Trojaner-Board - TR/PSW.zbot4706 HILFE!

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/PSW.zbot4706 HILFE! (https://www.trojaner-board.de/104021-tr-psw-zbot4706-hilfe.html)

TR/PSW.zbot4706 HILFE!

Hallo,

bei meiner letzten Antivir-Systemprüfung wurde u.a. der Trojaner TR/PSW.zbot.4706 gefunden. Die Datei wurde in die Quarantäne verschoben und gelöscht. Nach erneuten Prüfungen findet sowohl Antivir als auch Malwarebytes keinen Schädling mehr. Kann ich meinen PC nun als „sauber“ bezeichnen? Hab ja ne Menge schlechter Dinge über diese ZBOT Trojaner gelesen . Ich Poste nachfolgend mal den Antivir Bericht unn die Hijack Log Datei. Würde mich über eine Hilfestellung sehr freuen…

Avira AntiVir Professional
Erstellungsdatum der Reportdatei: Freitag, 7. Oktober 2011 14:36

Es wird nach 3368892 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Plattform : Windows XP
Windowsversion : (Service Pack 2) [5.1.2600]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : ORGA1

Versionsinformationen:
BUILD.DAT : 10.2.0.1059 41553 Bytes 07.09.2011 17:08:00
AVSCAN.EXE : 10.3.0.7 484008 Bytes 28.06.2011 10:35:31
AVSCAN.DLL : 10.0.5.0 57192 Bytes 28.06.2011 10:35:31
LUKE.DLL : 10.3.0.5 45416 Bytes 28.06.2011 10:35:31
LUKERES.DLL : 10.0.0.0 13672 Bytes 25.03.2010 06:43:37
AVSCPLR.DLL : 10.3.0.7 119656 Bytes 28.06.2011 10:35:31
AVREG.DLL : 10.3.0.9 88833 Bytes 12.07.2011 09:44:59
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 07:29:22
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 06:27:58
VBASE002.VDF : 7.11.3.0 1950720 Bytes 09.02.2011 06:24:54
VBASE003.VDF : 7.11.5.225 1980416 Bytes 07.04.2011 11:17:58
VBASE004.VDF : 7.11.8.178 2354176 Bytes 31.05.2011 11:24:25
VBASE005.VDF : 7.11.10.251 1788416 Bytes 07.07.2011 06:26:44
VBASE006.VDF : 7.11.13.60 6411776 Bytes 16.08.2011 08:25:19
VBASE007.VDF : 7.11.15.106 2389504 Bytes 05.10.2011 10:43:21
VBASE008.VDF : 7.11.15.107 2048 Bytes 05.10.2011 10:43:21
VBASE009.VDF : 7.11.15.108 2048 Bytes 05.10.2011 10:43:21
VBASE010.VDF : 7.11.15.109 2048 Bytes 05.10.2011 10:43:21
VBASE011.VDF : 7.11.15.110 2048 Bytes 05.10.2011 10:43:21
VBASE012.VDF : 7.11.15.111 2048 Bytes 05.10.2011 10:43:21
VBASE013.VDF : 7.11.15.144 161792 Bytes 07.10.2011 08:33:13
VBASE014.VDF : 7.11.15.145 2048 Bytes 07.10.2011 08:33:14
VBASE015.VDF : 7.11.15.146 2048 Bytes 07.10.2011 08:33:14
VBASE016.VDF : 7.11.15.147 2048 Bytes 07.10.2011 08:33:14
VBASE017.VDF : 7.11.15.148 2048 Bytes 07.10.2011 08:33:14
VBASE018.VDF : 7.11.15.149 2048 Bytes 07.10.2011 08:33:14
VBASE019.VDF : 7.11.15.150 2048 Bytes 07.10.2011 08:33:14
VBASE020.VDF : 7.11.15.151 2048 Bytes 07.10.2011 08:33:15
VBASE021.VDF : 7.11.15.152 2048 Bytes 07.10.2011 08:33:15
VBASE022.VDF : 7.11.15.153 2048 Bytes 07.10.2011 08:33:15
VBASE023.VDF : 7.11.15.154 2048 Bytes 07.10.2011 08:33:15
VBASE024.VDF : 7.11.15.155 2048 Bytes 07.10.2011 08:33:15
VBASE025.VDF : 7.11.15.156 2048 Bytes 07.10.2011 08:33:15
VBASE026.VDF : 7.11.15.157 2048 Bytes 07.10.2011 08:33:16
VBASE027.VDF : 7.11.15.158 2048 Bytes 07.10.2011 08:33:16
VBASE028.VDF : 7.11.15.159 2048 Bytes 07.10.2011 08:33:16
VBASE029.VDF : 7.11.15.160 2048 Bytes 07.10.2011 08:33:16
VBASE030.VDF : 7.11.15.161 2048 Bytes 07.10.2011 08:33:16
VBASE031.VDF : 7.11.15.164 24064 Bytes 07.10.2011 11:33:48
Engineversion : 8.2.6.80
AEVDF.DLL : 8.1.2.1 106868 Bytes 30.07.2010 05:38:12
AESCRIPT.DLL : 8.1.3.81 467322 Bytes 05.10.2011 05:35:30
AESCN.DLL : 8.1.7.2 127349 Bytes 22.11.2010 11:25:13
AESBX.DLL : 8.2.1.34 323957 Bytes 03.06.2011 05:33:36
AERDL.DLL : 8.1.9.15 639348 Bytes 09.09.2011 05:34:30
AEPACK.DLL : 8.2.10.11 684408 Bytes 23.09.2011 06:11:52
AEOFFICE.DLL : 8.1.2.15 201083 Bytes 16.09.2011 05:43:34
AEHEUR.DLL : 8.1.2.177 3744120 Bytes 07.10.2011 05:36:00
AEHELP.DLL : 8.1.17.7 254327 Bytes 29.07.2011 06:31:09
AEGEN.DLL : 8.1.5.9 401780 Bytes 29.08.2011 05:32:43
AEEMU.DLL : 8.1.3.0 393589 Bytes 22.11.2010 11:25:08
AECORE.DLL : 8.1.23.0 196983 Bytes 29.08.2011 05:32:42
AEBB.DLL : 8.1.1.0 53618 Bytes 26.04.2010 05:35:10
AVWINLL.DLL : 10.0.0.0 19304 Bytes 25.03.2010 06:43:34
AVPREF.DLL : 10.0.3.2 44904 Bytes 28.06.2011 10:35:31
AVREP.DLL : 10.0.0.10 174120 Bytes 17.05.2011 11:20:57
AVARKT.DLL : 10.0.26.1 255336 Bytes 28.06.2011 10:35:30
AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 28.06.2011 10:35:30
SQLITE3.DLL : 3.6.19.0 355688 Bytes 25.03.2010 06:43:37
AVSMTP.DLL : 10.0.0.17 63848 Bytes 25.03.2010 06:43:34
NETNT.DLL : 10.0.0.0 11624 Bytes 25.03.2010 06:43:37
RCIMAGE.DLL : 10.0.0.33 2858344 Bytes 28.06.2011 10:35:30
RCTEXT.DLL : 10.0.63.0 98664 Bytes 28.06.2011 10:35:30

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: c:\programme\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Freitag, 7. Oktober 2011 14:37

Der Suchlauf nach versteckten Objekten wird begonnen.
c:\windows\system32\tlntsvr.exe
c:\windows\system32\tlntsvr.exe
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'rsmsink.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'msdtc.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'dllhost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'dllhost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'EXCEL.EXE' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'MSACCESS.EXE' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '113' Modul(e) wurden durchsucht
Durchsuche Prozess 'OUTLOOK.EXE' - '108' Modul(e) wurden durchsucht
Durchsuche Prozess 'OpenCTI.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'FNPLicensingService.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMBgMonitor.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'msmsgs.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'ctfmon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'Acrotray.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'UpdateTool.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'EEventManager.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'Control Center.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'fpassist.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'ngtray.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'RUNDLL32.EXE' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedhlp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'TimounterMonitor.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrueImageMonitor.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'Smax4.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'smax4pnp.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '143' Modul(e) wurden durchsucht
Durchsuche Prozess 'alg.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmailc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'nSvcIp.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvsvc32.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'nSvcLog.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'apache.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'ngctw32.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'MDM.EXE' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'jqs.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'apache.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'schedul2.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '159' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '662' Dateien ).

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\3\6ade6383-7c650ab7
[0] Archivtyp: ZIP
--> support/Attachment.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/2010-0840.G
--> support/ForMail.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/2010-0840.H
C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\48\33598cb0-36186128
[FUND] Ist das Trojanische Pferd TR/PSW.Zbot.4706

Beginne mit der Desinfektion:
C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\48\33598cb0-36186128
[FUND] Ist das Trojanische Pferd TR/PSW.Zbot.4706
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c35a72d.qua' verschoben!
C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\3\6ade6383-7c650ab7
[FUND] Enthält Erkennungsmuster des Exploits EXP/2010-0840.H
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '549588d8.qua' verschoben!

Ende des Suchlaufs: Freitag, 7. Oktober 2011 15:49
Benötigte Zeit: 1:12:47 Stunde(n)

Der Suchlauf wurde abgebrochen!

14676 Verzeichnisse wurden überprüft
712297 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
2 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
712294 Dateien ohne Befall
4190 Archive wurden durchsucht
0 Warnungen
3 Hinweise
437421 Objekte wurden beim Rootkitscan durchsucht
1 Versteckte Objekte wurden gefunden

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:04:46, on 10.10.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\Explorer.EXE
C:\Programme\Analog Devices\Core\smax4pnp.exe
C:\Programme\Analog Devices\SoundMAX\Smax4.exe
C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe
C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\Symantec\Ghost\ngtray.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\Digitus\MFP Server Control Center\Control Center.exe
C:\Programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe
C:\Programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\DeTeWe\OpenCTI.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
C:\Programme\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe
C:\Dokumente und Einstellungen\Anmeldung\Eigene Dateien\Downloads\HiJackThis204.exe
C:\Programme\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.110:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.2.251;<local>
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NGTray] "C:\Programme\Symantec\Ghost\ngtray.exe"
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [Control Center] C:\Programme\Digitus\MFP Server Control Center\Control Center.exe -mini
O4 - HKLM\..\Run: [EEventManager] C:\Programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Update-Tool] C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\GEMEIN~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [OpenCTI] C:\Programme\DeTeWe\OpenCTI.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [egagv.exe] "C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Buteri\egagv.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = awt.home
O17 - HKLM\Software\..\Telephony: DomainName = awt.home
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B7F5306-BC2A-45FB-873A-C7BAAC963708}: NameServer = 192.168.2.250,192.168.2.252
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = awt.home
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = awt.home
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Symantec Ghost Client Agent (NGCLIENT) - Symantec Corporation - C:\Programme\Symantec\Ghost\ngctw32.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 9804 bytes

Zitat:

Nach erneuten Prüfungen findet sowohl Antivir als auch Malwarebytes keinen Schädling mehr.

Statt dem sinnfreien Hijackthis-Log hättest du mal besser ALLE Logs von Malwarebytes gepostet, bitte nachholen ;)

OK, hole ich morgen nach. ich weiß aber nicht wie sinnvoll die Malwarebytes-Logs sind, da erst nachdem ich mit Antivir die infizierten Dateien gelöscht habe, ich nochmal mit Malwarebytes nen Suchlauf gestartet habe...
Schon mal besten Dank im voraus!

leider kann ich nicht mehr informationen bieten...

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7912

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

10.10.2011 14:41:41
mbam-log-2011-10-10 (14-41-41).txt

Scan type: Quick scan
Objects scanned: 159302
Time elapsed: 2 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7912

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

10.10.2011 08:00:49
mbam-log-2011-10-10 (08-00-49).txt

Scan type: Quick scan
Objects scanned: 159032
Time elapsed: 2 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hier die Logs:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7912

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

12.10.2011 11:20:37
mbam-log-2011-10-12 (11-20-37).txt

Scan type: Full scan (C:\|D:\|E:\|S:\|U:\|V:\|)
Objects scanned: 298708
Time elapsed: 52 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=5525205440fb4944a3f596a1c0d4dc12
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-11 12:38:27
# local_time=2011-10-11 02:38:27 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1792 16777195 100 0 75007070 75007070 0 0
# compatibility_mode=8192 67108863 100 0 201 201 0 0
# scanned=1483
# found=0
# cleaned=0
# scan_time=265
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=5525205440fb4944a3f596a1c0d4dc12
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-11 12:57:18
# local_time=2011-10-11 02:57:18 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1792 16777195 100 0 75007444 75007444 0 0
# compatibility_mode=8192 67108863 100 0 575 575 0 0
# scanned=21300
# found=0
# cleaned=0
# scan_time=1022
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=5525205440fb4944a3f596a1c0d4dc12
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-12 08:25:27
# local_time=2011-10-12 10:25:27 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1792 16777195 100 0 75068751 75068751 0 0
# compatibility_mode=8192 67108863 100 0 61882 61882 0 0
# scanned=144577
# found=0
# cleaned=0
# scan_time=9804
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=5525205440fb4944a3f596a1c0d4dc12
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-12 10:47:18
# local_time=2011-10-12 12:47:18 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1792 16777195 100 0 75082075 75082075 0 0
# compatibility_mode=8192 67108863 100 0 75206 75206 0 0
# scanned=147072
# found=0
# cleaned=0
# scan_time=4990

Zitat:

Database version: 7912

Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.

So, jetzt aber :applaus::

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7934

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

13.10.2011 08:58:00
mbam-log-2011-10-13 (08-58-00).txt

Scan type: Full scan (C:\|D:\|E:\|S:\|U:\|V:\|)
Objects scanned: 296699
Time elapsed: 57 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

OTL Logfile:

Code:

OTL logfile created on: 14.10.2011 07:53:45 - Run 1[/B]

OTL by OldTimer - Version 3.2.29.1     Folder = C:\Dokumente und Einstellungen\Anmeldung\Eigene Dateien\Downloads

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,53 Gb Available Physical Memory | 76,50% Memory free

3,85 Gb Paging File | 3,47 Gb Available in Paging File | 90,31% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,31 Gb Total Space | 70,25 Gb Free Space | 74,49% Space Free | Partition Type: NTFS

Drive D: | 92,00 Gb Total Space | 88,15 Gb Free Space | 95,81% Space Free | Partition Type: NTFS

Drive S: | 99,99 Gb Total Space | 74,59 Gb Free Space | 74,60% Space Free | Partition Type: NTFS

Drive U: | 99,99 Gb Total Space | 74,59 Gb Free Space | 74,60% Space Free | Partition Type: NTFS

Drive V: | 99,99 Gb Total Space | 74,59 Gb Free Space | 74,60% Space Free | Partition Type: NTFS

 

Computer Name: ORGA1 | User Name: Anmeldung | NOT logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.10.14 07:37:40 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Anmeldung\Eigene Dateien\Downloads\OTL.exe

PRC - [2010.11.02 14:54:05 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2007.09.06 12:01:16 | 000,761,096 | ---- | M] () -- C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe

PRC - [2007.06.26 20:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007.04.04 13:55:56 | 005,543,424 | ---- | M] () -- C:\Programme\Digitus\MFP Server Control Center\Control Center.exe

PRC - [2006.12.04 15:32:14 | 000,222,856 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\Ghost\ngtray.exe

PRC - [2006.10.22 23:24:02 | 000,620,152 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

PRC - [2006.06.20 12:02:12 | 001,848,150 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe

PRC - [2006.06.20 12:01:38 | 000,126,976 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe

PRC - [2006.06.20 12:01:08 | 001,106,422 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe

PRC - [2006.04.21 17:03:34 | 000,094,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

PRC - [2004.08.05 15:19:10 | 000,118,784 | ---- | M] () -- C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2007.09.06 12:01:16 | 000,761,096 | ---- | M] () -- C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe

MOD - [2007.05.22 10:59:22 | 000,128,512 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2007.04.04 13:55:56 | 005,543,424 | ---- | M] () -- C:\Programme\Digitus\MFP Server Control Center\Control Center.exe

MOD - [2006.06.20 12:01:02 | 000,045,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Acronis\Common\rpc_client.dll

MOD - [2004.08.05 15:19:10 | 000,118,784 | ---- | M] () -- C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

 
 ========== Driver Services (SafeList) ==========

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 192.168.2.251;<local>

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.2.110:8100

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..network.proxy.type: 0

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.10.11 07:42:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.10.11 07:42:37 | 000,000,000 | ---D | M]

 

[2010.03.16 09:17:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Mozilla\Extensions

[2010.03.16 09:17:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Mozilla\Firefox\Profiles\1nc1d3r.default\extensions

[2011.10.11 07:42:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2009.06.10 14:00:52 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2011.09.29 09:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.09.29 03:24:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.29 03:16:42 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.09.29 03:24:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.29 03:24:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.29 03:24:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.29 03:24:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)

O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe (Acronis)

O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Control Center] C:\Programme\Digitus\MFP Server Control Center\Control Center.exe ()

O4 - HKLM..\Run: [EEventManager] C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe ()

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [NGTray] C:\Programme\Symantec\Ghost\ngtray.exe (Symantec Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe (Acronis)

O4 - HKLM..\Run: [Update-Tool] C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe ()

O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O4 - HKCU..\Run: [egagv.exe] C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Buteri\egagv.exe ()

O4 - HKCU..\Run: [OpenCTI] C:\Programme\DeTeWe\OpenCTI.exe (DeTeWe)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = awt.home

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B7F5306-BC2A-45FB-873A-C7BAAC963708}: NameServer = 192.168.2.250,192.168.2.252

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (sockspy.dll) - File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Anmeldung\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Anmeldung\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O30 - LSA: Authentication Packages - (relog_ap) -C:\WINDOWS\System32\relog_ap.dll (Acronis)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.06.22 18:14:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{785c836e-8288-11df-8107-001bfc2891ad}\Shell - "" = AutoRun

O33 - MountPoints2\{785c836e-8288-11df-8107-001bfc2891ad}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{785c836e-8288-11df-8107-001bfc2891ad}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen

ActiveX: {65A3DE05-06B1-27C4-0EF6-96B40D01A6DA} - Microsoft Windows Media Player 6.4

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung

ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

 

%SYSTEMROOT%\SYSTEM32\*.DLL /LOCKEDFILES CREATERESTOREPOINT

Error creating restore point.

