir nicht geheur waren geschlossn. Jetzt ist das Bka Fenster nicht gekommen, ich bin jetzt jedoch nicht sicher ob ich einfach den richtigen Prozess erwischt habe oder der Scanner doch erfolgreich war. Da ich meinen PC im moment ja benutzen kann habe ich gleich die OTl.exe geladen und ausgeführt. Die OTL datei findet ihr im anhang hoffe ihr könnt mir helfen und schon mal danke im vorraus. Code:
OTL logfile created on: 09.08.2011 23:25:27 - Run 2
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\philipp\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,01 Gb Available Physical Memory | 67,00% Memory free
6,17 Gb Paging File | 5,10 Gb Available in Paging File | 82,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173,99 Gb Total Space | 12,54 Gb Free Space | 7,21% Space Free | Partition Type: NTFS
Drive D: | 45,22 Gb Total Space | 21,54 Gb Free Space | 47,64% Space Free | Partition Type: NTFS
Computer Name: PHILIPP | User Name: philipp | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\philipp\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
PRC - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
PRC - C:\Programme\EXPERTool\TBPANEL.exe (Gainward Co.)
PRC - C:\Programme\TeamViewer3\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Search Settings\SearchSettings.exe (Vendio Services, Inc.)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\Programme\avmwlanstick\FRITZWLanMini.exe (AVM Berlin GmbH)
========== Modules (SafeList) ==========
MOD - C:\Users\philipp\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (CLTNetCnService) -- File not found
SRV - (AntiVirScheduler) -- C:\Program Files\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe (Avira GmbH)
SRV - (TeamViewer) -- C:\Program Files\TeamViewer3\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (HRService) -- C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (TestHandler) -- C:\FirstSteps\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Siemens Computers)
SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
========== Driver Services (SafeList) ==========
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Programme\AntiVir PersonalEdition Classic\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\AntiVir PersonalEdition Classic\avgio.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (AVIRA GmbH)
DRV - (AmdLLD) -- C:\Windows\System32\drivers\AmdLLD.sys (AMD, Inc.)
DRV - (TBPanel) -- C:\Windows\System32\drivers\TBPanel.sys (Windows (R) 2000 DDK provider)
DRV - (ElbyDelay) -- C:\Windows\System32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (nvatabus) -- C:\Windows\system32\drivers\nvatabus.sys (NVIDIA Corporation)
DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\Windows\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfdrv01a) StarForce Protection Environment Driver (version 1.x.a) -- C:\Windows\System32\drivers\sfdrv01a.sys (Protection Technology (StarForce))
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (tandpl) -- C:\Windows\System32\drivers\tandpl.sys ()
DRV - (enodpl) -- C:\Windows\System32\drivers\enodpl.sys ()
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\kb127\SearchSettings.dll (Vendio Services, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://googel.de/"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.103
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:4.0.21.0
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.2.0185
FF - prefs.js..extensions.enabledItems: {64e8cc5b-20db-4212-8320-178fc5ae71f7}:1.5
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.2.20080717
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.14 22:49:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.14 22:49:24 | 000,000,000 | ---D | M]
[2008.09.13 13:07:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\philipp\AppData\Roaming\mozilla\Extensions
[2011.08.09 20:17:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\philipp\AppData\Roaming\mozilla\Firefox\Profiles\vzkwfv5c.default\extensions
[2009.09.07 12:53:30 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\philipp\AppData\Roaming\mozilla\Firefox\Profiles\vzkwfv5c.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.07.05 17:44:42 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\philipp\AppData\Roaming\mozilla\Firefox\Profiles\vzkwfv5c.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.01.09 12:42:07 | 000,000,000 | ---D | M] (FaceMod Dislike Button) -- C:\Users\philipp\AppData\Roaming\mozilla\Firefox\Profiles\vzkwfv5c.default\extensions\{64e8cc5b-20db-4212-8320-178fc5ae71f7}