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.10.11 14:30:41 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2011.10.11 14:29:57 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\esetsmartinstaller_enu.exe

[2011.10.10 07:58:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Malwarebytes

[2011.10.10 07:55:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware

[2011.10.10 07:55:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2011.10.10 07:55:28 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011.10.10 07:55:27 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.09.28 08:48:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Ewylx

[2011.09.28 08:48:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Buteri

[2011.09.16 10:21:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\AI_Vektorgrafiken_USB Sticks

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.10.14 07:44:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.10.13 10:09:03 | 000,131,121 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Ust.-Befreiung II.jpg

[2011.10.13 09:59:16 | 000,109,151 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Ust.-Befreiung I.jpg

[2011.10.13 07:40:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.10.11 14:29:59 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\esetsmartinstaller_enu.exe

[2011.10.11 12:43:44 | 000,126,486 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\E-Proof_Freigabe.jpg

[2011.10.11 07:42:43 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[2011.10.11 07:41:35 | 000,002,321 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk

[2011.09.30 11:49:36 | 000,039,708 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Foto.jpg

[2011.09.23 10:50:32 | 000,133,787 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Maßnahmeübersicht Sep 2011.pdf

[2011.09.22 07:44:19 | 003,300,037 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Messe.jpg

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.10.13 10:09:02 | 000,131,121 | ---- | C] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Ust.-Befreiung II.jpg

[2011.10.13 09:59:16 | 000,109,151 | ---- | C] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Ust.-Befreiung I.jpg

[2011.10.11 12:43:44 | 000,126,486 | ---- | C] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\E-Proof_Freigabe.jpg

[2011.10.11 07:52:31 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\Anmeldung\Startmenü\Programme\Mozilla Firefox.lnk

[2011.10.11 07:42:43 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk

[2011.10.11 07:42:43 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[2011.09.30 11:28:58 | 000,039,708 | ---- | C] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Foto.jpg

[2011.09.22 07:36:30 | 003,300,037 | ---- | C] () -- C:\Dokumente und Einstellungen\Anmeldung\Desktop\Messe.jpg

[2010.06.28 09:41:27 | 000,004,608 | ---- | C] () -- C:\Dokumente und Einstellungen\Anmeldung\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2009.04.20 10:28:43 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll

[2008.07.02 14:13:54 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2008.06.17 16:55:24 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.03.11 12:18:41 | 000,000,178 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini

[2008.03.11 12:11:51 | 000,000,519 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2008.02.06 16:26:01 | 000,002,280 | ---- | C] () -- C:\WINDOWS\AVUV.INI

[2007.10.28 21:15:44 | 000,000,386 | ---- | C] () -- C:\WINDOWS\Tiger5.INI

[2007.10.25 09:40:15 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI

[2007.10.25 09:36:42 | 000,030,605 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat

[2007.10.25 09:36:42 | 000,027,030 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat

[2007.10.25 09:36:42 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2007.10.22 15:29:13 | 000,000,024 | ---- | C] () -- C:\WINDOWS\4EVER.INI

[2007.10.12 13:07:33 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2007.10.12 13:07:33 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe

[2007.10.02 16:47:30 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2007.10.02 16:43:33 | 000,066,484 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\firstlsp.reg.dat

[2007.06.22 18:55:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2007.06.22 18:54:17 | 001,563,784 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2007.06.22 18:32:13 | 000,017,279 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2007.06.22 18:32:04 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2007.06.22 18:29:35 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007.06.22 18:16:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2007.06.22 18:11:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2007.03.22 04:50:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2007.03.22 04:50:00 | 001,622,016 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2007.03.22 04:50:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2007.03.22 04:50:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2007.03.22 04:50:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2007.03.22 04:50:00 | 000,928,096 | ---- | C] () -- C:\WINDOWS\System32\nvucode.bin

[2007.03.22 04:50:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2007.03.22 04:50:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2007.03.22 04:50:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe

[2007.03.22 04:50:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2004.08.04 01:12:38 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.08.23 14:00:00 | 000,320,094 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2001.08.23 14:00:00 | 000,314,508 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.08.23 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.08.23 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2001.08.23 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001.08.23 14:00:00 | 000,049,174 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2001.08.23 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.08.23 14:00:00 | 000,040,836 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.08.23 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2001.08.23 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001.08.23 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

 
 ========== LOP Check ==========

 

[2007.06.22 19:28:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis

[2009.02.09 14:32:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Imation

[2011.03.02 13:47:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Amazon

[2011.09.28 08:48:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Buteri

[2010.09.09 12:46:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\EPSON

[2011.10.10 15:03:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Ewylx

[2010.04.08 14:25:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\gtk-2.0

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. >

 
 < %APPDATA%\*.exe /s >

[2011.03.07 20:24:28 | 000,164,352 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Buteri\egagv.exe

[2011.07.22 14:47:19 | 003,085,984 | ---- | M] (Adobe Systems, Inc.) -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\U3\temp\cleanup.exe

[2008.05.02 10:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Anmeldung\Anwendungsdaten\U3\temp\Launchpad Removal.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys

[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll

[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\system32\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll

[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe

[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2001.08.23 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav >

 
 < %systemroot%\*. /mp /s >
 

< End of report >

--- --- ---

Zitat:

NOT logged in as Administrator.

Du solltest OTL als Administrator ausführen!

OTL Logfile:

Code:

OTL logfile created on: 17.10.2011 07:58:55 - Run 1

OTL by OldTimer - Version 3.2.29.1     Folder = C:\Dokumente und Einstellungen\Anmeldung\Eigene Dateien\Downloads

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,56 Gb Available Physical Memory | 78,09% Memory free

3,85 Gb Paging File | 3,49 Gb Available in Paging File | 90,65% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,31 Gb Total Space | 70,24 Gb Free Space | 74,48% Space Free | Partition Type: NTFS

Drive D: | 92,00 Gb Total Space | 88,15 Gb Free Space | 95,81% Space Free | Partition Type: NTFS

 

Computer Name: ORGA1 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.10.14 07:37:40 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Anmeldung\Eigene Dateien\Downloads\OTL.exe

PRC - [2011.06.28 12:35:31 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe

PRC - [2011.06.28 12:35:31 | 000,340,136 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe

PRC - [2011.06.28 12:35:31 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.04.27 09:21:42 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2010.11.02 14:54:05 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.03.25 08:43:34 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.04.20 10:17:02 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

PRC - [2007.09.06 12:01:16 | 000,761,096 | ---- | M] () -- C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe

PRC - [2007.06.26 20:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007.04.04 13:55:56 | 005,543,424 | ---- | M] () -- C:\Programme\Digitus\MFP Server Control Center\Control Center.exe

PRC - [2006.12.04 15:32:14 | 000,222,856 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\Ghost\ngtray.exe

PRC - [2006.12.04 15:32:10 | 000,632,456 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\Ghost\ngctw32.exe

PRC - [2006.10.23 01:40:14 | 000,046,200 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe

PRC - [2006.10.22 23:24:02 | 000,620,152 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

PRC - [2006.07.13 16:59:48 | 000,131,131 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

PRC - [2006.07.13 16:59:32 | 000,065,599 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

PRC - [2006.06.20 12:02:12 | 001,848,150 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe

PRC - [2006.06.20 12:01:38 | 000,126,976 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe

PRC - [2006.06.20 12:01:36 | 000,204,800 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

PRC - [2006.06.20 12:01:08 | 001,106,422 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe

PRC - [2006.04.21 17:03:34 | 000,094,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

PRC - [2006.04.03 18:04:02 | 000,020,543 | ---- | M] (Apache Software Foundation) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe

PRC - [2004.08.05 15:19:10 | 000,118,784 | ---- | M] () -- C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe

PRC - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2010.03.25 08:43:37 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2006.10.23 00:21:28 | 000,917,504 | ---- | M] () -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdistRes.DEU

MOD - [2006.04.03 18:04:02 | 000,876,544 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libeay32.dll

MOD - [2006.04.03 18:04:02 | 000,159,744 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\ssleay32.dll

MOD - [2006.04.03 18:04:02 | 000,024,691 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so

MOD - [2005.01.06 18:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.06.28 12:35:31 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2011.06.28 12:35:31 | 000,340,136 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2011.06.28 12:35:31 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.04.27 09:21:42 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.04.20 10:17:02 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2007.03.20 16:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)

SRV - [2006.12.04 15:32:10 | 000,632,456 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Symantec\Ghost\ngctw32.exe -- (NGCLIENT)

SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2006.07.13 16:59:48 | 000,131,131 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp)

SRV - [2006.07.13 16:59:32 | 000,065,599 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog)

SRV - [2006.06.20 12:01:36 | 000,204,800 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)

SRV - [2006.04.03 18:04:02 | 000,020,543 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface)

SRV - [2004.10.22 03:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.06.28 12:35:31 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.06.28 12:35:31 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.06.09 09:47:04 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.05.26 11:03:54 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2009.02.09 14:32:33 | 000,062,528 | ---- | M] (Imation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\IPFD1286.sys -- (IPGXII)

DRV - [2007.06.22 19:07:08 | 000,388,000 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)

DRV - [2007.06.22 19:07:08 | 000,032,288 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)

DRV - [2007.06.22 19:07:06 | 000,099,776 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman)

DRV - [2007.03.13 18:15:30 | 000,052,352 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KUSBusByTCPMasterBus.sys -- (KUSBusByTCPMasterBus)

DRV - [2007.03.13 18:15:22 | 000,077,312 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\KUSBusByTCP.sys -- (KUSBusByTCP)

DRV - [2006.07.12 15:38:30 | 000,020,480 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)

DRV - [2006.07.12 15:38:28 | 000,057,856 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)

DRV - [2006.07.01 23:30:28 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)

DRV - [2005.10.11 18:07:38 | 000,393,088 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)

DRV - [2004.10.27 15:21:30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.10.11 07:42:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.10.11 07:42:37 | 000,000,000 | ---D | M]

 

[2011.10.11 07:42:41 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.09.29 09:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.09.29 03:24:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.29 03:16:42 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.09.29 03:24:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.29 03:24:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.29 03:24:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.29 03:24:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)

O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe (Acronis)

O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Control Center] C:\Programme\Digitus\MFP Server Control Center\Control Center.exe ()

O4 - HKLM..\Run: [EEventManager] C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe ()

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [NGTray] C:\Programme\Symantec\Ghost\ngtray.exe (Symantec Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe (Acronis)

O4 - HKLM..\Run: [Update-Tool] C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = awt.home

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B7F5306-BC2A-45FB-873A-C7BAAC963708}: NameServer = 192.168.2.250,192.168.2.252

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (sockspy.dll) - File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O30 - LSA: Authentication Packages - (relog_ap) -C:\WINDOWS\System32\relog_ap.dll (Acronis)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.06.22 18:14:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.10.13 07:58:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.V23\Anwendungsdaten\Malwarebytes

[2011.10.11 14:30:41 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2011.10.10 07:55:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware

[2011.10.10 07:55:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2011.10.10 07:55:28 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011.10.10 07:55:27 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.10.17 07:54:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.10.17 07:35:57 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.10.11 07:42:43 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[2011.10.11 07:41:35 | 000,002,321 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.10.11 07:42:43 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk

[2011.10.11 07:42:43 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[2009.04.20 10:28:43 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll

[2008.07.02 14:13:54 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2008.06.17 16:55:24 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.03.11 12:18:41 | 000,000,178 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini

[2008.03.11 12:11:51 | 000,000,519 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2008.02.06 16:26:01 | 000,002,280 | ---- | C] () -- C:\WINDOWS\AVUV.INI

[2007.10.28 21:15:44 | 000,000,386 | ---- | C] () -- C:\WINDOWS\Tiger5.INI

[2007.10.25 09:40:15 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI

[2007.10.25 09:36:42 | 000,030,605 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat

[2007.10.25 09:36:42 | 000,027,030 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat

[2007.10.25 09:36:42 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2007.10.22 15:29:13 | 000,000,024 | ---- | C] () -- C:\WINDOWS\4EVER.INI

[2007.10.12 13:07:33 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2007.10.12 13:07:33 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe

[2007.10.02 16:47:30 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2007.10.02 16:43:33 | 000,066,484 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\firstlsp.reg.dat

[2007.06.22 18:55:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2007.06.22 18:54:17 | 001,563,784 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2007.06.22 18:32:13 | 000,017,279 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2007.06.22 18:32:04 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2007.06.22 18:29:35 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007.06.22 18:16:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2007.06.22 18:11:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2007.03.22 04:50:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2007.03.22 04:50:00 | 001,622,016 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2007.03.22 04:50:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2007.03.22 04:50:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2007.03.22 04:50:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2007.03.22 04:50:00 | 000,928,096 | ---- | C] () -- C:\WINDOWS\System32\nvucode.bin

[2007.03.22 04:50:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2007.03.22 04:50:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2007.03.22 04:50:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe

[2007.03.22 04:50:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2004.08.04 01:12:38 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.08.23 14:00:00 | 000,320,094 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2001.08.23 14:00:00 | 000,314,508 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.08.23 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.08.23 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2001.08.23 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001.08.23 14:00:00 | 000,049,174 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2001.08.23 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.08.23 14:00:00 | 000,040,836 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.08.23 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2001.08.23 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001.08.23 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

 
 ========== LOP Check ==========

 

[2007.10.25 09:40:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.V23\Anwendungsdaten\EPSON

[2007.06.22 19:28:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis

[2009.02.09 14:32:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Imation

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

Diesmal war es KEIN Custom Scan!
Mach bitte mit Adminrechten den CustomScan!

ups, sorry.... jetzt aber:OTL Logfile:

Code:

OTL logfile created on: 18.10.2011 08:26:41 - Run 2

OTL by OldTimer - Version 3.2.29.1     Folder = C:\Dokumente und Einstellungen\Anmeldung\Eigene Dateien\Downloads

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,47 Gb Available Physical Memory | 73,38% Memory free

3,85 Gb Paging File | 3,39 Gb Available in Paging File | 88,08% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 94,31 Gb Total Space | 69,99 Gb Free Space | 74,21% Space Free | Partition Type: NTFS

Drive D: | 92,00 Gb Total Space | 88,15 Gb Free Space | 95,81% Space Free | Partition Type: NTFS

 

Computer Name: ORGA1 | User Name: Administrator | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.10.14 07:37:40 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Anmeldung\Eigene Dateien\Downloads\OTL.exe

PRC - [2011.09.29 09:09:51 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe

PRC - [2011.06.28 12:35:31 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe

PRC - [2011.06.28 12:35:31 | 000,340,136 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe

PRC - [2011.06.28 12:35:31 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.06.09 13:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

PRC - [2011.04.27 09:21:42 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2010.11.02 14:54:05 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.03.25 08:43:34 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.04.20 10:17:02 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

PRC - [2007.09.06 12:01:16 | 000,761,096 | ---- | M] () -- C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe

PRC - [2007.06.26 20:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe

PRC - [2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007.04.04 13:55:56 | 005,543,424 | ---- | M] () -- C:\Programme\Digitus\MFP Server Control Center\Control Center.exe

PRC - [2006.12.04 15:32:14 | 000,222,856 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\Ghost\ngtray.exe

PRC - [2006.12.04 15:32:10 | 000,632,456 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\Ghost\ngctw32.exe

PRC - [2006.10.23 01:40:14 | 000,046,200 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe

PRC - [2006.10.22 23:24:02 | 000,620,152 | ---- | M] (Adobe Systems Inc.) -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

PRC - [2006.07.13 16:59:48 | 000,131,131 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

PRC - [2006.07.13 16:59:32 | 000,065,599 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

PRC - [2006.06.20 12:02:12 | 001,848,150 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe

PRC - [2006.06.20 12:01:38 | 000,126,976 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe

PRC - [2006.06.20 12:01:36 | 000,204,800 | ---- | M] (Acronis) -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

PRC - [2006.06.20 12:01:08 | 001,106,422 | ---- | M] (Acronis) -- C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe

PRC - [2006.04.21 17:03:34 | 000,094,208 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

PRC - [2006.04.03 18:04:02 | 000,020,543 | ---- | M] (Apache Software Foundation) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe

PRC - [2004.08.05 15:19:10 | 000,118,784 | ---- | M] () -- C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe

PRC - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2010.03.25 08:43:37 | 000,355,688 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

MOD - [2006.10.23 00:21:28 | 000,917,504 | ---- | M] () -- C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdistRes.DEU

MOD - [2006.04.03 18:04:02 | 000,876,544 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\libeay32.dll

MOD - [2006.04.03 18:04:02 | 000,159,744 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\ssleay32.dll

MOD - [2006.04.03 18:04:02 | 000,024,691 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\modules\mod_auth.so

MOD - [2005.01.06 18:33:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\redmonnt.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.06.28 12:35:31 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)

SRV - [2011.06.28 12:35:31 | 000,340,136 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)

SRV - [2011.06.28 12:35:31 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.04.27 09:21:42 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2009.04.20 10:17:02 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2007.03.20 16:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)

SRV - [2006.12.04 15:32:10 | 000,632,456 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Symantec\Ghost\ngctw32.exe -- (NGCLIENT)

SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)

SRV - [2006.07.13 16:59:48 | 000,131,131 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp)

SRV - [2006.07.13 16:59:32 | 000,065,599 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog)

SRV - [2006.06.20 12:01:36 | 000,204,800 | ---- | M] (Acronis) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)

SRV - [2006.04.03 18:04:02 | 000,020,543 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe -- (ForcewareWebInterface)

SRV - [2004.10.22 03:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)

SRV - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.06.28 12:35:31 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.06.28 12:35:31 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009.06.09 09:47:04 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.05.26 11:03:54 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2009.02.09 14:32:33 | 000,062,528 | ---- | M] (Imation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\IPFD1286.sys -- (IPGXII)

DRV - [2007.06.22 19:07:08 | 000,388,000 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\timntr.sys -- (timounter)

DRV - [2007.06.22 19:07:08 | 000,032,288 | ---- | M] (Acronis) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tifsfilt.sys -- (tifsfilter)

DRV - [2007.06.22 19:07:06 | 000,099,776 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\snapman.sys -- (snapman)

DRV - [2007.03.13 18:15:30 | 000,052,352 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KUSBusByTCPMasterBus.sys -- (KUSBusByTCPMasterBus)

DRV - [2007.03.13 18:15:22 | 000,077,312 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\KUSBusByTCP.sys -- (KUSBusByTCP)

DRV - [2006.07.12 15:38:30 | 000,020,480 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)

DRV - [2006.07.12 15:38:28 | 000,057,856 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)

DRV - [2006.07.01 23:30:28 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)

DRV - [2005.10.11 18:07:38 | 000,393,088 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)

DRV - [2004.10.27 15:21:30 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.10.11 07:42:41 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.10.18 08:21:28 | 000,000,000 | ---D | M]

 

[2011.10.18 08:21:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.10.18 08:21:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}

[2011.09.29 09:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.10.18 08:21:16 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2011.09.29 03:24:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.09.29 03:16:42 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.09.29 03:24:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.09.29 03:24:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.09.29 03:24:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.09.29 03:24:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)

O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe (Acronis)

O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe (Acronis)

O4 - HKLM..\Run: [Adobe_ID0EYTHM] C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Control Center] C:\Programme\Digitus\MFP Server Control Center\Control Center.exe ()

O4 - HKLM..\Run: [EEventManager] C:\Programme\epson\Creativity Suite\Event Manager\EEventManager.exe ()

O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)

O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)

O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)

O4 - HKLM..\Run: [NGTray] C:\Programme\Symantec\Ghost\ngtray.exe (Symantec Corporation)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe (Acronis)

O4 - HKLM..\Run: [Update-Tool] C:\Programme\OPEN-XCHANGE\OXlook\UpdateTool.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = awt.home

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9B7F5306-BC2A-45FB-873A-C7BAAC963708}: NameServer = 192.168.2.250,192.168.2.252

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (sockspy.dll) - File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp

O30 - LSA: Authentication Packages - (relog_ap) -C:\WINDOWS\System32\relog_ap.dll (Acronis)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.06.22 18:14:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offlinebrowsingpaket

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer-Hilfe

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsererweiterungen

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - Zugang zu MSN Site

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe

ActiveX: {89AB834D-40DF-7242-F0FF-77E197CC82AA} - Microsoft Windows Media Player

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML-Datenbindung

ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - 

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer-Hauptschriftarten

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML-Hilfe

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.10.18 08:21:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun

[2011.10.18 08:21:47 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java

[2011.10.18 08:21:11 | 000,000,000 | ---D | C] -- C:\Programme\Java

[2011.10.13 07:58:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator.V23\Anwendungsdaten\Malwarebytes

[2011.10.11 14:30:41 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2011.10.10 07:55:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware

[2011.10.10 07:55:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

[2011.10.10 07:55:28 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2011.10.10 07:55:27 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.10.18 08:15:18 | 000,002,321 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat - Schnellstart.lnk

[2011.10.18 08:15:15 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.10.18 07:51:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.10.11 07:42:43 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.10.11 07:42:43 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk

[2011.10.11 07:42:43 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk

[2009.04.20 10:28:43 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll

[2008.07.02 14:13:54 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2008.06.17 16:55:24 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2008.03.11 12:18:41 | 000,000,178 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini

[2008.03.11 12:11:51 | 000,000,519 | ---- | C] () -- C:\WINDOWS\wincmd.ini

[2008.02.06 16:26:01 | 000,002,280 | ---- | C] () -- C:\WINDOWS\AVUV.INI

[2007.10.28 21:15:44 | 000,000,386 | ---- | C] () -- C:\WINDOWS\Tiger5.INI

[2007.10.25 09:40:15 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI

[2007.10.25 09:36:42 | 000,030,605 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat

[2007.10.25 09:36:42 | 000,027,030 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat

[2007.10.25 09:36:42 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini

[2007.10.22 15:29:13 | 000,000,024 | ---- | C] () -- C:\WINDOWS\4EVER.INI

[2007.10.12 13:07:33 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll

[2007.10.12 13:07:33 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe

[2007.10.02 16:47:30 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2007.10.02 16:43:33 | 000,066,484 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\firstlsp.reg.dat

[2007.06.22 18:55:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2007.06.22 18:54:17 | 001,563,784 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2007.06.22 18:32:13 | 000,017,279 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2007.06.22 18:32:04 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2007.06.22 18:29:35 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2007.06.22 18:16:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2007.06.22 18:11:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2007.03.22 04:50:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2007.03.22 04:50:00 | 001,622,016 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2007.03.22 04:50:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2007.03.22 04:50:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2007.03.22 04:50:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2007.03.22 04:50:00 | 000,928,096 | ---- | C] () -- C:\WINDOWS\System32\nvucode.bin

[2007.03.22 04:50:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2007.03.22 04:50:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2007.03.22 04:50:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe

[2007.03.22 04:50:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2004.08.04 01:12:38 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin

[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2001.08.23 14:00:00 | 000,320,094 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2001.08.23 14:00:00 | 000,314,508 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2001.08.23 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2001.08.23 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2001.08.23 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2001.08.23 14:00:00 | 000,049,174 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2001.08.23 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2001.08.23 14:00:00 | 000,040,836 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2001.08.23 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2001.08.23 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001.08.23 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

 
 ========== LOP Check ==========

 

[2007.10.25 09:40:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.V23\Anwendungsdaten\EPSON

[2007.06.22 19:28:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Acronis

[2009.02.09 14:32:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Imation

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 

Invalid Environment Variable: APPDATA

 

Invalid Environment Variable: APPDATA

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.04 01:10:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys

[2004.08.03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll

[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\dllcache\eventlog.dll

[2004.08.04 00:57:20 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\system32\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll

[2004.08.04 00:57:32 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtUninstallKB968389$\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$NtUninstallKB975467$\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\system32\dllcache\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\system32\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll

[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\dllcache\scecli.dll

[2004.08.04 00:57:34 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\system32\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\dllcache\user32.dll

[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\system32\user32.dll

[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004.08.04 00:57:38 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe

[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\dllcache\userinit.exe

[2004.08.04 00:58:18 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\system32\userinit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\dllcache\winlogon.exe

[2004.08.04 00:58:20 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\system32\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2001.08.23 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2001.08.23 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

 
 < %systemroot%\System32\config\*.sav >

[2007.06.22 19:53:32 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav

[2007.06.22 19:53:32 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav

[2007.06.22 19:53:32 | 000,434,176 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >

[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 

< End of report >

--- --- ---

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4 - HKLM..\Run: []  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007.06.22 18:14:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: administrator
->Temp folder emptied: 1669 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Administrator.AWT
->Temp folder emptied: 26284476 bytes
->Temporary Internet Files folder emptied: 150619542 bytes
->Java cache emptied: 13657184 bytes
->FireFox cache emptied: 11284588 bytes
->Flash cache emptied: 738 bytes

User: Administrator.V23
->Temp folder emptied: 5301688 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Anmeldung
->Temp folder emptied: 10986633 bytes
->Temporary Internet Files folder emptied: 534910326 bytes
->Java cache emptied: 8937602 bytes
->FireFox cache emptied: 37667447 bytes
->Flash cache emptied: 3181772 bytes

User: x
->Temp folder emptied: 735308 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 7000 bytes
->FireFox cache emptied: 6613978 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Dozent
->Temp folder emptied: 283355 bytes
->Temporary Internet Files folder emptied: 149387 bytes
->FireFox cache emptied: 51875801 bytes
->Flash cache emptied: 4637 bytes

User: x
->Temp folder emptied: 18906 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 51459778 bytes
->Flash cache emptied: 633 bytes

User: x
->Temp folder emptied: 542352834 bytes
->Temporary Internet Files folder emptied: 269359363 bytes
->Java cache emptied: 69758419 bytes
->FireFox cache emptied: 30290643 bytes
->Flash cache emptied: 2289345 bytes

User: x
->Temp folder emptied: 1030544352 bytes
->Temporary Internet Files folder emptied: 33916121 bytes

User: K5624~1~WAC

User: LocalService
->Temp folder emptied: 16384 bytes
->Temporary Internet Files folder emptied: 910708 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: x
->Temp folder emptied: 198133 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 12688182 bytes
->FireFox cache emptied: 5376625 bytes
->Flash cache emptied: 570 bytes

User: x
->Temp folder emptied: 19129 bytes
->Temporary Internet Files folder emptied: 218626 bytes
->FireFox cache emptied: 55723567 bytes
->Flash cache emptied: 434 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2225356 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 615007 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 2.833,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.29.1 log created on 10192011_101251

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\Anmeldung\Lokale Einstellungen\Temp\~DFD6EF.tmp not found!

Registry entries deleted on Reboot...