[2011.06.04 19:08:43 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\philipp\AppData\Roaming\mozilla\Firefox\Profiles\vzkwfv5c.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009.06.27 13:01:48 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\philipp\AppData\Roaming\mozilla\Firefox\Profiles\vzkwfv5c.default\extensions\battlefieldheroespatcher@ea.com
[2010.05.26 13:17:17 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\philipp\AppData\Roaming\mozilla\Firefox\Profiles\vzkwfv5c.default\extensions\DTToolbar@toolbarnet.com
[2010.05.26 13:17:10 | 000,002,059 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vzkwfv5c.default\searchplugins\daemon-search.xml
[2011.08.07 15:55:54 | 000,000,950 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vzkwfv5c.default\searchplugins\icqplugin-1.xml
[2009.12.29 23:04:14 | 000,000,950 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vzkwfv5c.default\searchplugins\icqplugin-2.xml
[2010.02.16 00:36:23 | 000,000,950 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vzkwfv5c.default\searchplugins\icqplugin-3.xml
[2010.05.17 15:04:50 | 000,000,950 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vzkwfv5c.default\searchplugins\icqplugin-4.xml
[2009.09.20 19:02:56 | 000,000,944 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\Mozilla\Firefox\Profiles\vzkwfv5c.default\searchplugins\icqplugin.xml
[2010.08.03 09:59:59 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.08.14 18:39:46 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.03 09:59:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2009.08.14 18:39:46 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}
[2009.06.05 14:45:32 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
[2009.07.04 20:57:01 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009.07.04 21:06:56 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2010.02.27 00:22:40 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
[2010.08.03 09:59:59 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.05.16 13:43:23 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.05.16 13:43:23 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.05.16 13:43:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.05.16 13:43:23 | 000,000,986 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.05.16 13:43:23 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SearchSettings Class) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Programme\Search Settings\kb127\SearchSettings.dll (Vendio Services, Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [avgnt] C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLanMini.exe (AVM Berlin GmbH)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SearchSettings] C:\Programme\Search Settings\SearchSettings.exe (Vendio Services, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{2F43B1D4-2431-5E4C-7AE0-A2086AC28B58}] File not found
O4 - HKCU..\Run: [avupdate] C:\Users\philipp\AppData\Roaming\jashla.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [GAINWARD] C:\Program Files\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\L_O_S_T_by_tungoy12.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\L_O_S_T_by_tungoy12.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{253e8769-481f-11dc-999d-001a9250b66c}\Shell - "" = AutoRun
O33 - MountPoints2\{253e8769-481f-11dc-999d-001a9250b66c}\Shell\AutoRun\command - "" = G:\pushinst.exe
O33 - MountPoints2\{8350c229-68b8-11df-bbdb-001a4f9d9f65}\Shell - "" = AutoRun
O33 - MountPoints2\{8350c229-68b8-11df-bbdb-001a4f9d9f65}\Shell\AutoRun\command - "" = F:\Autorun.exe
O33 - MountPoints2\{8a7f24e9-551b-11df-9179-001a9250b66c}\Shell - "" = AutoRun
O33 - MountPoints2\{8a7f24e9-551b-11df-9179-001a9250b66c}\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\{dd252f6d-a2e6-11df-8885-86c9b9560560}\Shell - "" = AutoRun
O33 - MountPoints2\{dd252f6d-a2e6-11df-8885-86c9b9560560}\Shell\AutoRun\command - "" = G:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2011.08.09 20:21:09 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\philipp\Desktop\OTL.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.08.09 23:24:31 | 000,000,140 | ---- | M] () -- C:\Users\philipp\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.URL
[2011.08.09 23:24:24 | 000,000,085 | ---- | M] () -- C:\Users\philipp\Desktop\Trojaner-Board - Neues Thema erstellen.URL