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

08:27:29.0989 3564 TDSS rootkit removing tool 2.6.11.0 Oct 19 2011 13:50:27
08:27:30.0145 3564 ============================================================
08:27:30.0145 3564 Current date / time: 2011/10/20 08:27:30.0145
08:27:30.0145 3564 SystemInfo:
08:27:30.0145 3564
08:27:30.0145 3564 OS Version: 5.1.2600 ServicePack: 2.0
08:27:30.0145 3564 Product type: Workstation
08:27:30.0145 3564 ComputerName: ORGA1
08:27:30.0145 3564 UserName: Administrator
08:27:30.0145 3564 Windows directory: C:\WINDOWS
08:27:30.0145 3564 System windows directory: C:\WINDOWS
08:27:30.0145 3564 Processor architecture: Intel x86
08:27:30.0145 3564 Number of processors: 2
08:27:30.0145 3564 Page size: 0x1000
08:27:30.0145 3564 Boot type: Normal boot
08:27:30.0145 3564 ============================================================
08:27:31.0099 3564 Initialize success
08:29:04.0599 1368 ============================================================
08:29:04.0599 1368 Scan started
08:29:04.0599 1368 Mode: Manual; SigCheck; TDLFS;
08:29:04.0599 1368 ============================================================
08:29:04.0942 1368 Abiosdsk - ok
08:29:04.0958 1368 abp480n5 - ok
08:29:04.0989 1368 ACPI (94b4741d2cf9ed38140b831293d1601a) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:29:05.0020 1368 ACPI ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0020 1368 ACPI - detected UnsignedFile.Multi.Generic (1)
08:29:05.0036 1368 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
08:29:05.0052 1368 ACPIEC ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0052 1368 ACPIEC - detected UnsignedFile.Multi.Generic (1)
08:29:05.0083 1368 ADIHdAudAddService (d392183cc5379e302e50ceba635248eb) C:\WINDOWS\system32\drivers\ADIHdAud.sys
08:29:05.0099 1368 ADIHdAudAddService ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0099 1368 ADIHdAudAddService - detected UnsignedFile.Multi.Generic (1)
08:29:05.0099 1368 adpu160m - ok
08:29:05.0114 1368 AEAudioService (9f59ae2de835641fbb0c6afd80d8fa9b) C:\WINDOWS\system32\drivers\AEAudio.sys
08:29:05.0130 1368 AEAudioService ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0130 1368 AEAudioService - detected UnsignedFile.Multi.Generic (1)
08:29:05.0145 1368 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
08:29:05.0161 1368 aec ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0161 1368 aec - detected UnsignedFile.Multi.Generic (1)
08:29:05.0177 1368 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
08:29:05.0192 1368 AFD ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0192 1368 AFD - detected UnsignedFile.Multi.Generic (1)
08:29:05.0192 1368 Aha154x - ok
08:29:05.0208 1368 aic78u2 - ok
08:29:05.0208 1368 aic78xx - ok
08:29:05.0224 1368 AliIde - ok
08:29:05.0239 1368 AmdK8 (58be3c2f1aa041ea56f7305a6463035c) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
08:29:05.0255 1368 AmdK8 ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0255 1368 AmdK8 - detected UnsignedFile.Multi.Generic (1)
08:29:05.0255 1368 amsint - ok
08:29:05.0270 1368 asc - ok
08:29:05.0286 1368 asc3350p - ok
08:29:05.0286 1368 asc3550 - ok
08:29:05.0317 1368 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:29:05.0333 1368 AsyncMac ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0333 1368 AsyncMac - detected UnsignedFile.Multi.Generic (1)
08:29:05.0333 1368 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:29:05.0349 1368 atapi ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0349 1368 atapi - detected UnsignedFile.Multi.Generic (1)
08:29:05.0349 1368 Atdisk - ok
08:29:05.0364 1368 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:29:05.0380 1368 Atmarpc ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0380 1368 Atmarpc - detected UnsignedFile.Multi.Generic (1)
08:29:05.0411 1368 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:29:05.0411 1368 audstub ( UnsignedFile.Multi.Generic ) - warning
08:29:05.0411 1368 audstub - detected UnsignedFile.Multi.Generic (1)
08:29:05.0505 1368 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
08:29:05.0536 1368 avgio - ok
08:29:05.0552 1368 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
08:29:06.0145 1368 avgntflt - ok
08:29:06.0177 1368 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
08:29:06.0192 1368 avipbb - ok
08:29:06.0208 1368 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:29:06.0224 1368 Beep ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0224 1368 Beep - detected UnsignedFile.Multi.Generic (1)
08:29:06.0255 1368 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:29:06.0255 1368 cbidf2k ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0255 1368 cbidf2k - detected UnsignedFile.Multi.Generic (1)
08:29:06.0270 1368 cd20xrnt - ok
08:29:06.0286 1368 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:29:06.0286 1368 Cdaudio ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0286 1368 Cdaudio - detected UnsignedFile.Multi.Generic (1)
08:29:06.0302 1368 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
08:29:06.0317 1368 Cdfs ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0317 1368 Cdfs - detected UnsignedFile.Multi.Generic (1)
08:29:06.0349 1368 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:29:06.0349 1368 Cdrom ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0349 1368 Cdrom - detected UnsignedFile.Multi.Generic (1)
08:29:06.0349 1368 Changer - ok
08:29:06.0364 1368 CmdIde - ok
08:29:06.0380 1368 Cpqarray - ok
08:29:06.0395 1368 dac2w2k - ok
08:29:06.0395 1368 dac960nt - ok
08:29:06.0427 1368 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
08:29:06.0427 1368 Disk ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0427 1368 Disk - detected UnsignedFile.Multi.Generic (1)
08:29:06.0489 1368 dmboot (5789b83ba87fc84c3568cf86cacef8ce) C:\WINDOWS\system32\drivers\dmboot.sys
08:29:06.0520 1368 dmboot ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0520 1368 dmboot - detected UnsignedFile.Multi.Generic (1)
08:29:06.0520 1368 dmio (084eb0a50a4f7b4705c8a57f234e5291) C:\WINDOWS\system32\drivers\dmio.sys
08:29:06.0536 1368 dmio ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0536 1368 dmio - detected UnsignedFile.Multi.Generic (1)
08:29:06.0536 1368 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
08:29:06.0552 1368 dmload ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0552 1368 dmload - detected UnsignedFile.Multi.Generic (1)
08:29:06.0583 1368 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
08:29:06.0599 1368 DMusic ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0599 1368 DMusic - detected UnsignedFile.Multi.Generic (1)
08:29:06.0599 1368 dpti2o - ok
08:29:06.0630 1368 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
08:29:06.0630 1368 drmkaud ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0630 1368 drmkaud - detected UnsignedFile.Multi.Generic (1)
08:29:06.0645 1368 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
08:29:06.0661 1368 Fastfat ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0661 1368 Fastfat - detected UnsignedFile.Multi.Generic (1)
08:29:06.0661 1368 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
08:29:06.0677 1368 Fdc ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0677 1368 Fdc - detected UnsignedFile.Multi.Generic (1)
08:29:06.0692 1368 Fips (9e9af89f9b14aa6249065c309ce73bd8) C:\WINDOWS\system32\drivers\Fips.sys
08:29:06.0692 1368 Fips ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0692 1368 Fips - detected UnsignedFile.Multi.Generic (1)
08:29:06.0708 1368 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
08:29:06.0724 1368 Flpydisk ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0724 1368 Flpydisk - detected UnsignedFile.Multi.Generic (1)
08:29:06.0739 1368 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
08:29:06.0739 1368 FltMgr ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0739 1368 FltMgr - detected UnsignedFile.Multi.Generic (1)
08:29:06.0755 1368 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:29:06.0770 1368 Fs_Rec ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0770 1368 Fs_Rec - detected UnsignedFile.Multi.Generic (1)
08:29:06.0786 1368 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:29:06.0786 1368 Ftdisk ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0786 1368 Ftdisk - detected UnsignedFile.Multi.Generic (1)
08:29:06.0802 1368 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:29:06.0802 1368 Gpc ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0802 1368 Gpc - detected UnsignedFile.Multi.Generic (1)
08:29:06.0833 1368 HdAudAddService (f58d2900c66a1e773e3375098e0e9337) C:\WINDOWS\system32\drivers\HdAudio.sys
08:29:06.0833 1368 HdAudAddService ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0833 1368 HdAudAddService - detected UnsignedFile.Multi.Generic (1)
08:29:06.0864 1368 HDAudBus (cbc3def409549672b915fb9403d63f74) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
08:29:06.0864 1368 HDAudBus ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0864 1368 HDAudBus - detected UnsignedFile.Multi.Generic (1)
08:29:06.0895 1368 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:29:06.0895 1368 HidUsb ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0895 1368 HidUsb - detected UnsignedFile.Multi.Generic (1)
08:29:06.0895 1368 hpn - ok
08:29:06.0927 1368 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
08:29:06.0942 1368 HTTP ( UnsignedFile.Multi.Generic ) - warning
08:29:06.0942 1368 HTTP - detected UnsignedFile.Multi.Generic (1)
08:29:06.0958 1368 i2omgmt - ok
08:29:06.0958 1368 i2omp - ok
08:29:06.0989 1368 i8042prt (7c575018d0413440d75432a78b88c899) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:29:07.0005 1368 i8042prt ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0005 1368 i8042prt - detected UnsignedFile.Multi.Generic (1)
08:29:07.0005 1368 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
08:29:07.0020 1368 Imapi ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0020 1368 Imapi - detected UnsignedFile.Multi.Generic (1)
08:29:07.0036 1368 ini910u - ok
08:29:07.0036 1368 IntelIde - ok
08:29:07.0067 1368 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
08:29:07.0067 1368 Ip6Fw ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0067 1368 Ip6Fw - detected UnsignedFile.Multi.Generic (1)
08:29:07.0083 1368 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:29:07.0083 1368 IpFilterDriver ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0083 1368 IpFilterDriver - detected UnsignedFile.Multi.Generic (1)
08:29:07.0099 1368 IPGXII (6ecc034243c817c91b836590c90f5c23) C:\WINDOWS\system32\drivers\IPFD1286.sys
08:29:07.0114 1368 IPGXII - ok
08:29:07.0114 1368 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:29:07.0130 1368 IpInIp ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0130 1368 IpInIp - detected UnsignedFile.Multi.Generic (1)
08:29:07.0145 1368 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:29:07.0161 1368 IpNat ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0161 1368 IpNat - detected UnsignedFile.Multi.Generic (1)
08:29:07.0161 1368 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:29:07.0177 1368 IPSec ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0177 1368 IPSec - detected UnsignedFile.Multi.Generic (1)
08:29:07.0192 1368 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
08:29:07.0192 1368 IRENUM ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0192 1368 IRENUM - detected UnsignedFile.Multi.Generic (1)
08:29:07.0208 1368 isapnp (ce9b7afdf0a3d7dd8d1487262316b959) C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:29:07.0224 1368 isapnp ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0224 1368 isapnp - detected UnsignedFile.Multi.Generic (1)
08:29:07.0224 1368 Kbdclass (b128fc0a5cd83f669d5de4b58f77c7d6) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:29:07.0239 1368 Kbdclass ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0239 1368 Kbdclass - detected UnsignedFile.Multi.Generic (1)
08:29:07.0270 1368 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
08:29:07.0270 1368 kmixer ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0270 1368 kmixer - detected UnsignedFile.Multi.Generic (1)
08:29:07.0286 1368 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
08:29:07.0286 1368 KSecDD ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0286 1368 KSecDD - detected UnsignedFile.Multi.Generic (1)
08:29:07.0317 1368 KUSBusByTCP (9e05eb2d4092289b1232888c3e94f83f) C:\WINDOWS\system32\Drivers\KUSBusByTCP.sys
08:29:07.0333 1368 KUSBusByTCP ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0333 1368 KUSBusByTCP - detected UnsignedFile.Multi.Generic (1)
08:29:07.0349 1368 KUSBusByTCPMasterBus (22c06d411bf7d97eff599c2ff324ed56) C:\WINDOWS\system32\Drivers\KUSBusByTCPMasterBus.sys
08:29:07.0364 1368 KUSBusByTCPMasterBus ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0364 1368 KUSBusByTCPMasterBus - detected UnsignedFile.Multi.Generic (1)
08:29:07.0364 1368 lbrtfdc - ok
08:29:07.0395 1368 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
08:29:07.0411 1368 mnmdd ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0411 1368 mnmdd - detected UnsignedFile.Multi.Generic (1)
08:29:07.0427 1368 Modem (91a3da4b12f6f1d760463a7f7857f748) C:\WINDOWS\system32\drivers\Modem.sys
08:29:07.0427 1368 Modem ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0427 1368 Modem - detected UnsignedFile.Multi.Generic (1)
08:29:07.0442 1368 Mouclass (71e15ca47fd947552054afb28536268f) C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:29:07.0458 1368 Mouclass ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0458 1368 Mouclass - detected UnsignedFile.Multi.Generic (1)
08:29:07.0474 1368 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:29:07.0489 1368 mouhid ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0489 1368 mouhid - detected UnsignedFile.Multi.Generic (1)
08:29:07.0489 1368 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
08:29:07.0505 1368 MountMgr ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0505 1368 MountMgr - detected UnsignedFile.Multi.Generic (1)
08:29:07.0505 1368 mraid35x - ok
08:29:07.0520 1368 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:29:07.0536 1368 MRxDAV ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0536 1368 MRxDAV - detected UnsignedFile.Multi.Generic (1)
08:29:07.0583 1368 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:29:07.0599 1368 MRxSmb ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0599 1368 MRxSmb - detected UnsignedFile.Multi.Generic (1)
08:29:07.0614 1368 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
08:29:07.0614 1368 Msfs ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0614 1368 Msfs - detected UnsignedFile.Multi.Generic (1)
08:29:07.0630 1368 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:29:07.0630 1368 MSKSSRV ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0630 1368 MSKSSRV - detected UnsignedFile.Multi.Generic (1)
08:29:07.0645 1368 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:29:07.0645 1368 MSPCLOCK ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0645 1368 MSPCLOCK - detected UnsignedFile.Multi.Generic (1)
08:29:07.0661 1368 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
08:29:07.0661 1368 MSPQM ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0661 1368 MSPQM - detected UnsignedFile.Multi.Generic (1)
08:29:07.0677 1368 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:29:07.0677 1368 mssmbios ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0677 1368 mssmbios - detected UnsignedFile.Multi.Generic (1)
08:29:07.0708 1368 Mup (f66b6b1cddee6ca87cefc016eb7a0d8e) C:\WINDOWS\system32\drivers\Mup.sys
08:29:07.0724 1368 Mup ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0724 1368 Mup - detected UnsignedFile.Multi.Generic (1)
08:29:07.0724 1368 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
08:29:07.0739 1368 NDIS ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0739 1368 NDIS - detected UnsignedFile.Multi.Generic (1)
08:29:07.0739 1368 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:29:07.0755 1368 NdisTapi ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0755 1368 NdisTapi - detected UnsignedFile.Multi.Generic (1)
08:29:07.0786 1368 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:29:07.0786 1368 Ndisuio ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0786 1368 Ndisuio - detected UnsignedFile.Multi.Generic (1)
08:29:07.0786 1368 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:29:07.0802 1368 NdisWan ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0802 1368 NdisWan - detected UnsignedFile.Multi.Generic (1)
08:29:07.0817 1368 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
08:29:07.0817 1368 NDProxy ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0817 1368 NDProxy - detected UnsignedFile.Multi.Generic (1)
08:29:07.0833 1368 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
08:29:07.0833 1368 NetBIOS ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0833 1368 NetBIOS - detected UnsignedFile.Multi.Generic (1)
08:29:07.0849 1368 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
08:29:07.0864 1368 NetBT ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0864 1368 NetBT - detected UnsignedFile.Multi.Generic (1)
08:29:07.0880 1368 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
08:29:07.0880 1368 Npfs ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0880 1368 Npfs - detected UnsignedFile.Multi.Generic (1)
08:29:07.0927 1368 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
08:29:07.0958 1368 Ntfs ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0958 1368 Ntfs - detected UnsignedFile.Multi.Generic (1)
08:29:07.0974 1368 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
08:29:07.0974 1368 Null ( UnsignedFile.Multi.Generic ) - warning
08:29:07.0974 1368 Null - detected UnsignedFile.Multi.Generic (1)
08:29:08.0192 1368 nv (a42c6ba17a5776aace3bae0ffa2fa8d1) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
08:29:08.0583 1368 nv ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0583 1368 nv - detected UnsignedFile.Multi.Generic (1)
08:29:08.0645 1368 NVENETFD (4d6f0d3fb17c1ba64942f415c73adcdb) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
08:29:08.0645 1368 NVENETFD ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0645 1368 NVENETFD - detected UnsignedFile.Multi.Generic (1)
08:29:08.0677 1368 nvnetbus (921e63aa1e1a20302223d016acafb52b) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
08:29:08.0677 1368 nvnetbus ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0677 1368 nvnetbus - detected UnsignedFile.Multi.Generic (1)
08:29:08.0724 1368 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:29:08.0739 1368 NwlnkFlt ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0739 1368 NwlnkFlt - detected UnsignedFile.Multi.Generic (1)
08:29:08.0755 1368 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:29:08.0770 1368 NwlnkFwd ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0770 1368 NwlnkFwd - detected UnsignedFile.Multi.Generic (1)
08:29:08.0802 1368 Parport (b2f17a2edb5450e61973a037f63a595b) C:\WINDOWS\system32\DRIVERS\parport.sys
08:29:08.0817 1368 Parport ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0817 1368 Parport - detected UnsignedFile.Multi.Generic (1)
08:29:08.0833 1368 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
08:29:08.0849 1368 PartMgr ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0849 1368 PartMgr - detected UnsignedFile.Multi.Generic (1)
08:29:08.0864 1368 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
08:29:08.0864 1368 ParVdm ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0864 1368 ParVdm - detected UnsignedFile.Multi.Generic (1)
08:29:08.0880 1368 PCI (6fb463e5b243fbd6f3d3c83f914d94fb) C:\WINDOWS\system32\DRIVERS\pci.sys
08:29:08.0895 1368 PCI ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0895 1368 PCI - detected UnsignedFile.Multi.Generic (1)
08:29:08.0895 1368 PCIDump - ok
08:29:08.0911 1368 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
08:29:08.0911 1368 PCIIde ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0911 1368 PCIIde - detected UnsignedFile.Multi.Generic (1)
08:29:08.0942 1368 Pcmcia (e2363f4c1daff89abee5f593e13d8a05) C:\WINDOWS\system32\drivers\Pcmcia.sys
08:29:08.0958 1368 Pcmcia ( UnsignedFile.Multi.Generic ) - warning
08:29:08.0958 1368 Pcmcia - detected UnsignedFile.Multi.Generic (1)
08:29:08.0958 1368 PDCOMP - ok
08:29:08.0958 1368 PDFRAME - ok
08:29:08.0974 1368 PDRELI - ok
08:29:08.0974 1368 PDRFRAME - ok
08:29:08.0989 1368 perc2 - ok
08:29:08.0989 1368 perc2hib - ok
08:29:09.0036 1368 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:29:09.0036 1368 PptpMiniport ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0036 1368 PptpMiniport - detected UnsignedFile.Multi.Generic (1)
08:29:09.0067 1368 Processor (3d7f196e77f986c106e9320b81a5ebbf) C:\WINDOWS\system32\DRIVERS\processr.sys
08:29:09.0067 1368 Processor ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0067 1368 Processor - detected UnsignedFile.Multi.Generic (1)
08:29:09.0083 1368 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
08:29:09.0099 1368 PSched ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0099 1368 PSched - detected UnsignedFile.Multi.Generic (1)
08:29:09.0099 1368 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:29:09.0099 1368 Ptilink ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0099 1368 Ptilink - detected UnsignedFile.Multi.Generic (1)
08:29:09.0114 1368 ql1080 - ok
08:29:09.0114 1368 Ql10wnt - ok
08:29:09.0130 1368 ql12160 - ok
08:29:09.0130 1368 ql1240 - ok
08:29:09.0145 1368 ql1280 - ok
08:29:09.0161 1368 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:29:09.0161 1368 RasAcd ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0161 1368 RasAcd - detected UnsignedFile.Multi.Generic (1)
08:29:09.0177 1368 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:29:09.0177 1368 Rasl2tp ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0177 1368 Rasl2tp - detected UnsignedFile.Multi.Generic (1)
08:29:09.0192 1368 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:29:09.0192 1368 RasPppoe ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0192 1368 RasPppoe - detected UnsignedFile.Multi.Generic (1)
08:29:09.0192 1368 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
08:29:09.0208 1368 Raspti ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0208 1368 Raspti - detected UnsignedFile.Multi.Generic (1)
08:29:09.0239 1368 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:29:09.0239 1368 Rdbss ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0239 1368 Rdbss - detected UnsignedFile.Multi.Generic (1)
08:29:09.0255 1368 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:29:09.0270 1368 RDPCDD ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0270 1368 RDPCDD - detected UnsignedFile.Multi.Generic (1)
08:29:09.0302 1368 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
08:29:09.0302 1368 rdpdr ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0302 1368 rdpdr - detected UnsignedFile.Multi.Generic (1)
08:29:09.0349 1368 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
08:29:09.0349 1368 RDPWD ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0349 1368 RDPWD - detected UnsignedFile.Multi.Generic (1)
08:29:09.0364 1368 redbook (aa56702e230860565cb8d43680f57f33) C:\WINDOWS\system32\DRIVERS\redbook.sys
08:29:09.0380 1368 redbook ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0380 1368 redbook - detected UnsignedFile.Multi.Generic (1)
08:29:09.0411 1368 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:29:09.0427 1368 Secdrv ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0427 1368 Secdrv - detected UnsignedFile.Multi.Generic (1)
08:29:09.0458 1368 SenFiltService (f22e6dd1d2cf71b77119eead1b3fc79d) C:\WINDOWS\system32\drivers\Senfilt.sys
08:29:09.0474 1368 SenFiltService ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0474 1368 SenFiltService - detected UnsignedFile.Multi.Generic (1)
08:29:09.0505 1368 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
08:29:09.0520 1368 serenum ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0520 1368 serenum - detected UnsignedFile.Multi.Generic (1)
08:29:09.0520 1368 Serial (cd5b9995afcdb466c9efc048d167e3be) C:\WINDOWS\system32\DRIVERS\serial.sys
08:29:09.0536 1368 Serial ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0536 1368 Serial - detected UnsignedFile.Multi.Generic (1)
08:29:09.0536 1368 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
08:29:09.0536 1368 Sfloppy ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0552 1368 Sfloppy - detected UnsignedFile.Multi.Generic (1)
08:29:09.0552 1368 Simbad - ok
08:29:09.0599 1368 snapman (5052dbafc8f4e4507e6ad0d467dd3529) C:\WINDOWS\system32\DRIVERS\snapman.sys
08:29:09.0599 1368 snapman ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0599 1368 snapman - detected UnsignedFile.Multi.Generic (1)
08:29:09.0599 1368 Sparrow - ok
08:29:09.0630 1368 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
08:29:09.0630 1368 splitter ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0630 1368 splitter - detected UnsignedFile.Multi.Generic (1)
08:29:09.0661 1368 sr (e4200cb2f418d8fc4acdd7e38c419d6a) C:\WINDOWS\system32\DRIVERS\sr.sys
08:29:09.0661 1368 sr ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0661 1368 sr - detected UnsignedFile.Multi.Generic (1)
08:29:09.0708 1368 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
08:29:09.0724 1368 Srv ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0724 1368 Srv - detected UnsignedFile.Multi.Generic (1)
08:29:09.0770 1368 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
08:29:09.0770 1368 ssmdrv - ok
08:29:09.0786 1368 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
08:29:09.0786 1368 swenum ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0786 1368 swenum - detected UnsignedFile.Multi.Generic (1)
08:29:09.0817 1368 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
08:29:09.0833 1368 swmidi ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0833 1368 swmidi - detected UnsignedFile.Multi.Generic (1)
08:29:09.0833 1368 symc810 - ok
08:29:09.0849 1368 symc8xx - ok
08:29:09.0849 1368 sym_hi - ok
08:29:09.0864 1368 sym_u3 - ok
08:29:09.0880 1368 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
08:29:09.0880 1368 sysaudio ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0880 1368 sysaudio - detected UnsignedFile.Multi.Generic (1)
08:29:09.0911 1368 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:29:09.0927 1368 Tcpip ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0927 1368 Tcpip - detected UnsignedFile.Multi.Generic (1)
08:29:09.0958 1368 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
08:29:09.0958 1368 TDPIPE ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0958 1368 TDPIPE - detected UnsignedFile.Multi.Generic (1)
08:29:09.0989 1368 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
08:29:09.0989 1368 TDTCP ( UnsignedFile.Multi.Generic ) - warning
08:29:09.0989 1368 TDTCP - detected UnsignedFile.Multi.Generic (1)
08:29:10.0020 1368 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
08:29:10.0020 1368 TermDD ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0020 1368 TermDD - detected UnsignedFile.Multi.Generic (1)
08:29:10.0052 1368 tifsfilter (fd03a8ff9d4573246bd8e6d5371969e4) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys
08:29:10.0052 1368 tifsfilter ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0052 1368 tifsfilter - detected UnsignedFile.Multi.Generic (1)
08:29:10.0083 1368 timounter (8061ee6fe61a27d6024da5e2d06a0418) C:\WINDOWS\system32\DRIVERS\timntr.sys
08:29:10.0099 1368 timounter ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0099 1368 timounter - detected UnsignedFile.Multi.Generic (1)
08:29:10.0099 1368 TosIde - ok
08:29:10.0130 1368 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
08:29:10.0145 1368 Udfs ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0145 1368 Udfs - detected UnsignedFile.Multi.Generic (1)
08:29:10.0145 1368 ultra - ok
08:29:10.0177 1368 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
08:29:10.0192 1368 Update ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0192 1368 Update - detected UnsignedFile.Multi.Generic (1)
08:29:10.0224 1368 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:29:10.0224 1368 usbccgp ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0224 1368 usbccgp - detected UnsignedFile.Multi.Generic (1)
08:29:10.0255 1368 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:29:10.0270 1368 usbehci ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0270 1368 usbehci - detected UnsignedFile.Multi.Generic (1)
08:29:10.0270 1368 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:29:10.0286 1368 usbhub ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0286 1368 usbhub - detected UnsignedFile.Multi.Generic (1)
08:29:10.0286 1368 usbohci (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS\system32\DRIVERS\usbohci.sys
08:29:10.0302 1368 usbohci ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0302 1368 usbohci - detected UnsignedFile.Multi.Generic (1)
08:29:10.0317 1368 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
08:29:10.0333 1368 usbscan ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0333 1368 usbscan - detected UnsignedFile.Multi.Generic (1)
08:29:10.0349 1368 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:29:10.0364 1368 USBSTOR ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0364 1368 USBSTOR - detected UnsignedFile.Multi.Generic (1)
08:29:10.0380 1368 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
08:29:10.0395 1368 VgaSave ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0395 1368 VgaSave - detected UnsignedFile.Multi.Generic (1)
08:29:10.0395 1368 ViaIde - ok
08:29:10.0411 1368 VolSnap (d6888520ff56d72a50437e371ca25fc9) C:\WINDOWS\system32\drivers\VolSnap.sys
08:29:10.0427 1368 VolSnap ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0427 1368 VolSnap - detected UnsignedFile.Multi.Generic (1)
08:29:10.0442 1368 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:29:10.0442 1368 Wanarp ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0442 1368 Wanarp - detected UnsignedFile.Multi.Generic (1)
08:29:10.0458 1368 WDICA - ok
08:29:10.0489 1368 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
08:29:10.0489 1368 wdmaud ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0489 1368 wdmaud - detected UnsignedFile.Multi.Generic (1)
08:29:10.0536 1368 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
08:29:10.0536 1368 WS2IFSL ( UnsignedFile.Multi.Generic ) - warning
08:29:10.0536 1368 WS2IFSL - detected UnsignedFile.Multi.Generic (1)
08:29:10.0552 1368 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
08:29:10.0770 1368 \Device\Harddisk0\DR0 - ok
08:29:10.0802 1368 Boot (0x1200) (ff5c5c15419c4d42bc1e98e4dc3a6d14) \Device\Harddisk0\DR0\Partition0
08:29:10.0802 1368 \Device\Harddisk0\DR0\Partition0 - ok
08:29:10.0817 1368 Boot (0x1200) (75ccabe1ab65d71566abf7b48d361ee2) \Device\Harddisk0\DR0\Partition1
08:29:10.0817 1368 \Device\Harddisk0\DR0\Partition1 - ok
08:29:10.0817 1368 ============================================================
08:29:10.0817 1368 Scan finished
08:29:10.0817 1368 ============================================================
08:29:10.0927 3676 Detected object count: 126
08:29:10.0927 3676 Actual detected object count: 126
08:29:28.0411 3676 ACPI ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0411 3676 ACPI ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0411 3676 ACPIEC ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0411 3676 ACPIEC ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0411 3676 ADIHdAudAddService ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0411 3676 ADIHdAudAddService ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0411 3676 AEAudioService ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0411 3676 AEAudioService ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0411 3676 aec ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0411 3676 aec ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 AFD ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 AFD ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 AmdK8 ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 AmdK8 ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 AsyncMac ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 AsyncMac ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 atapi ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 atapi ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 Atmarpc ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 Atmarpc ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 audstub ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 audstub ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 Beep ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 Beep ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 cbidf2k ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 cbidf2k ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0427 3676 Cdaudio ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0427 3676 Cdaudio ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 Cdfs ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 Cdfs ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 Cdrom ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 Cdrom ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 Disk ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 Disk ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 dmboot ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 dmboot ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 dmio ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 dmio ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 dmload ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 dmload ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 DMusic ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 DMusic ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0442 3676 drmkaud ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0442 3676 drmkaud ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 Fastfat ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 Fastfat ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 Fdc ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 Fdc ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 Fips ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 Fips ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 Flpydisk ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 Flpydisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 FltMgr ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 FltMgr ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 Fs_Rec ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 Fs_Rec ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 Ftdisk ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 Ftdisk ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 Gpc ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0458 3676 Gpc ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0458 3676 HdAudAddService ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 HdAudAddService ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 HDAudBus ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 HDAudBus ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 HidUsb ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 HidUsb ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 HTTP ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 HTTP ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 i8042prt ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 i8042prt ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 Imapi ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 Imapi ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 Ip6Fw ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 Ip6Fw ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 IpFilterDriver ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 IpFilterDriver ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0474 3676 IpInIp ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0474 3676 IpInIp ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 IpNat ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 IpNat ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 IPSec ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 IPSec ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 IRENUM ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 IRENUM ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 isapnp ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 isapnp ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 Kbdclass ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 Kbdclass ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 kmixer ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 kmixer ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 KSecDD ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 KSecDD ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0489 3676 KUSBusByTCP ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0489 3676 KUSBusByTCP ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 KUSBusByTCPMasterBus ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 KUSBusByTCPMasterBus ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 mnmdd ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 mnmdd ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 Modem ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 Modem ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 Mouclass ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 Mouclass ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 mouhid ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 mouhid ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 MountMgr ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 MountMgr ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 MRxDAV ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 MRxDAV ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 MRxSmb ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 MRxSmb ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0505 3676 Msfs ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0505 3676 Msfs ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 MSKSSRV ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 MSKSSRV ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 MSPCLOCK ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 MSPCLOCK ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 MSPQM ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 MSPQM ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 mssmbios ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 mssmbios ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 Mup ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 Mup ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 NDIS ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 NDIS ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 NdisTapi ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 NdisTapi ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0520 3676 Ndisuio ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0520 3676 Ndisuio ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 NdisWan ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 NdisWan ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 NDProxy ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 NDProxy ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 NetBIOS ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 NetBIOS ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 NetBT ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 NetBT ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 Npfs ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 Npfs ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 Ntfs ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 Ntfs ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 Null ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 Null ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 nv ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 nv ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0536 3676 NVENETFD ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0536 3676 NVENETFD ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 nvnetbus ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 nvnetbus ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 NwlnkFlt ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 NwlnkFlt ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 NwlnkFwd ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 NwlnkFwd ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 Parport ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 Parport ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 PartMgr ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 PartMgr ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 ParVdm ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 ParVdm ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 PCI ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 PCI ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0552 3676 PCIIde ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0552 3676 PCIIde ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 Pcmcia ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 Pcmcia ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 PptpMiniport ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 PptpMiniport ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 Processor ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 Processor ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 PSched ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 PSched ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 Ptilink ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 Ptilink ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 RasAcd ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 RasAcd ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 Rasl2tp ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 Rasl2tp ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 RasPppoe ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 RasPppoe ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0567 3676 Raspti ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0567 3676 Raspti ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 Rdbss ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 Rdbss ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 RDPCDD ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 RDPCDD ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 rdpdr ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 rdpdr ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 RDPWD ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 RDPWD ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 redbook ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 redbook ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 Secdrv ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 Secdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 SenFiltService ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 SenFiltService ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0583 3676 serenum ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0583 3676 serenum ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 Serial ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 Serial ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 Sfloppy ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 Sfloppy ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 snapman ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 snapman ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 splitter ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 splitter ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 sr ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 sr ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 Srv ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 Srv ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 swenum ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 swenum ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 swmidi ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 swmidi ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0599 3676 sysaudio ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0599 3676 sysaudio ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 Tcpip ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 Tcpip ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 TDPIPE ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 TDPIPE ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 TDTCP ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 TDTCP ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 TermDD ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 TermDD ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 tifsfilter ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 tifsfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 timounter ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 timounter ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 Udfs ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 Udfs ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0614 3676 Update ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0614 3676 Update ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 usbccgp ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 usbccgp ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 usbehci ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 usbehci ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 usbhub ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 usbhub ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 usbohci ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 usbohci ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 usbscan ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 usbscan ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 USBSTOR ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 USBSTOR ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 VgaSave ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 VgaSave ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 VolSnap ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0630 3676 VolSnap ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0630 3676 Wanarp ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0645 3676 Wanarp ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0645 3676 wdmaud ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0645 3676 wdmaud ( UnsignedFile.Multi.Generic ) - User select action: Skip
08:29:28.0645 3676 WS2IFSL ( UnsignedFile.Multi.Generic ) - skipped by user
08:29:28.0645 3676 WS2IFSL ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Combofix Logfile:

Code:

ComboFix 11-10-20.03 - Administrator 20.10.2011  14:19:59.1.2 - x86

Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.2047.1417 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Anmeldung\Eigene Dateien\Downloads\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {B02B524A-0C22-45DD-A6D1-70C7010CE58E}

FW: ActiveArmor Firewall *Disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\Administrator.AWT\WINDOWS

c:\dokumente und einstellungen\Anmeldung\Anwendungsdaten\Buteri

c:\dokumente und einstellungen\Anmeldung\Anwendungsdaten\Buteri\egagv.exe

c:\windows\pkunzip.pif

c:\windows\pkzip.pif

.

c:\windows\system32\Drivers\atapi.sys . . . ist infiziert!!

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-09-20 bis 2011-10-20  ))))))))))))))))))))))))))))))

.

.

2011-10-19 08:12 . 2011-10-19 08:12        --------        d-----w-        C:\_OTL

2011-10-18 10:59 . 2011-10-18 10:59        --------        d-----w-        c:\dokumente und einstellungen\Administrator.AWT\Anwendungsdaten\Avira

2011-10-18 06:21 . 2011-10-18 06:21        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java

2011-10-18 06:21 . 2011-10-18 06:21        73728        ----a-w-        c:\windows\system32\javacpl.cpl

2011-10-18 06:21 . 2011-10-18 06:21        476904        ----a-w-        c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll

2011-10-18 06:21 . 2011-10-18 06:21        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2011-10-18 06:21 . 2011-10-18 06:21        --------        d-----w-        c:\programme\Java

2011-10-13 05:58 . 2011-10-13 05:58        --------        d-----w-        c:\dokumente und einstellungen\Administrator.V23\Anwendungsdaten\Malwarebytes

2011-10-11 12:30 . 2011-10-11 12:30        --------        d-----w-        c:\programme\ESET

2011-10-11 05:42 . 2011-09-29 07:09        16856        ----a-w-        c:\programme\Mozilla Firefox\plugin-container.exe

2011-10-11 05:42 . 2011-09-29 07:09        134104        ----a-w-        c:\programme\Mozilla Firefox\components\browsercomps.dll

2011-10-11 05:42 . 2011-09-29 07:09        89048        ----a-w-        c:\programme\Mozilla Firefox\libEGL.dll

2011-10-11 05:42 . 2011-09-29 07:09        773080        ----a-w-        c:\programme\Mozilla Firefox\mozsqlite3.dll

2011-10-11 05:42 . 2011-09-29 07:09        719832        ----a-w-        c:\programme\Mozilla Firefox\mozcpp19.dll

2011-10-11 05:42 . 2011-09-29 07:09        478168        ----a-w-        c:\programme\Mozilla Firefox\libGLESv2.dll

2011-10-11 05:42 . 2011-09-29 07:09        1833944        ----a-w-        c:\programme\Mozilla Firefox\mozjs.dll

2011-10-11 05:42 . 2011-09-29 07:09        15832        ----a-w-        c:\programme\Mozilla Firefox\mozalloc.dll

2011-10-11 05:42 . 2011-09-29 00:26        2106216        ----a-w-        c:\programme\Mozilla Firefox\D3DCompiler_43.dll

2011-10-11 05:42 . 2011-09-29 00:26        1998168        ----a-w-        c:\programme\Mozilla Firefox\d3dx9_43.dll

2011-10-10 05:58 . 2011-10-10 05:58        --------        d-----w-        c:\dokumente und einstellungen\Anmeldung\Anwendungsdaten\Malwarebytes

2011-10-10 05:55 . 2011-10-10 05:55        --------        d-----w-        c:\dokumente und einstellungen\Administrator.AWT\Anwendungsdaten\Malwarebytes

2011-10-10 05:55 . 2011-10-10 05:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-10-10 05:55 . 2011-08-31 15:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-10-10 05:55 . 2011-10-10 05:55        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-09-28 06:48 . 2011-10-19 12:48        --------        d-----w-        c:\dokumente und einstellungen\Anmeldung\Anwendungsdaten\Ewylx

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-29 07:09 . 2011-10-11 05:42        134104        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys

[-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys

.

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\asyncmac.sys

[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys

[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys

.

[-] 2001-08-23 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

[-] 2001-08-23 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

.

[-] 2008-04-14 . 1704D8C4C8807B889E43C649B478A452 . 25216 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\kbdclass.sys

[-] 2004-08-03 . B128FC0A5CD83F669D5DE4B58F77C7D6 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

.

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ndis.sys

[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys

[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

.

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntfs.sys

[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys

[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\system32\dllcache\ntfs.sys

[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\system32\drivers\ntfs.sys

[-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys

.

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

.

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys

[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys

[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\tcpip.sys

[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748$\tcpip.sys

[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys

[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys

[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys

[-] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB917953$\tcpip.sys

.

[-] 2008-04-14 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\browser.dll

[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll

[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll

.

[-] 2008-04-14 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\lsass.exe

[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe

.

[-] 2008-04-14 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netman.dll

[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll

[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\dllcache\netman.dll

[-] 2005-08-22 . 19D9B6B139F09A72AE71758BDF28308E . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll

[-] 2004-08-03 . CDF4DA6B518105343FE9E8AFBBF8FBF4 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll

.

[-] 2008-04-14 02:22 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\comres.dll

[-] 2004-08-03 22:57 . 4B9D9E2708019763C5A72DA776DB1158 . 846848 . . [2001.12.4414.258] . . c:\windows\system32\comres.dll

[-] 2004-08-03 22:57 . 4B9D9E2708019763C5A72DA776DB1158 . 846848 . . [2001.12.4414.258] . . c:\windows\system32\dllcache\comres.dll

.

[-] 2008-04-14 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\qmgr.dll

[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll

[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll

.

[-] 2009-02-09 . D3D765E8455A961AE567B408F767D4F9 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll

[-] 2009-02-09 . 3127AFBF2C1ED0AB14A1BBB7AAECB85B . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll

[-] 2009-02-09 . 8AFBC2E1E5555A1C29953AF854F0FCA5 . 401408 . . [5.1.2600.3520] . . c:\windows\system32\rpcss.dll

[-] 2009-02-09 . 8AFBC2E1E5555A1C29953AF854F0FCA5 . 401408 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\rpcss.dll

[-] 2008-04-14 . E970C2296916BF4A2F958680016FE312 . 399360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\rpcss.dll

[-] 2005-07-26 . 891E3E4537C6DFCAE475073FC49CE9CB . 397824 . . [5.1.2600.2726] . . c:\windows\$NtUninstallKB956572$\rpcss.dll

[-] 2005-07-26 . DBA9F9C00A7A2B45EB8E451C2B6D10E9 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll

[-] 2005-04-28 . 434A27912D53BF3FB6C1CE37BAFA5CF6 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll

[-] 2005-04-28 . A9219270CA2E5DDB52828E7AB7268B82 . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll

[-] 2004-08-03 . 9F28FF58D6D67B123272869D89D14004 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll

.

[-] 2009-02-09 . A3EDBE9053889FB24AB22492472B39DC . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe

[-] 2009-02-09 . F0A7D59AF279326528715B206669B86C . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe

[-] 2009-02-09 . A07CA23EA361A01E627D911CF139B950 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\services.exe

[-] 2009-02-09 . A07CA23EA361A01E627D911CF139B950 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\services.exe

[-] 2008-04-14 . 4BB6A83640F1D1792AD21CE767B621C6 . 109056 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\services.exe

[-] 2004-08-03 . EDB6B81761BD60F32F740BBC40AFB676 . 108544 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572$\services.exe

.

[-] 2008-04-14 . 39356A9CDB6753A6D13A4072A9F5A4BB . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\spoolsv.exe

[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe

[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe

[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-03 . 54E7113A4BD696E430919BCAF5C65E06 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe

.

[-] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe

[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe

.

[-] 2008-04-14 . AD28671D1B83A386B070DC451A113C13 . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\comctl32.dll

[-] 2008-04-14 . 3C93CE6C6985C55952B7BE6673E9FD15 . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\asms\60\msft\windows\common\controls\comctl32.dll

[-] 2006-08-25 . EE82D1393169AC6BDF6016F4EA8D2B79 . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2006-08-25 . EE82D1393169AC6BDF6016F4EA8D2B79 . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2006-08-25 . F64451D07B9368B46AB31172D56D1804 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

[-] 2004-08-03 . 2CF914215226B3F7FA1AE4A47E4D261C . 611328 . . [5.82] . . c:\windows\$NtUninstallKB923191$\comctl32.dll

[-] 2004-08-03 . 9D0F57B9C65BF8A07DB655A9ED6EB2EE . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

[-] 2001-08-23 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

.

[-] 2008-04-14 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\cryptsvc.dll

[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll

[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll

.

[-] 2008-07-07 20:30 . D68ED3908C7A0DB446111D34AC40DC18 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\es.dll

[-] 2008-07-07 20:30 . D68ED3908C7A0DB446111D34AC40DC18 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\dllcache\es.dll

[-] 2008-07-07 20:26 . AF4F6B5739D18CA7972AB53E091CBC74 . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll

[-] 2008-07-07 20:23 . ADA7241C16F3F42C7F210539FAD5F3AA . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll

[-] 2008-07-07 20:16 . 3912BEF896D1D687B6053409E5F5F2A6 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll

[-] 2008-04-14 02:22 . 0F3EDAEE1EF97CF3DB2BE23A7289B78C . 246272 . . [2001.12.4414.701] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\es.dll

[-] 2005-07-26 04:39 . BEBC63622BDC30053A3145EBD90AF450 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974$\es.dll

[-] 2005-07-26 04:29 . 0D0F85237E32538F58278D673032676A . 243200 . . [2001.12.4414.308] . . c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll

[-] 2004-08-03 22:57 . 4E1A8645EE77CB9454FFE53C59620A25 . 243200 . . [2001.12.4414.258] . . c:\windows\$NtUninstallKB902400$\es.dll

.

[-] 2008-04-14 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\imm32.dll

[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll

[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll

.

[-] 2009-03-21 . A6F4977F9D2C9506050BFF0EF0B574B5 . 1059840 . . [5.1.2600.3541] . . c:\windows\system32\kernel32.dll

[-] 2009-03-21 . A6F4977F9D2C9506050BFF0EF0B574B5 . 1059840 . . [5.1.2600.3541] . . c:\windows\system32\dllcache\kernel32.dll

[-] 2009-03-21 . B055C64AABC1A3E3DE57EC8025CAD283 . 1063424 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll

[-] 2009-03-21 . 3EB703BFC2ED26A3D8ACB8626AB2C006 . 1065472 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll

[-] 2009-03-21 . B6053A5FA67EAC4A292A44F585881FFF . 1062912 . . [5.1.2600.3541] . . c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll

[-] 2008-04-14 . 4C897C69754D88F496339B1A666907C1 . 1063424 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\kernel32.dll

[-] 2007-04-16 . 5D0974BD58808FACA5D2C437B6FC8D85 . 1059840 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll

[-] 2007-04-16 . 8EEA8280A1E0E794EDFCCAD3721C7CAB . 1058304 . . [5.1.2600.3119] . . c:\windows\$NtUninstallKB959426$\kernel32.dll

[-] 2004-08-03 . E6CD85D0D37416CF138F01F4BB0FC872 . 1057280 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB935839$\kernel32.dll

.

[-] 2008-04-14 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\linkinfo.dll

[-] 2005-09-01 . F2AFE60F01040B23207D8EB7DC26EC96 . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll

[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll

[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\dllcache\linkinfo.dll

[-] 2004-08-03 . 3898FFF548E2968CB3AC5A71D7F4E425 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll

.

[-] 2008-04-14 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\lpk.dll

[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll

[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll

.

[-] 2010-04-16 . 164B4195439F7A0919A6CA7BDEC238AC . 3094016 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3GDR\mshtml.dll

[-] 2010-04-16 . 65E4FEB30D4307C1425F8635EE75200D . 3094528 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3QFE\mshtml.dll

[-] 2010-04-16 . F78A7680EC0A14F1D601364DD4635D7B . 3086336 . . [6.00.2900.3698] . . c:\windows\system32\mshtml.dll

[-] 2010-04-16 . F78A7680EC0A14F1D601364DD4635D7B . 3086336 . . [6.00.2900.3698] . . c:\windows\system32\dllcache\mshtml.dll

[-] 2010-04-16 . 61244206F4B9840DE7AD5BF8DE5B9A49 . 3094016 . . [6.00.2900.3698] . . c:\windows\$hf_mig$\KB982381\SP2QFE\mshtml.dll

[-] 2010-02-26 . DCDD4521EE1CD7E0D545317AAB10D1CE . 3094016 . . [6.00.2900.3676] . . c:\windows\$hf_mig$\KB980182\SP2QFE\mshtml.dll

[-] 2010-02-26 . 562E9B7A59BA0A4FCC54D6B39E7B6A1E . 3086336 . . [6.00.2900.3676] . . c:\windows\$NtUninstallKB982381$\mshtml.dll

[-] 2010-02-26 . E2CA735504A1D90EC8FAB02858A62996 . 3094016 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3GDR\mshtml.dll

[-] 2010-02-26 . A8662879AC1BC243664C7331B8F0E74D . 3094528 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3QFE\mshtml.dll

[-] 2009-12-22 . DD7FFD7FB25C268A46791E5A42CCF038 . 3084800 . . [6.00.2900.3660] . . c:\windows\$NtUninstallKB980182$\mshtml.dll

[-] 2009-12-22 . DEBDFEE5D25C43616E0A29092F17F38D . 3092480 . . [6.00.2900.3660] . . c:\windows\$hf_mig$\KB978207\SP2QFE\mshtml.dll

[-] 2009-12-22 . 25EDB39CE3473A734476100AB8DE6A15 . 3092480 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3GDR\mshtml.dll

[-] 2009-12-22 . 55EBD086581CA985DFB63736ED42629E . 3094528 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3QFE\mshtml.dll

[-] 2009-10-29 . D473C3526B86547643858E40FD096422 . 3091968 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3GDR\mshtml.dll

[-] 2009-10-29 . 2DE2C731DC298392D763BF62C0310D4A . 3084288 . . [6.00.2900.3640] . . c:\windows\$NtUninstallKB978207$\mshtml.dll

[-] 2009-10-29 . 0B59B93A2524462E02EB2084FEA2E9C1 . 3094016 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3QFE\mshtml.dll

[-] 2009-10-29 . A49E11FC06282A68232DE1AF1E9C9CD3 . 3091968 . . [6.00.2900.3640] . . c:\windows\$hf_mig$\KB976325\SP2QFE\mshtml.dll

[-] 2009-10-20 . 11E808A2F746C273BD609C5FA7AB1890 . 3084288 . . [6.00.2900.3636] . . c:\windows\$NtUninstallKB976325$\mshtml.dll

[-] 2009-10-19 . 84866A38371838B4F49D68DF167C3681 . 3091968 . . [6.00.2900.3636] . . c:\windows\$hf_mig$\KB976749\SP2QFE\mshtml.dll

[-] 2009-10-19 . 711368E3637EC8F2F04CCA1168324B8C . 3091968 . . [6.00.2900.5890] . . c:\windows\$hf_mig$\KB976749\SP3GDR\mshtml.dll

[-] 2009-10-19 . 4AB194D8CDD5167674FD7E2F1DC1CD00 . 3093504 . . [6.00.2900.5890] . . c:\windows\$hf_mig$\KB976749\SP3QFE\mshtml.dll

[-] 2009-09-25 . 95BD53D5AB4AA7BD8098CCBA7D01C5D1 . 3084288 . . [6.00.2900.3627] . . c:\windows\$NtUninstallKB976749$\mshtml.dll

[-] 2009-09-25 . C6F8947BB5076B0C7C8E8ECFCC394F84 . 3091968 . . [6.00.2900.3627] . . c:\windows\$hf_mig$\KB974455\SP2QFE\mshtml.dll

[-] 2009-09-25 . 848FD0FC3725E859C7512047BF447510 . 3091968 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3GDR\mshtml.dll

[-] 2009-09-25 . CB479559434C766DCC26D0489BA84EF1 . 3093504 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3QFE\mshtml.dll

[-] 2009-07-18 . B6D491B0E52DE9575F042E8398671974 . 3083264 . . [6.00.2900.3603] . . c:\windows\$NtUninstallKB974455$\mshtml.dll

[-] 2009-07-18 . 455DE0E849F09CC58CD4B614020B753F . 3090432 . . [6.00.2900.5848] . . c:\windows\$hf_mig$\KB972260\SP3GDR\mshtml.dll

[-] 2009-07-18 . DA5277A9BE2E684B2693E8CDC0FED8B6 . 3090432 . . [6.00.2900.3603] . . c:\windows\$hf_mig$\KB972260\SP2QFE\mshtml.dll

[-] 2009-07-18 . 26FD9945DF52F824888631CE09C77CB0 . 3090944 . . [6.00.2900.5848] . . c:\windows\$hf_mig$\KB972260\SP3QFE\mshtml.dll

[-] 2009-04-29 . 43F242F1804B5FDC7EA3B05FA98DEEE2 . 3081728 . . [6.00.2900.3562] . . c:\windows\$NtUninstallKB972260$\mshtml.dll

[-] 2009-04-29 . 2AAFE1C8A23843A40D3D5192CC93CC51 . 3089920 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3GDR\mshtml.dll

[-] 2009-04-29 . C651307F243807E92151FBDA2A1A0668 . 3089920 . . [6.00.2900.3562] . . c:\windows\$hf_mig$\KB969897\SP2QFE\mshtml.dll

[-] 2009-04-29 . 5D79A59F2AE282734E9A228B33314ACE . 3090432 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3QFE\mshtml.dll

[-] 2009-02-20 . 1F4F0A17815C0370644AACB3298B107D . 3088896 . . [6.00.2900.3527] . . c:\windows\$hf_mig$\KB963027\SP2QFE\mshtml.dll

[-] 2009-02-20 . E1B4638FF5F8D6BB002849FA0FBF36BC . 3080704 . . [6.00.2900.3527] . . c:\windows\$NtUninstallKB969897$\mshtml.dll

[-] 2009-02-20 . E4160ECABB1F61BFA54A9366B50C3CA8 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\mshtml.dll

[-] 2009-02-20 . 272906D8E5499462A4201C3596031EDF . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\mshtml.dll

[-] 2008-12-12 . 295752605EAAF3F4C6879996E97F66CA . 3081216 . . [6.00.2900.3492] . . c:\windows\$NtUninstallKB963027$\mshtml.dll

[-] 2008-12-12 . 785EF0996D7ED3F685C39FED77C50408 . 3088384 . . [6.00.2900.3492] . . c:\windows\$hf_mig$\KB960714\SP2QFE\mshtml.dll

[-] 2008-12-12 . D3BC95D72D732C2F05CB24E56EC5D7D3 . 3088896 . . [6.00.2900.5726] . . c:\windows\$hf_mig$\KB960714\SP3QFE\mshtml.dll

[-] 2008-12-12 . E8002EA2A6DB0FC061D7E6436C9AFF58 . 3088896 . . [6.00.2900.5726] . . c:\windows\$hf_mig$\KB960714\SP3GDR\mshtml.dll

[-] 2008-10-16 . 6FCD5A221AF953E47543FC084FADDF75 . 3080704 . . [6.00.2900.3462] . . c:\windows\$NtUninstallKB960714$\mshtml.dll

[-] 2008-10-16 . 8A93A35B05C15780BE61D16F1B673B2C . 3088384 . . [6.00.2900.3462] . . c:\windows\$hf_mig$\KB958215\SP2QFE\mshtml.dll

[-] 2008-10-16 . C25684D7A6272BE0ECF749BFD7EF83F9 . 3088896 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3QFE\mshtml.dll

[-] 2008-10-16 . 2F6089996C26EE36DE46A2CC90A9996C . 3088896 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3GDR\mshtml.dll

[-] 2008-08-20 . 8317F8BF680E5E7E963D0813169303E1 . 3081216 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB958215$\mshtml.dll

[-] 2008-08-20 . 921840757FDDD0DCF947EBBF5D8C6FE9 . 3088384 . . [6.00.2900.3429] . . c:\windows\$hf_mig$\KB956390\SP2QFE\mshtml.dll

[-] 2008-08-20 . 9F3A80616E64425D2E22DB8C689C98E8 . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\mshtml.dll

[-] 2008-08-20 . F10BD57696EF088685D8548AE2A23572 . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\mshtml.dll

[-] 2008-06-25 . F9F693A6E17EC05CDDA3949789710F5D . 3088896 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3QFE\mshtml.dll

[-] 2008-06-23 . 1C95CFF9357A5E39D57F340D0891EA53 . 3088384 . . [6.00.2900.3395] . . c:\windows\$hf_mig$\KB953838\SP2QFE\mshtml.dll

[-] 2008-06-23 . 019015EDB00FC65F909439E72902974A . 3080704 . . [6.00.2900.3395] . . c:\windows\$NtUninstallKB956390$\mshtml.dll

[-] 2008-06-23 . 8B13E2409FE52E03A9AF548E20505EDC . 3088384 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3GDR\mshtml.dll

[-] 2008-04-21 . FDB76AF64A6C7A16560B17501B50A82A . 3080704 . . [6.00.2900.3354] . . c:\windows\$NtUninstallKB953838$\mshtml.dll

[-] 2008-04-21 . 97F3A3011FEFD8EC231365767B6203D6 . 3087872 . . [6.00.2900.3354] . . c:\windows\$hf_mig$\KB950759\SP2QFE\mshtml.dll

[-] 2008-04-21 . 324308768813C0518F677DDD631A94A0 . 3087872 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3GDR\mshtml.dll

[-] 2008-04-21 . 031FF37B530D76C23BCC2E21B709DB7F . 3088384 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3QFE\mshtml.dll

[-] 2008-04-14 . 72AE55A9FFBC60650339CB12E35C7DD5 . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mshtml.dll

[-] 2008-02-16 . 016F10669B82482DE4AEF35617A63A3C . 3080704 . . [6.00.2900.3314] . . c:\windows\$NtUninstallKB950759$\mshtml.dll

[-] 2008-02-16 . DDAD436E163284C7115F5C5A429A9D6A . 3087872 . . [6.00.2900.3314] . . c:\windows\$hf_mig$\KB947864\SP2QFE\mshtml.dll

[-] 2007-12-07 . 3C961503B4078281DCFC65DC4658C08B . 3080192 . . [6.00.2900.3268] . . c:\windows\$NtUninstallKB947864$\mshtml.dll

[-] 2007-12-07 . 35161A288701DCCF7951D9BA647A9F52 . 3087360 . . [6.00.2900.3268] . . c:\windows\$hf_mig$\KB944533\SP2QFE\mshtml.dll

[-] 2007-10-30 . EF34B39C746FA81408A98639D60B3903 . 3079680 . . [6.00.2900.3243] . . c:\windows\$NtUninstallKB944533$\mshtml.dll

[-] 2007-10-30 . 7E44238B71A821276EEA8D704191D848 . 3086848 . . [6.00.2900.3243] . . c:\windows\$hf_mig$\KB942615\SP2QFE\mshtml.dll

[-] 2007-08-22 . 4AAFA54B172BDA3B4B7504AA03332A41 . 3079168 . . [6.00.2900.3199] . . c:\windows\$NtUninstallKB942615$\mshtml.dll

[-] 2007-08-22 . A9AC1654BE9D4081A824DC22CAF63092 . 3085824 . . [6.00.2900.3199] . . c:\windows\$hf_mig$\KB939653\SP2QFE\mshtml.dll

[-] 2004-08-03 . CAC51AD576713E5F0CE2251ED3A7FE82 . 3003392 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB939653$\mshtml.dll

[-] 2004-08-03 . CAC51AD576713E5F0CE2251ED3A7FE82 . 3003392 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2gdr\mshtml.dll

[-] 2004-08-03 . CAC51AD576713E5F0CE2251ED3A7FE82 . 3003392 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2qfe\mshtml.dll

.