[2011.08.09 23:05:49 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.09 23:05:49 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.09 20:21:33 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\philipp\Desktop\OTL.exe
[2011.08.09 20:05:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.08 18:30:08 | 000,163,328 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\jashla.exe
[2011.08.08 18:25:10 | 000,000,041 | ---- | M] () -- C:\Users\philipp\AppData\Roaming\Spin Chat Preferences
[2011.07.17 15:02:54 | 000,651,038 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.07.17 15:02:54 | 000,618,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.07.17 15:02:54 | 000,121,090 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.07.17 15:02:54 | 000,107,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.08.09 23:24:31 | 000,000,140 | ---- | C] () -- C:\Users\philipp\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten - Trojaner-Board.URL
[2011.08.09 23:24:24 | 000,000,085 | ---- | C] () -- C:\Users\philipp\Desktop\Trojaner-Board - Neues Thema erstellen.URL
[2011.08.08 18:30:08 | 000,163,328 | ---- | C] () -- C:\Users\philipp\AppData\Roaming\jashla.exe
[2011.04.27 17:27:04 | 000,000,004 | ---- | C] () -- C:\Users\philipp\AppData\Roaming\steam_md4.dat
[2011.04.27 17:14:03 | 000,000,110 | ---- | C] () -- C:\Windows\System32\alterIWnet.ini
[2010.05.25 20:21:05 | 000,026,340 | ---- | C] () -- C:\Users\philipp\AppData\Roaming\UserTile.png
[2009.07.12 20:01:35 | 000,860,211 | --S- | C] () -- C:\Windows\System32\XSIFtk-3.6.2.1.dll
[2009.05.19 19:08:31 | 000,000,041 | ---- | C] () -- C:\Users\philipp\AppData\Roaming\Spin Chat Preferences
[2009.02.26 15:06:39 | 000,000,024 | ---- | C] () -- C:\Users\philipp\AppData\Local\.ipc_copyrecord
[2009.02.26 15:03:30 | 000,000,024 | ---- | C] () -- C:\Users\philipp\AppData\Local\84756-11986-27475-00TC1-94865
[2009.01.25 16:17:34 | 000,000,532 | ---- | C] () -- C:\Windows\eReg.dat
[2008.11.18 17:54:08 | 000,139,152 | ---- | C] () -- C:\Users\philipp\AppData\Roaming\PnkBstrK.sys
[2008.11.18 17:54:08 | 000,138,520 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2008.11.18 17:53:53 | 000,189,640 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2008.11.18 17:53:49 | 000,075,064 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2008.11.18 17:53:47 | 000,794,408 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2008.10.21 12:14:30 | 000,007,718 | ---- | C] () -- C:\Windows\cadx2.ini
[2008.10.07 10:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.10.04 14:08:16 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2008.09.13 13:15:12 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.06.05 09:58:26 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.06.04 14:14:36 | 000,001,530 | ---- | C] () -- C:\Users\philipp\AppData\Roaming\EasyToolz.ini
[2008.05.23 12:09:16 | 000,047,104 | ---- | C] () -- C:\Windows\System32\KMVIDC32.DLL
[2008.05.10 16:02:06 | 000,000,000 | ---- | C] () -- C:\Windows\galaxy.ini
[2008.02.28 13:12:39 | 000,000,095 | ---- | C] () -- C:\Users\philipp\AppData\Local\fusioncache.dat
[2007.12.07 15:39:49 | 000,002,032 | ---- | C] () -- C:\Users\philipp\AppData\Local\d3d9caps.dat
[2007.12.04 15:16:29 | 000,000,001 | ---- | C] () -- C:\Windows\System32\SI.bin
[2007.12.03 19:25:51 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2007.12.03 19:25:50 | 000,000,772 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2007.11.26 22:56:28 | 000,151,415 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2007.10.02 17:07:50 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys
[2007.10.02 17:07:50 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys
[2007.09.19 17:23:49 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.09.06 14:04:40 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2007.09.06 14:04:40 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2007.08.15 19:45:21 | 000,000,343 | ---- | C] () -- C:\Windows\ask.ini
[2007.08.11 17:35:57 | 000,097,312 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
[2007.07.01 18:21:37 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2007.07.01 18:21:35 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2007.06.28 20:37:37 | 000,038,912 | ---- | C] () -- C:\Users\philipp\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.06.28 20:22:39 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2007.05.16 09:35:44 | 002,071,552 | ---- | C] () -- C:\Windows\setup_rangers_2.exe