[-] 2008-04-14 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\msvcrt.dll

[-] 2008-04-14 . C536AAD8A71608FE33CD956214EDD366 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\asms\70\msft\windows\mswincrt\msvcrt.dll

[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll

[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll

[-] 2004-08-03 . 365B3C43810E1CF41B3BE1E7180F583B . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll

[-] 2001-08-23 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll

.

[-] 2008-06-20 . ACD8BD448A74F344D46FCAF21BAB92AF . 247296 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll

[-] 2008-06-20 . 4AA50627B01C0E9C6B4C6BD3AF648F12 . 247296 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll

[-] 2008-06-20 . 774274C487493452DF3B0126DBE7FF3B . 247296 . . [5.1.2600.3394] . . c:\windows\system32\mswsock.dll

[-] 2008-06-20 . 774274C487493452DF3B0126DBE7FF3B . 247296 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2008-06-20 . EB55B1D9978B61E9913EDCD27EEC4C7C . 247296 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll

[-] 2008-04-14 . F12B9D9A069331877D006CC81B4735F9 . 247296 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mswsock.dll

[-] 2004-08-03 . B36E08F680BAE4DFC5C24D00A2DFC9E7 . 247296 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748$\mswsock.dll

.

[-] 2009-02-06 . ED4BBAD725A21632FB205452749FC8F5 . 408064 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB975467$\netlogon.dll

[-] 2009-02-06 . ED4BBAD725A21632FB205452749FC8F5 . 408064 . . [5.1.2600.3520] . . c:\windows\system32\netlogon.dll

[-] 2009-02-06 . ED4BBAD725A21632FB205452749FC8F5 . 408064 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\netlogon.dll

[-] 2008-04-14 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll

[-] 2004-08-03 . D27395EDCD3416AFD125A9370DCB585C . 407040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB968389$\netlogon.dll

.

[-] 2008-04-14 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\powrprof.dll

[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll

[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll

.

[-] 2008-04-14 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll

[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll

[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll

.

[-] 2008-04-14 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sfc.dll

[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll

[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll

.

[-] 2008-04-14 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\svchost.exe

[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe

.

[-] 2008-04-14 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\tapisrv.dll

[-] 2005-07-08 . F07061E18613F336A3120229097F7635 . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll

[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll

[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\dllcache\tapisrv.dll

[-] 2004-08-03 . 4584E2A5FE662AB3E7C32936E1449043 . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll

.

[-] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll

[-] 2007-03-08 . 78785EFF8CB90CEC1862A4CCFD9A3C3A . 579584 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll

[-] 2007-03-08 . 492E166CFD26A50FB9160DB536FF7D2B . 579072 . . [5.1.2600.3099] . . c:\windows\system32\user32.dll

[-] 2007-03-08 . 492E166CFD26A50FB9160DB536FF7D2B . 579072 . . [5.1.2600.3099] . . c:\windows\system32\dllcache\user32.dll

[-] 2005-03-02 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll

[-] 2005-03-02 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll

[-] 2004-08-03 . 56785FD5236D7B22CF471A6DA9DB46D8 . 578560 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

.

[-] 2008-04-14 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe

[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe

[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe

.

[-] 2010-04-16 . 0CC0A30F7F06C6A5A40911616CA35085 . 672768 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3GDR\wininet.dll

[-] 2010-04-16 . 68B82A22151D41988B3BCB7C881E2B0E . 674304 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3QFE\wininet.dll

[-] 2010-04-16 . C7B31EF1A7F52D99E92BFF1B053D6EB2 . 667648 . . [6.00.2900.3698] . . c:\windows\system32\wininet.dll

[-] 2010-04-16 . C7B31EF1A7F52D99E92BFF1B053D6EB2 . 667648 . . [6.00.2900.3698] . . c:\windows\system32\dllcache\wininet.dll

[-] 2010-04-16 . 4350AD71E6C5F397BB76DFF7C4BCFCBD . 674304 . . [6.00.2900.3698] . . c:\windows\$hf_mig$\KB982381\SP2QFE\wininet.dll

[-] 2010-02-26 . 54B62A6FBDF708F3A3C42382FA7BCCB7 . 667648 . . [6.00.2900.3676] . . c:\windows\$NtUninstallKB982381$\wininet.dll

[-] 2010-02-26 . DB3E27E2A3CD8128AE60C006165A3894 . 674304 . . [6.00.2900.3676] . . c:\windows\$hf_mig$\KB980182\SP2QFE\wininet.dll

[-] 2010-02-26 . 8A54A1EFAF25D51AF0AF6C16A3632F44 . 672768 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3GDR\wininet.dll

[-] 2010-02-26 . D9B4109E317F25D5342DB8EC39446A1C . 674304 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3QFE\wininet.dll

[-] 2009-12-22 . FB39AB08021941836E0F554570D73C79 . 667648 . . [6.00.2900.3660] . . c:\windows\$NtUninstallKB980182$\wininet.dll

[-] 2009-12-22 . C8F00B80E215CA7D803D1A932CE01C9E . 674304 . . [6.00.2900.3660] . . c:\windows\$hf_mig$\KB978207\SP2QFE\wininet.dll

[-] 2009-12-22 . 352E386B17F08786A7F0D9D9D909E1FA . 672768 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3GDR\wininet.dll

[-] 2009-12-22 . 7F7A6BC378B622FDFC90C5A5575A83D0 . 674304 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3QFE\wininet.dll

[-] 2009-10-29 . C64DCEA39BD8845BADB6CF9DB6E14D8B . 667648 . . [6.00.2900.3640] . . c:\windows\$NtUninstallKB978207$\wininet.dll

[-] 2009-10-29 . 547B7FF3C91C09E7EE82760DA4323706 . 672768 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3GDR\wininet.dll

[-] 2009-10-29 . 132C1D9C2DDCDFF55746D73508250362 . 674304 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3QFE\wininet.dll

[-] 2009-10-29 . 66F8DD3C5A2F6B5B839B96F9704B40BA . 674304 . . [6.00.2900.3640] . . c:\windows\$hf_mig$\KB976325\SP2QFE\wininet.dll

[-] 2009-09-25 . 85C9ABE5F08AF31EF47933B4926F17C6 . 667648 . . [6.00.2900.3627] . . c:\windows\$NtUninstallKB976325$\wininet.dll

[-] 2009-09-25 . 1B6142BB8574BD070105289B55D43168 . 674304 . . [6.00.2900.3627] . . c:\windows\$hf_mig$\KB974455\SP2QFE\wininet.dll

[-] 2009-09-25 . C9ACEFE3BE286B40A84D47498CF73CB8 . 672768 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3GDR\wininet.dll

[-] 2009-09-25 . 8DA0021A5283AFC13EF3932EDD5D1CDA . 674304 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3QFE\wininet.dll

[-] 2009-06-26 . 6988F148A06D085A49553F3E00E0D062 . 672256 . . [6.00.2900.5835] . . c:\windows\$hf_mig$\KB972260\SP3GDR\wininet.dll

[-] 2009-06-26 . F39EB4C85244526E442AC1C55297C918 . 673792 . . [6.00.2900.5835] . . c:\windows\$hf_mig$\KB972260\SP3QFE\wininet.dll

[-] 2009-06-26 . EC47B51F2A656CC1FB669836E04F9AA3 . 665088 . . [6.00.2900.3592] . . c:\windows\$NtUninstallKB974455$\wininet.dll

[-] 2009-06-26 . 5F14BC3417EDA201007F9BCDE10ABDEE . 673792 . . [6.00.2900.3592] . . c:\windows\$hf_mig$\KB972260\SP2QFE\wininet.dll

[-] 2009-04-29 . 8134E79429BBA1E37FAB26F5A84E1CF5 . 665088 . . [6.00.2900.3562] . . c:\windows\$NtUninstallKB972260$\wininet.dll

[-] 2009-04-29 . 7A9E3F9ED0B2772F352571D26D0A164E . 672256 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3GDR\wininet.dll

[-] 2009-04-29 . 1921E9AE3EEDF5966666E5C46DE9E3A1 . 673792 . . [6.00.2900.3562] . . c:\windows\$hf_mig$\KB969897\SP2QFE\wininet.dll

[-] 2009-04-29 . 4926F4F45F9400B8F535E5F5443A54BA . 673792 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3QFE\wininet.dll

[-] 2009-02-20 . D6C05CF7EA4617375C57941E867648C4 . 665088 . . [6.00.2900.3527] . . c:\windows\$NtUninstallKB969897$\wininet.dll

[-] 2009-02-20 . 2A35B8EAB65D43244F64DF891FBD3C21 . 673792 . . [6.00.2900.3527] . . c:\windows\$hf_mig$\KB963027\SP2QFE\wininet.dll

[-] 2009-02-20 . 34D8090A7B1AE7975FAE5259BF840849 . 671744 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\wininet.dll

[-] 2009-02-20 . DE271547E700E38226FB0DE0BA34D37A . 673280 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\wininet.dll

[-] 2008-10-16 . 8F865B36EA1C77A4F1F0E118560F5775 . 665088 . . [6.00.2900.3462] . . c:\windows\$NtUninstallKB963027$\wininet.dll

[-] 2008-10-16 . 3BDCD8E52A29A36F2A4D76789DF37FE1 . 673280 . . [6.00.2900.3462] . . c:\windows\$hf_mig$\KB958215\SP2QFE\wininet.dll

[-] 2008-10-16 . 7DBE34DA22CAB4BE922638540048379F . 672768 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3QFE\wininet.dll

[-] 2008-10-16 . 10A2C485838D5B95CCF7905E21E9A80A . 671744 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3GDR\wininet.dll

[-] 2008-08-20 . 53163D419C4780F65C114E746FAE1E49 . 665088 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB958215$\wininet.dll

[-] 2008-08-20 . 66AF60C255953898C67993CD665A2D22 . 673280 . . [6.00.2900.3429] . . c:\windows\$hf_mig$\KB956390\SP2QFE\wininet.dll

[-] 2008-08-20 . C5326257F4FEE83E24B06CD4BC08EBA2 . 671744 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\wininet.dll

[-] 2008-08-20 . 503D9BE987B9A3964816FED082F45771 . 672256 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll

[-] 2008-06-23 . 878F506D7F69E06BCCDC86C2A4D17633 . 672768 . . [6.00.2900.3395] . . c:\windows\$hf_mig$\KB953838\SP2QFE\wininet.dll

[-] 2008-06-23 . 1B540E19ADC30A53C8410DCBBAB1EF53 . 665088 . . [6.00.2900.3395] . . c:\windows\$NtUninstallKB956390$\wininet.dll

[-] 2008-06-23 . 978542595CF09A86E2EF60552A35C937 . 671744 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3GDR\wininet.dll

[-] 2008-06-23 . 6432638B5CE374D912C0C4F2A9F03DAE . 672256 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3QFE\wininet.dll

[-] 2008-04-21 . FBED32C104BD9410E2DA2D3AC1CE4008 . 665088 . . [6.00.2900.3354] . . c:\windows\$NtUninstallKB953838$\wininet.dll

[-] 2008-04-21 . 018ADED93507A4AEA4F55741863DBC9E . 672256 . . [6.00.2900.3354] . . c:\windows\$hf_mig$\KB950759\SP2QFE\wininet.dll

[-] 2008-04-21 . 11D26D87E041000EA4C0128CD0010F7A . 671744 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3GDR\wininet.dll

[-] 2008-04-21 . 645A4A4884EB5EB8453C01531FCBEC3A . 672256 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3QFE\wininet.dll

[-] 2008-04-14 . B4AEE98A48917B274FACFB78BBE0BC84 . 671744 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\wininet.dll

[-] 2008-02-16 . 6C49192217DF0509BC6A576535545529 . 671744 . . [6.00.2900.3314] . . c:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll

[-] 2008-02-16 . 34B6EE86F286B2595539E1617962256D . 665088 . . [6.00.2900.3314] . . c:\windows\$NtUninstallKB950759$\wininet.dll

[-] 2007-12-07 . 84E9262ED72810CFF255BEFD188D4038 . 665088 . . [6.00.2900.3268] . . c:\windows\$NtUninstallKB947864$\wininet.dll

[-] 2007-12-07 . 273F4B37B80C8D398713A88B788FE59B . 671744 . . [6.00.2900.3268] . . c:\windows\$hf_mig$\KB944533\SP2QFE\wininet.dll

[-] 2007-10-11 . DC532B5BD08E02DF13C9F166D0F4F73B . 665088 . . [6.00.2900.3231] . . c:\windows\$NtUninstallKB944533$\wininet.dll

[-] 2007-10-11 . 6BE2CDDC28610D9E73E54678A131B253 . 671744 . . [6.00.2900.3231] . . c:\windows\$hf_mig$\KB942615\SP2QFE\wininet.dll

[-] 2007-08-22 . 8D3CCA79F45918F6164B5BE5A3364B19 . 664576 . . [6.00.2900.3199] . . c:\windows\$NtUninstallKB942615$\wininet.dll

[-] 2007-08-22 . D6140D5095E62BD609DF3201C7B854AC . 671232 . . [6.00.2900.3199] . . c:\windows\$hf_mig$\KB939653\SP2QFE\wininet.dll

[-] 2004-08-03 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB939653$\wininet.dll

[-] 2004-08-03 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2gdr\wininet.dll

[-] 2004-08-03 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2qfe\wininet.dll

.

[-] 2008-04-14 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ws2_32.dll

[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll

[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll

.

[-] 2008-04-14 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ws2help.dll

[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll

[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2help.dll

.

[-] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\explorer.exe

[-] 2007-06-13 . 64D320C0E301EEDC5A4ADBBDC5024F7F . 1036288 . . [6.00.2900.3156] . . c:\windows\explorer.exe

[-] 2007-06-13 . 64D320C0E301EEDC5A4ADBBDC5024F7F . 1036288 . . [6.00.2900.3156] . . c:\windows\system32\dllcache\explorer.exe

[-] 2007-06-13 . 331ED93570BAF3CFE30340298762CD56 . 1036288 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

[-] 2004-08-03 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

.

[-] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\regedit.exe

[-] 2004-08-03 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\regedit.exe

[-] 2004-08-03 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regedit.exe

.

[-] 2008-04-14 . E08D638BA3D3DD6DF6E31216AB66AE0B . 1287680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ole32.dll

[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\ole32.dll

[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\dllcache\ole32.dll

[-] 2005-07-26 . 24EDF93FD04CA1A98D32F092DD4F9953 . 1286144 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll

[-] 2005-04-28 . D3653209882B5645223B1EA958EEE3A6 . 1286656 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll

[-] 2005-04-28 . 9752FA23CE81D3A2BD2125F40C24A723 . 1285120 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\ole32.dll

[-] 2004-08-03 . D700449AD3045E81680C25A79620A171 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\ole32.dll

.

[-] 2008-04-14 . 052F968390A85D37D5EE8BE3AB2A83A2 . 406016 . . [1.0420.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\usp10.dll

[-] 2004-08-03 . E4E40EAFF464EBE7752BAD3D82AF1715 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\usp10.dll

[-] 2004-08-03 . E4E40EAFF464EBE7752BAD3D82AF1715 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\dllcache\usp10.dll

.

[-] 2008-04-14 . 671ABB33C712B1585A5BF7ADD36AD96E . 4096 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ksuser.dll

[-] 2004-08-03 . 4721744CE11F385073F6F9F7831752C7 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ksuser.dll

[-] 2004-08-03 . 4721744CE11F385073F6F9F7831752C7 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\ksuser.dll

[-] 2004-08-03 . 4721744CE11F385073F6F9F7831752C7 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\ksuser.dll

.

[-] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-04-14 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\wscntfy.exe

[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe

[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe

.

[-] 2008-04-14 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\xmlprov.dll

[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll

[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll

.

[-] 2008-04-14 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll

[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll

[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll

.

[-] 2008-04-14 . 5251425B86EA4A3532B8BB8D14044E61 . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sfcfiles.dll

[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll

.

[-] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ctfmon.exe

[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe

[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe

.

[-] 2008-04-14 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\shsvcs.dll

[-] 2006-12-19 . 521A4CB71CC419FDF60DB83E7308AE2B . 135168 . . [6.00.2900.3051] . . c:\windows\system32\shsvcs.dll

[-] 2006-12-19 . 521A4CB71CC419FDF60DB83E7308AE2B . 135168 . . [6.00.2900.3051] . . c:\windows\system32\dllcache\shsvcs.dll

[-] 2006-12-19 . B5B37E7C51A551F60A1254E63C878FA9 . 135680 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll

[-] 2004-08-03 . BAC5F7F0C2B8C1B9832594851E0F9914 . 135168 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll

.

[-] 2008-04-14 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\regsvc.dll

[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll

[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll

.

[-] 2008-04-14 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\schedsvc.dll

[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll

[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll

.

[-] 2008-04-14 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ssdpsrv.dll

[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll

[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll

.

[-] 2008-04-14 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\termsrv.dll

[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll

[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll

.

[-] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\hnetcfg.dll

[-] 2004-08-03 . AE93E415220A4C0112768A0DEE36D28D . 348672 . . [5.1.2600.2180] . . c:\windows\system32\hnetcfg.dll

[-] 2004-08-03 . AE93E415220A4C0112768A0DEE36D28D . 348672 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\hnetcfg.dll

.

[-] 2008-04-14 . D45960BE52C3C610D361977057F98C54 . 175616 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\appmgmts.dll

[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll

[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll

.

[-] 2001-08-23 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

.

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\aec.sys

[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys

[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\Driver Cache\i386\aec.sys

[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\dllcache\aec.sys

[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\drivers\aec.sys

[-] 2004-08-03 20:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtUninstallKB900485$\aec.sys

.

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ip6fw.sys

[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys

[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

.

[-] 2008-04-14 02:22 . ACC19BA6876AF18768EE87931CAD14E2 . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mfc40u.dll

[-] 2006-11-01 19:17 . B80F1D82969BD31392F1867936E96448 . 927504 . . [4.1.0.61] . . c:\windows\system32\mfc40u.dll

[-] 2006-11-01 19:17 . B80F1D82969BD31392F1867936E96448 . 927504 . . [4.1.0.61] . . c:\windows\system32\dllcache\mfc40u.dll

[-] 2001-08-23 12:00 . 31DD27AB47F62D383505F35CA972748B . 924432 . . [4.1.6140] . . c:\windows\$NtUninstallKB924667$\mfc40u.dll

.

[-] 2008-04-14 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\msgsvc.dll

[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll

[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll

.

[-] 2008-04-14 02:22 . 6E18978B749F0696A774DE3F2CB142DD . 52736 . . [9.0.1.56] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mspmsnsv.dll

[-] 2004-08-03 22:57 . D68CC4EBF7B03FD770D5962295AD814E . 52736 . . [9.0.1.56] . . c:\windows\system32\mspmsnsv.dll

[-] 2004-08-03 22:57 . D68CC4EBF7B03FD770D5962295AD814E . 52736 . . [9.0.1.56] . . c:\windows\system32\dllcache\mspmsnsv.dll

.

[-] 2010-02-17 . FEDB0FDF1FE02ECC7A823A690175B876 . 2066048 . . [5.1.2600.3670] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe

[-] 2010-02-17 . FEDB0FDF1FE02ECC7A823A690175B876 . 2066048 . . [5.1.2600.3670] . . c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2010-02-16 . 4854CB137C17525E5FEA0AA1B4438880 . 2024448 . . [5.1.2600.3670] . . c:\windows\system32\ntkrnlpa.exe

[-] 2010-02-16 . 9F24D01B6027FED0423FD28F1055E3DD . 2069120 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntkrnlpa.exe

[-] 2010-02-16 . CEE28C8C47E52F185F9F8F3A2E31880C . 2069248 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe

[-] 2009-12-09 . 2E72317A93EF61138E43DCF7CD423EDF . 2068480 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe

[-] 2009-12-09 . 39F1FED7491AC4A659917BE1DB151344 . 2023424 . . [5.1.2600.3654] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe

[-] 2009-12-09 . ADB6D671931D876CD7D53A5E2C147DBB . 2068352 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3GDR\ntkrnlpa.exe

[-] 2009-08-04 . C50ED62BB5CDC5AD4F3985ED39C6AE87 . 2068480 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe

[-] 2009-08-04 . 602A85B23E5D9E6402D7205AFBE6FEB4 . 2068352 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3GDR\ntkrnlpa.exe

[-] 2009-08-04 . 7C9540461F095497E0F0696092569C87 . 2023424 . . [5.1.2600.3610] . . c:\windows\$NtUninstallKB977165$\ntkrnlpa.exe

[-] 2009-02-10 . 321917CFF934663C48C1E91A930E5D71 . 2068352 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe

[-] 2009-02-09 . 4DAA5039B88A46B90FD34D8F89DE3AF9 . 2023424 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB971486$\ntkrnlpa.exe

[-] 2009-02-09 . 1F9DA92672B8B5720C5FB1E87D8F249F . 2068480 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe

[-] 2008-08-14 . C789B5AEA9AB71C5BEF6DD568F744842 . 2068352 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe

[-] 2008-08-14 . A13D8649ECBF1445B0B0DE569EE04609 . 2018304 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe

[-] 2008-08-14 . 8F54D426024BC7E45A6F32253BBB572E . 2065280 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe

[-] 2008-08-14 . 326C258774EB791E78FEA8A9E14D5C3E . 2068352 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe

[-] 2008-04-14 . E51980EF65CED4490A7395A06C08DA34 . 2068224 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntkrnlpa.exe

[-] 2007-02-28 . 9B9CA27AD315C02B71510238574894B2 . 2061696 . . [5.1.2600.3093] . . c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe

[-] 2007-02-28 . 9DC58C5BDEDCCB8298C8A2D6D4996EC4 . 2018304 . . [5.1.2600.3093] . . c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe

[-] 2005-03-02 . AE8364004BBFD70461D2EF34888D3360 . 2059264 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe

[-] 2005-03-02 . A3724446ACB9DE8D890CFABD146CD0AD . 2017792 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe

[-] 2004-08-03 . F8D35488D41B19A306A454FFC0ED0336 . 2017792 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe

.

[-] 2008-04-14 02:22 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntmssvc.dll

[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll

[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll

.

[-] 2008-04-14 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\upnphost.dll

[-] 2007-02-05 . 5C686B95470AC24E133AB4DAC4639A6C . 185856 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll

[-] 2007-02-05 . 855790C1BACED245A6B210AF430ED17B . 185856 . . [5.1.2600.3077] . . c:\windows\system32\upnphost.dll

[-] 2007-02-05 . 855790C1BACED245A6B210AF430ED17B . 185856 . . [5.1.2600.3077] . . c:\windows\system32\dllcache\upnphost.dll

[-] 2004-08-03 . 09D4A2D7C5A8ABEC227D118765FAADDF . 185856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB931261$\upnphost.dll

.

[-] 2008-04-14 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\dsound.dll

[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll

[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll

.

[-] 2008-04-14 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\d3d9.dll

[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\d3d9.dll

[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\d3d9.dll

.

[-] 2008-04-14 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ddraw.dll

[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll

[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\ddraw.dll

.

[-] 2008-04-14 02:22 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\olepro32.dll

[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll

[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\olepro32.dll

.

[-] 2008-04-14 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\perfctrs.dll

[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll

[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\perfctrs.dll

.

[-] 2008-04-14 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\version.dll

[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll

[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\version.dll

.

[-] 2008-04-14 . 3BFE49B4CDFAC83B0F3C79412895A179 . 93184 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\iexplore.exe

[-] 2004-08-03 . B39A6AF04A431E317C85BF061719E705 . 93184 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\iexplore.exe

.

[-] 2010-02-17 . 786F98EFD090AD93F03E3BD95FB68714 . 2192256 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntoskrnl.exe

[-] 2010-02-16 . B76CEA13602DC99EE0E655E4798C24AA . 2189184 . . [5.1.2600.3670] . . c:\windows\Driver Cache\i386\ntoskrnl.exe

[-] 2010-02-16 . B76CEA13602DC99EE0E655E4798C24AA . 2189184 . . [5.1.2600.3670] . . c:\windows\system32\dllcache\ntoskrnl.exe

[-] 2010-02-16 . C5E80D6BD860BB6180E1F89FA3E48136 . 2146304 . . [5.1.2600.3670] . . c:\windows\system32\ntoskrnl.exe

[-] 2010-02-16 . 4456016C2FF1A8CCCAC8309C9B76E2F5 . 2192384 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe

[-] 2009-12-09 . A97847B2D30F4A299B35239D26BAD948 . 2191616 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe

[-] 2009-12-09 . 43EFD54785807AD9F1EF94AE3F0179CF . 2145280 . . [5.1.2600.3654] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe

[-] 2009-12-09 . F71185C58C105BDB2BE1AEEAF4198F6E . 2191488 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3GDR\ntoskrnl.exe

[-] 2009-08-04 . 121AEDCE2F5A65D63C9D51B9198FA7B3 . 2191488 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3GDR\ntoskrnl.exe

[-] 2009-08-04 . 4B86421F2D85D9A4ECB06885C40B8EEB . 2191616 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe

[-] 2009-08-04 . 1C1535EF3A07A3B23001BE1072E63B3B . 2145280 . . [5.1.2600.3610] . . c:\windows\$NtUninstallKB977165$\ntoskrnl.exe

[-] 2009-02-10 . D3453310FC92736E674FFDC6E3F455B7 . 2191488 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe

[-] 2009-02-09 . EA9A7CCE036D7F4121191CE903584F09 . 2145280 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB971486$\ntoskrnl.exe

[-] 2009-02-09 . FEE1600B76B196D9993CD468DA7524F7 . 2191360 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe

[-] 2008-08-14 . 59282EFE7147C011530E51FF92BA86AC . 2191488 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe

[-] 2008-08-14 . 04876E6755E505B76CE1BBB7816B1BF4 . 2138624 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe

[-] 2008-08-14 . C7153F3F41C63C8CB912E973F2780495 . 2188288 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe

[-] 2008-08-14 . 934FBEA25F8DE017ABFC6169B8446D94 . 2191488 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe

[-] 2008-04-14 . 354C9291513BCE4D0ED6B0C6A15470F8 . 2191360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntoskrnl.exe

[-] 2007-02-28 . E1DE7A10D46959560C3B617227D95C19 . 2184448 . . [5.1.2600.3093] . . c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe

[-] 2007-02-28 . 495D541A116E7F1B79ED9BD588F54A71 . 2138624 . . [5.1.2600.3093] . . c:\windows\$NtUninstallKB956841$\ntoskrnl.exe

[-] 2005-03-02 . EB5538A452E0E99169E2B6CDB62FF9D2 . 2181888 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe

[-] 2005-03-02 . 3DDC2BC3D32B2FC505D09B8B8974D5BB . 2138112 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntoskrnl.exe

[-] 2004-08-03 . C3EC5DD56E3EB15D80AF9FCEE030CABD . 2150912 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntoskrnl.exe

.

[-] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-04-14 . 7B353059E665F8B7AD2BBEAEF597CF45 . 177152 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\w32time.dll

[-] 2004-08-03 . C6D874CD2A5B83CD11CDEBD28A638584 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\w32time.dll

[-] 2004-08-03 . C6D874CD2A5B83CD11CDEBD28A638584 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\w32time.dll

.

[-] 2008-04-14 . BC2C5985611C5356B24AEB370953DED9 . 334336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\wiaservc.dll

[-] 2006-12-19 . 452AA1C0E7FEE4B2E78D32BCF36FCEBE . 334336 . . [5.1.2600.3051] . . c:\windows\$hf_mig$\KB927802\SP2QFE\wiaservc.dll

[-] 2006-12-19 . 25E9B30AF1FA1B9AF1853577F39FF20B . 334336 . . [5.1.2600.3051] . . c:\windows\system32\wiaservc.dll

[-] 2006-12-19 . 25E9B30AF1FA1B9AF1853577F39FF20B . 334336 . . [5.1.2600.3051] . . c:\windows\system32\dllcache\wiaservc.dll

[-] 2004-08-03 . 7E751068ADA60FC77638622E86A7CD9E . 333824 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB927802$\wiaservc.dll

.

[-] 2008-04-14 . 2CF969B9BF1EF069075DCDCE309FAAE1 . 18944 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\midimap.dll

[-] 2004-08-03 . 32641AE4D340C1AC2D9B3A3BD71F5C47 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\midimap.dll

[-] 2004-08-03 . 32641AE4D340C1AC2D9B3A3BD71F5C47 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\midimap.dll

.

[-] 2008-04-14 . 469FED8597896DB77B49384BE90E2E0A . 7680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\rasadhlp.dll

[-] 2006-06-26 . 45F87F6E7AB4F79B5C719B78C289DB66 . 7680 . . [5.1.2600.2938] . . c:\windows\$hf_mig$\KB920683\SP2QFE\rasadhlp.dll

[-] 2006-06-26 . DC940E8932827D65180F6A71BD4BD878 . 8192 . . [5.1.2600.2938] . . c:\windows\system32\rasadhlp.dll

[-] 2006-06-26 . DC940E8932827D65180F6A71BD4BD878 . 8192 . . [5.1.2600.2938] . . c:\windows\system32\dllcache\rasadhlp.dll

[-] 2004-08-03 . 84028E2EBE7A25494766673A5FF4B304 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB920683$\rasadhlp.dll

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]

"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2005-05-21 925696]

"TrueImageMonitor.exe"="c:\programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe" [2006-06-20 1106422]

"AcronisTimounterMonitor"="c:\programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe" [2006-06-20 1848150]

"Acronis Scheduler2 Service"="c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" [2006-06-20 126976]

"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-22 8425472]

"nwiz"="nwiz.exe" [2007-03-22 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-03-22 81920]

"NGTray"="c:\programme\Symantec\Ghost\ngtray.exe" [2006-12-04 222856]

"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2007-06-26 312320]

"Control Center"="c:\programme\Digitus\MFP Server Control Center\Control Center.exe" [2007-04-04 5543424]

"EEventManager"="c:\programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2004-08-05 118784]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"Update-Tool"="c:\programme\OPEN-XCHANGE\OXlook\UpdateTool.exe" [2007-09-06 761096]

"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

.

c:\dokumente und einstellungen\k.arnts\Startmenü\Programme\Autostart\

OpenOffice.org 2.3.lnk - c:\programme\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]

.

c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\

Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2009-4-20 295606]

Adobe Reader Synchronizer.lnk - c:\programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1116\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1116\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1116\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1118\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1118\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1118\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1121\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1121\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1121\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1129\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1129\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1129\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1147\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1147\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1147\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1148\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1148\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1148\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-2608\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-2608\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-2608\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-500\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-500\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-500\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1578240273-668469433-1050887974-500\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Programme\\Acronis\\TrueImageEnterpriseServer\\TrueImage.exe"=

"c:\\WINDOWS\\system32\\javaw.exe"=

"c:\\Programme\\Symantec\\Ghost\\ngctw32.exe"=

"c:\\Programme\\Digitus\\MFP Server Control Center\\Control Center.exe"=

.

R0 IPGXII;IPGXII;c:\windows\system32\drivers\IPFD1286.sys [09.02.2009 14:32 62528]

R2 AntiVirMailService;Avira AntiVir MailGuard;c:\programme\Avira\AntiVir Desktop\avmailc.exe [26.05.2009 11:16 340136]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [26.05.2009 11:16 136360]

R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [26.05.2009 11:16 428200]

R2 NGCLIENT;Symantec Ghost Client Agent;c:\programme\Symantec\Ghost\ngctw32.exe [04.12.2006 15:32 632456]

R3 KUSBusByTCPMasterBus;Master Bus of Kernel USB Software Bus by TCP;c:\windows\system32\drivers\KUSBusByTCPMasterBus.sys [13.03.2007 18:15 52352]

S3 KUSBusByTCP;%KUSBusByUSB.SvcDesc%;c:\windows\system32\drivers\KUSBusByTCP.sys [13.03.2007 18:15 77312]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyServer = 192.168.2.110:8100

uInternet Settings,ProxyOverride = 192.168.2.251;<local>

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll

TCP: Interfaces\{9B7F5306-BC2A-45FB-873A-C7BAAC963708}: NameServer = 192.168.2.250,192.168.2.252

FF - ProfilePath - 

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-10-20 14:46

Windows 5.1.2600 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]

"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|ù•6~*]

"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(752)

c:\programme\Avira\AntiVir Desktop\avsda.dll

.

- - - - - - - > 'lsass.exe'(808)

c:\programme\Avira\AntiVir Desktop\avsda.dll

c:\programme\Bonjour\mdnsNSP.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Bonjour\mDNSResponder.exe

c:\programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

c:\windows\system32\nvsvc32.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

c:\windows\system32\RUNDLL32.EXE

c:\programme\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe

c:\programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-10-20  14:51:04 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-10-20 12:51

.

Vor Suchlauf: 9 Verzeichnis(se), 77.966.233.600 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 77.966.618.624 Bytes frei

.

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

.

- - End Of File - - 5DD33281FBB55FB41B11EFECB863703E

--- --- ---

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

FCopy::

c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys | c:\windows\system32\Drivers\atapi.sys
 

Folder::

c:\dokumente und einstellungen\Anmeldung\Anwendungsdaten\Ewylxa

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Combofix Logfile:

Code:

ComboFix 11-10-24.05 - Administrator 25.10.2011  12:25:46.2.2 - x86

Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.2047.1460 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Anmeldung\Eigene Dateien\Downloads\ComboFix.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Administrator.AWT\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Outdated* {B02B524A-0C22-45DD-A6D1-70C7010CE58E}

FW: ActiveArmor Firewall *Disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\k.arnts\prfE.tmp

c:\windows\help\tours\htmltour\unlock_playing.htm

.

.

--------------- FCopy ---------------

.

c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys --> c:\windows\system32\Drivers\atapi.sys

.

(((((((((((((((((((((((   Dateien erstellt von 2011-09-25 bis 2011-10-25  ))))))))))))))))))))))))))))))

.

.

2011-10-21 09:25 . 2011-10-21 09:25        --------        d-----w-        c:\dokumente und einstellungen\Administrator.V23\Lokale Einstellungen\Anwendungsdaten\Adobe

2011-10-19 08:12 . 2011-10-19 08:12        --------        d-----w-        C:\_OTL

2011-10-18 10:59 . 2011-10-18 10:59        --------        d-----w-        c:\dokumente und einstellungen\Administrator.AWT\Anwendungsdaten\Avira

2011-10-18 06:21 . 2011-10-18 06:21        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java

2011-10-18 06:21 . 2011-10-18 06:21        73728        ----a-w-        c:\windows\system32\javacpl.cpl

2011-10-18 06:21 . 2011-10-18 06:21        476904        ----a-w-        c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll

2011-10-18 06:21 . 2011-10-18 06:21        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2011-10-18 06:21 . 2011-10-18 06:21        --------        d-----w-        c:\programme\Java

2011-10-13 05:58 . 2011-10-13 05:58        --------        d-----w-        c:\dokumente und einstellungen\Administrator.V23\Anwendungsdaten\Malwarebytes

2011-10-11 12:30 . 2011-10-11 12:30        --------        d-----w-        c:\programme\ESET

2011-10-11 05:42 . 2011-09-29 07:09        16856        ----a-w-        c:\programme\Mozilla Firefox\plugin-container.exe

2011-10-11 05:42 . 2011-09-29 07:09        134104        ----a-w-        c:\programme\Mozilla Firefox\components\browsercomps.dll

2011-10-11 05:42 . 2011-09-29 07:09        89048        ----a-w-        c:\programme\Mozilla Firefox\libEGL.dll

2011-10-11 05:42 . 2011-09-29 07:09        773080        ----a-w-        c:\programme\Mozilla Firefox\mozsqlite3.dll

2011-10-11 05:42 . 2011-09-29 07:09        719832        ----a-w-        c:\programme\Mozilla Firefox\mozcpp19.dll

2011-10-11 05:42 . 2011-09-29 07:09        478168        ----a-w-        c:\programme\Mozilla Firefox\libGLESv2.dll

2011-10-11 05:42 . 2011-09-29 07:09        1833944        ----a-w-        c:\programme\Mozilla Firefox\mozjs.dll

2011-10-11 05:42 . 2011-09-29 07:09        15832        ----a-w-        c:\programme\Mozilla Firefox\mozalloc.dll

2011-10-11 05:42 . 2011-09-29 00:26        2106216        ----a-w-        c:\programme\Mozilla Firefox\D3DCompiler_43.dll

2011-10-11 05:42 . 2011-09-29 00:26        1998168        ----a-w-        c:\programme\Mozilla Firefox\d3dx9_43.dll

2011-10-10 05:58 . 2011-10-10 05:58        --------        d-----w-        c:\dokumente und einstellungen\Anmeldung\Anwendungsdaten\Malwarebytes

2011-10-10 05:55 . 2011-10-10 05:55        --------        d-----w-        c:\dokumente und einstellungen\Administrator.AWT\Anwendungsdaten\Malwarebytes

2011-10-10 05:55 . 2011-10-10 05:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-10-10 05:55 . 2011-08-31 15:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-10-10 05:55 . 2011-10-10 05:55        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-09-28 06:48 . 2011-10-19 12:48        --------        d-----w-        c:\dokumente und einstellungen\Anmeldung\Anwendungsdaten\Ewylx

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-29 07:09 . 2011-10-11 05:42        134104        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys

.