[2007.02.14 11:18:27 | 000,135,168 | ---- | C] () -- C:\Windows\System32\property.dll
[2006.11.02 17:33:31 | 000,651,038 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,121,090 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,318,168 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,618,272 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,107,416 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.08.11 10:52:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
========== LOP Check ==========
[2011.05.14 11:23:21 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\.minecraft
[2008.06.24 16:23:37 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\Acreon
[2009.06.06 14:37:59 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\Armagetron
[2007.07.21 09:24:27 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\CrystalSpace
[2010.05.26 13:23:59 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\DAEMON Tools Lite
[2008.07.24 14:59:28 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\ICQ
[2008.08.24 13:22:23 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\ICQ Toolbar
[2009.06.06 10:44:03 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\Lexware
[2010.02.27 00:37:46 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\OpenOffice.org
[2010.05.25 20:21:05 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\PeerNetworking
[2008.09.02 14:09:04 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\SPORE Creature Creator
[2008.11.18 18:47:02 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\TeamViewer
[2009.02.26 20:40:16 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\Teeworlds
[2009.08.05 11:23:08 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\Ubisoft
[2011.05.01 00:57:22 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\Uduc
[2011.06.25 15:33:51 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\uTorrent
[2011.05.03 17:15:52 | 000,000,000 | ---D | M] -- C:\Users\philipp\AppData\Roaming\Zegoyt
[2011.08.08 19:50:10 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2008.02.21 19:31:48 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2007.09.17 17:40:56 | 000,000,000 | ---D | M] -- C:\965cf9a323f4e1e789f52d74571453
[2011.02.17 21:04:35 | 000,000,000 | ---D | M] -- C:\BlueJ
[2007.02.14 11:19:18 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2007.06.28 18:56:55 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2007.02.14 12:00:34 | 000,000,000 | R--D | M] -- C:\DRIVER
[2007.06.28 19:01:52 | 000,000,000 | ---D | M] -- C:\FirstSteps
[2007.02.14 12:00:34 | 000,000,000 | R--D | M] -- C:\MANUAL
[2007.02.14 12:05:08 | 000,000,000 | ---D | M] -- C:\MSWorks
[2007.02.14 12:06:54 | 000,000,000 | ---D | M] -- C:\nero
[2009.05.06 17:03:16 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2011.07.06 13:28:15 | 000,000,000 | R--D | M] -- C:\Program Files
[2010.07.29 20:37:56 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2007.06.28 18:56:55 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.08.09 23:27:04 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2007.06.28 19:00:30 | 000,000,000 | R--D | M] -- C:\Users
[2011.08.08 20:33:22 | 000,000,000 | ---D | M] -- C:\Windows
[2007.02.14 11:46:10 | 000,000,000 | ---D | M] -- C:\x86
< %PROGRAMFILES%\*.exe >
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< MD5 for: EXPLORER.EXE >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\explorer.exe
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\SoftwareDistribution\Download\370a8a4bc0631584d862be923aa9fef0\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
< MD5 for: REGEDIT.EXE >
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\SoftwareDistribution\Download\370a8a4bc0631584d862be923aa9fef0\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
< MD5 for: USERINIT.EXE >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SoftwareDistribution\Download\370a8a4bc0631584d862be923aa9fef0\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
< MD5 for: WININIT.EXE >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\SoftwareDistribution\Download\370a8a4bc0631584d862be923aa9fef0\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
< MD5 for: WINLOGON.EXE >
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\SoftwareDistribution\Download\370a8a4bc0631584d862be923aa9fef0\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-08-05 10:32:49
< >
========== Alternate Data Streams ==========
@Alternate Data Stream - 487 bytes -> C:\ProgramData\TEMP:05EE1EEF
< End of report >
|