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\asyncmac.sys

[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys

[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys

.

[-] 2001-08-23 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

[-] 2001-08-23 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

.

[-] 2008-04-14 . 1704D8C4C8807B889E43C649B478A452 . 25216 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\kbdclass.sys

[-] 2004-08-03 . B128FC0A5CD83F669D5DE4B58F77C7D6 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

.

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ndis.sys

[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys

[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

.

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntfs.sys

[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys

[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\system32\dllcache\ntfs.sys

[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\system32\drivers\ntfs.sys

[-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys

.

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

.

[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys

[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys

[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\tcpip.sys

[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748$\tcpip.sys

[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys

[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys

[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys

[-] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB917953$\tcpip.sys

.

[-] 2008-04-14 . B42057F06BBB98B31876C0B3F2B54E33 . 77824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\browser.dll

[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll

[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll

.

[-] 2008-04-14 . AFB8261B56CBA0D86AEB6DF682AF9785 . 13312 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\lsass.exe

[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe

.

[-] 2008-04-14 . E6D88F1F6745BF00B57E7855A2AB696C . 198144 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netman.dll

[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll

[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\dllcache\netman.dll

[-] 2005-08-22 . 19D9B6B139F09A72AE71758BDF28308E . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll

[-] 2004-08-03 . CDF4DA6B518105343FE9E8AFBBF8FBF4 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll

.

[-] 2008-04-14 02:22 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\comres.dll

[-] 2004-08-03 22:57 . 4B9D9E2708019763C5A72DA776DB1158 . 846848 . . [2001.12.4414.258] . . c:\windows\system32\comres.dll

[-] 2004-08-03 22:57 . 4B9D9E2708019763C5A72DA776DB1158 . 846848 . . [2001.12.4414.258] . . c:\windows\system32\dllcache\comres.dll

.

[-] 2008-04-14 . D6F603772A789BB3228F310D650B8BD1 . 409088 . . [6.7.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\qmgr.dll

[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll

[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll

.

[-] 2009-02-09 . D3D765E8455A961AE567B408F767D4F9 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll

[-] 2009-02-09 . 3127AFBF2C1ED0AB14A1BBB7AAECB85B . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll

[-] 2009-02-09 . 8AFBC2E1E5555A1C29953AF854F0FCA5 . 401408 . . [5.1.2600.3520] . . c:\windows\system32\rpcss.dll

[-] 2009-02-09 . 8AFBC2E1E5555A1C29953AF854F0FCA5 . 401408 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\rpcss.dll

[-] 2008-04-14 . E970C2296916BF4A2F958680016FE312 . 399360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\rpcss.dll

[-] 2005-07-26 . 891E3E4537C6DFCAE475073FC49CE9CB . 397824 . . [5.1.2600.2726] . . c:\windows\$NtUninstallKB956572$\rpcss.dll

[-] 2005-07-26 . DBA9F9C00A7A2B45EB8E451C2B6D10E9 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll

[-] 2005-04-28 . 434A27912D53BF3FB6C1CE37BAFA5CF6 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll

[-] 2005-04-28 . A9219270CA2E5DDB52828E7AB7268B82 . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll

[-] 2004-08-03 . 9F28FF58D6D67B123272869D89D14004 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll

.

[-] 2009-02-09 . A3EDBE9053889FB24AB22492472B39DC . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe

[-] 2009-02-09 . F0A7D59AF279326528715B206669B86C . 111104 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe

[-] 2009-02-09 . A07CA23EA361A01E627D911CF139B950 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\services.exe

[-] 2009-02-09 . A07CA23EA361A01E627D911CF139B950 . 111104 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\services.exe

[-] 2008-04-14 . 4BB6A83640F1D1792AD21CE767B621C6 . 109056 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\services.exe

[-] 2004-08-03 . EDB6B81761BD60F32F740BBC40AFB676 . 108544 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572$\services.exe

.

[-] 2008-04-14 . 39356A9CDB6753A6D13A4072A9F5A4BB . 57856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\spoolsv.exe

[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe

[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe

[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2004-08-03 . 54E7113A4BD696E430919BCAF5C65E06 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe

.

[-] 2008-04-14 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe

[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe

.

[-] 2008-04-14 . AD28671D1B83A386B070DC451A113C13 . 617472 . . [5.82] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\comctl32.dll

[-] 2008-04-14 . 3C93CE6C6985C55952B7BE6673E9FD15 . 1054208 . . [6.0] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\asms\60\msft\windows\common\controls\comctl32.dll

[-] 2006-08-25 . EE82D1393169AC6BDF6016F4EA8D2B79 . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2006-08-25 . EE82D1393169AC6BDF6016F4EA8D2B79 . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2006-08-25 . F64451D07B9368B46AB31172D56D1804 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

[-] 2004-08-03 . 2CF914215226B3F7FA1AE4A47E4D261C . 611328 . . [5.82] . . c:\windows\$NtUninstallKB923191$\comctl32.dll

[-] 2004-08-03 . 9D0F57B9C65BF8A07DB655A9ED6EB2EE . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

[-] 2001-08-23 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

.

[-] 2008-04-14 . 611F824E5C703A5A899F84C5F1699E4D . 62464 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\cryptsvc.dll

[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll

[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll

.

[-] 2008-07-07 20:30 . D68ED3908C7A0DB446111D34AC40DC18 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\es.dll

[-] 2008-07-07 20:30 . D68ED3908C7A0DB446111D34AC40DC18 . 253952 . . [2001.12.4414.320] . . c:\windows\system32\dllcache\es.dll

[-] 2008-07-07 20:26 . AF4F6B5739D18CA7972AB53E091CBC74 . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll

[-] 2008-07-07 20:23 . ADA7241C16F3F42C7F210539FAD5F3AA . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll

[-] 2008-07-07 20:16 . 3912BEF896D1D687B6053409E5F5F2A6 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll

[-] 2008-04-14 02:22 . 0F3EDAEE1EF97CF3DB2BE23A7289B78C . 246272 . . [2001.12.4414.701] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\es.dll

[-] 2005-07-26 04:39 . BEBC63622BDC30053A3145EBD90AF450 . 243200 . . [2001.12.4414.308] . . c:\windows\$NtUninstallKB950974$\es.dll

[-] 2005-07-26 04:29 . 0D0F85237E32538F58278D673032676A . 243200 . . [2001.12.4414.308] . . c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll

[-] 2004-08-03 22:57 . 4E1A8645EE77CB9454FFE53C59620A25 . 243200 . . [2001.12.4414.258] . . c:\windows\$NtUninstallKB902400$\es.dll

.

[-] 2008-04-14 . F9954695D246B33A5BF105029A4C6AB6 . 110080 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\imm32.dll

[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll

[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll

.

[-] 2009-03-21 . A6F4977F9D2C9506050BFF0EF0B574B5 . 1059840 . . [5.1.2600.3541] . . c:\windows\system32\kernel32.dll

[-] 2009-03-21 . A6F4977F9D2C9506050BFF0EF0B574B5 . 1059840 . . [5.1.2600.3541] . . c:\windows\system32\dllcache\kernel32.dll

[-] 2009-03-21 . B055C64AABC1A3E3DE57EC8025CAD283 . 1063424 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3GDR\kernel32.dll

[-] 2009-03-21 . 3EB703BFC2ED26A3D8ACB8626AB2C006 . 1065472 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll

[-] 2009-03-21 . B6053A5FA67EAC4A292A44F585881FFF . 1062912 . . [5.1.2600.3541] . . c:\windows\$hf_mig$\KB959426\SP2QFE\kernel32.dll

[-] 2008-04-14 . 4C897C69754D88F496339B1A666907C1 . 1063424 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\kernel32.dll

[-] 2007-04-16 . 5D0974BD58808FACA5D2C437B6FC8D85 . 1059840 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll

[-] 2007-04-16 . 8EEA8280A1E0E794EDFCCAD3721C7CAB . 1058304 . . [5.1.2600.3119] . . c:\windows\$NtUninstallKB959426$\kernel32.dll

[-] 2004-08-03 . E6CD85D0D37416CF138F01F4BB0FC872 . 1057280 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB935839$\kernel32.dll

.

[-] 2008-04-14 . 5543A9D4A1D0F9F84092482A9373A024 . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\linkinfo.dll

[-] 2005-09-01 . F2AFE60F01040B23207D8EB7DC26EC96 . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll

[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll

[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\dllcache\linkinfo.dll

[-] 2004-08-03 . 3898FFF548E2968CB3AC5A71D7F4E425 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll

.

[-] 2008-04-14 . F38F3C47BBFFD748C1359AB171C3A630 . 22016 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\lpk.dll

[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll

[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll

.

[-] 2010-04-16 . 164B4195439F7A0919A6CA7BDEC238AC . 3094016 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3GDR\mshtml.dll

[-] 2010-04-16 . 65E4FEB30D4307C1425F8635EE75200D . 3094528 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3QFE\mshtml.dll

[-] 2010-04-16 . F78A7680EC0A14F1D601364DD4635D7B . 3086336 . . [6.00.2900.3698] . . c:\windows\system32\mshtml.dll

[-] 2010-04-16 . F78A7680EC0A14F1D601364DD4635D7B . 3086336 . . [6.00.2900.3698] . . c:\windows\system32\dllcache\mshtml.dll

[-] 2010-04-16 . 61244206F4B9840DE7AD5BF8DE5B9A49 . 3094016 . . [6.00.2900.3698] . . c:\windows\$hf_mig$\KB982381\SP2QFE\mshtml.dll

[-] 2010-02-26 . DCDD4521EE1CD7E0D545317AAB10D1CE . 3094016 . . [6.00.2900.3676] . . c:\windows\$hf_mig$\KB980182\SP2QFE\mshtml.dll

[-] 2010-02-26 . 562E9B7A59BA0A4FCC54D6B39E7B6A1E . 3086336 . . [6.00.2900.3676] . . c:\windows\$NtUninstallKB982381$\mshtml.dll

[-] 2010-02-26 . E2CA735504A1D90EC8FAB02858A62996 . 3094016 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3GDR\mshtml.dll

[-] 2010-02-26 . A8662879AC1BC243664C7331B8F0E74D . 3094528 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3QFE\mshtml.dll

[-] 2009-12-22 . DD7FFD7FB25C268A46791E5A42CCF038 . 3084800 . . [6.00.2900.3660] . . c:\windows\$NtUninstallKB980182$\mshtml.dll

[-] 2009-12-22 . DEBDFEE5D25C43616E0A29092F17F38D . 3092480 . . [6.00.2900.3660] . . c:\windows\$hf_mig$\KB978207\SP2QFE\mshtml.dll

[-] 2009-12-22 . 25EDB39CE3473A734476100AB8DE6A15 . 3092480 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3GDR\mshtml.dll

[-] 2009-12-22 . 55EBD086581CA985DFB63736ED42629E . 3094528 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3QFE\mshtml.dll

[-] 2009-10-29 . D473C3526B86547643858E40FD096422 . 3091968 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3GDR\mshtml.dll

[-] 2009-10-29 . 2DE2C731DC298392D763BF62C0310D4A . 3084288 . . [6.00.2900.3640] . . c:\windows\$NtUninstallKB978207$\mshtml.dll

[-] 2009-10-29 . 0B59B93A2524462E02EB2084FEA2E9C1 . 3094016 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3QFE\mshtml.dll

[-] 2009-10-29 . A49E11FC06282A68232DE1AF1E9C9CD3 . 3091968 . . [6.00.2900.3640] . . c:\windows\$hf_mig$\KB976325\SP2QFE\mshtml.dll

[-] 2009-10-20 . 11E808A2F746C273BD609C5FA7AB1890 . 3084288 . . [6.00.2900.3636] . . c:\windows\$NtUninstallKB976325$\mshtml.dll

[-] 2009-10-19 . 84866A38371838B4F49D68DF167C3681 . 3091968 . . [6.00.2900.3636] . . c:\windows\$hf_mig$\KB976749\SP2QFE\mshtml.dll

[-] 2009-10-19 . 711368E3637EC8F2F04CCA1168324B8C . 3091968 . . [6.00.2900.5890] . . c:\windows\$hf_mig$\KB976749\SP3GDR\mshtml.dll

[-] 2009-10-19 . 4AB194D8CDD5167674FD7E2F1DC1CD00 . 3093504 . . [6.00.2900.5890] . . c:\windows\$hf_mig$\KB976749\SP3QFE\mshtml.dll

[-] 2009-09-25 . 95BD53D5AB4AA7BD8098CCBA7D01C5D1 . 3084288 . . [6.00.2900.3627] . . c:\windows\$NtUninstallKB976749$\mshtml.dll

[-] 2009-09-25 . C6F8947BB5076B0C7C8E8ECFCC394F84 . 3091968 . . [6.00.2900.3627] . . c:\windows\$hf_mig$\KB974455\SP2QFE\mshtml.dll

[-] 2009-09-25 . 848FD0FC3725E859C7512047BF447510 . 3091968 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3GDR\mshtml.dll

[-] 2009-09-25 . CB479559434C766DCC26D0489BA84EF1 . 3093504 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3QFE\mshtml.dll

[-] 2009-07-18 . B6D491B0E52DE9575F042E8398671974 . 3083264 . . [6.00.2900.3603] . . c:\windows\$NtUninstallKB974455$\mshtml.dll

[-] 2009-07-18 . 455DE0E849F09CC58CD4B614020B753F . 3090432 . . [6.00.2900.5848] . . c:\windows\$hf_mig$\KB972260\SP3GDR\mshtml.dll

[-] 2009-07-18 . DA5277A9BE2E684B2693E8CDC0FED8B6 . 3090432 . . [6.00.2900.3603] . . c:\windows\$hf_mig$\KB972260\SP2QFE\mshtml.dll

[-] 2009-07-18 . 26FD9945DF52F824888631CE09C77CB0 . 3090944 . . [6.00.2900.5848] . . c:\windows\$hf_mig$\KB972260\SP3QFE\mshtml.dll

[-] 2009-04-29 . 43F242F1804B5FDC7EA3B05FA98DEEE2 . 3081728 . . [6.00.2900.3562] . . c:\windows\$NtUninstallKB972260$\mshtml.dll

[-] 2009-04-29 . 2AAFE1C8A23843A40D3D5192CC93CC51 . 3089920 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3GDR\mshtml.dll

[-] 2009-04-29 . C651307F243807E92151FBDA2A1A0668 . 3089920 . . [6.00.2900.3562] . . c:\windows\$hf_mig$\KB969897\SP2QFE\mshtml.dll

[-] 2009-04-29 . 5D79A59F2AE282734E9A228B33314ACE . 3090432 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3QFE\mshtml.dll

[-] 2009-02-20 . 1F4F0A17815C0370644AACB3298B107D . 3088896 . . [6.00.2900.3527] . . c:\windows\$hf_mig$\KB963027\SP2QFE\mshtml.dll

[-] 2009-02-20 . E1B4638FF5F8D6BB002849FA0FBF36BC . 3080704 . . [6.00.2900.3527] . . c:\windows\$NtUninstallKB969897$\mshtml.dll

[-] 2009-02-20 . E4160ECABB1F61BFA54A9366B50C3CA8 . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\mshtml.dll

[-] 2009-02-20 . 272906D8E5499462A4201C3596031EDF . 3089408 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\mshtml.dll

[-] 2008-12-12 . 295752605EAAF3F4C6879996E97F66CA . 3081216 . . [6.00.2900.3492] . . c:\windows\$NtUninstallKB963027$\mshtml.dll

[-] 2008-12-12 . 785EF0996D7ED3F685C39FED77C50408 . 3088384 . . [6.00.2900.3492] . . c:\windows\$hf_mig$\KB960714\SP2QFE\mshtml.dll

[-] 2008-12-12 . D3BC95D72D732C2F05CB24E56EC5D7D3 . 3088896 . . [6.00.2900.5726] . . c:\windows\$hf_mig$\KB960714\SP3QFE\mshtml.dll

[-] 2008-12-12 . E8002EA2A6DB0FC061D7E6436C9AFF58 . 3088896 . . [6.00.2900.5726] . . c:\windows\$hf_mig$\KB960714\SP3GDR\mshtml.dll

[-] 2008-10-16 . 6FCD5A221AF953E47543FC084FADDF75 . 3080704 . . [6.00.2900.3462] . . c:\windows\$NtUninstallKB960714$\mshtml.dll

[-] 2008-10-16 . 8A93A35B05C15780BE61D16F1B673B2C . 3088384 . . [6.00.2900.3462] . . c:\windows\$hf_mig$\KB958215\SP2QFE\mshtml.dll

[-] 2008-10-16 . C25684D7A6272BE0ECF749BFD7EF83F9 . 3088896 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3QFE\mshtml.dll

[-] 2008-10-16 . 2F6089996C26EE36DE46A2CC90A9996C . 3088896 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3GDR\mshtml.dll

[-] 2008-08-20 . 8317F8BF680E5E7E963D0813169303E1 . 3081216 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB958215$\mshtml.dll

[-] 2008-08-20 . 921840757FDDD0DCF947EBBF5D8C6FE9 . 3088384 . . [6.00.2900.3429] . . c:\windows\$hf_mig$\KB956390\SP2QFE\mshtml.dll

[-] 2008-08-20 . 9F3A80616E64425D2E22DB8C689C98E8 . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\mshtml.dll

[-] 2008-08-20 . F10BD57696EF088685D8548AE2A23572 . 3088896 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\mshtml.dll

[-] 2008-06-25 . F9F693A6E17EC05CDDA3949789710F5D . 3088896 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3QFE\mshtml.dll

[-] 2008-06-23 . 1C95CFF9357A5E39D57F340D0891EA53 . 3088384 . . [6.00.2900.3395] . . c:\windows\$hf_mig$\KB953838\SP2QFE\mshtml.dll

[-] 2008-06-23 . 019015EDB00FC65F909439E72902974A . 3080704 . . [6.00.2900.3395] . . c:\windows\$NtUninstallKB956390$\mshtml.dll

[-] 2008-06-23 . 8B13E2409FE52E03A9AF548E20505EDC . 3088384 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3GDR\mshtml.dll

[-] 2008-04-21 . FDB76AF64A6C7A16560B17501B50A82A . 3080704 . . [6.00.2900.3354] . . c:\windows\$NtUninstallKB953838$\mshtml.dll

[-] 2008-04-21 . 97F3A3011FEFD8EC231365767B6203D6 . 3087872 . . [6.00.2900.3354] . . c:\windows\$hf_mig$\KB950759\SP2QFE\mshtml.dll

[-] 2008-04-21 . 324308768813C0518F677DDD631A94A0 . 3087872 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3GDR\mshtml.dll

[-] 2008-04-21 . 031FF37B530D76C23BCC2E21B709DB7F . 3088384 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3QFE\mshtml.dll

[-] 2008-04-14 . 72AE55A9FFBC60650339CB12E35C7DD5 . 3066880 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mshtml.dll

[-] 2008-02-16 . 016F10669B82482DE4AEF35617A63A3C . 3080704 . . [6.00.2900.3314] . . c:\windows\$NtUninstallKB950759$\mshtml.dll

[-] 2008-02-16 . DDAD436E163284C7115F5C5A429A9D6A . 3087872 . . [6.00.2900.3314] . . c:\windows\$hf_mig$\KB947864\SP2QFE\mshtml.dll

[-] 2007-12-07 . 3C961503B4078281DCFC65DC4658C08B . 3080192 . . [6.00.2900.3268] . . c:\windows\$NtUninstallKB947864$\mshtml.dll

[-] 2007-12-07 . 35161A288701DCCF7951D9BA647A9F52 . 3087360 . . [6.00.2900.3268] . . c:\windows\$hf_mig$\KB944533\SP2QFE\mshtml.dll

[-] 2007-10-30 . EF34B39C746FA81408A98639D60B3903 . 3079680 . . [6.00.2900.3243] . . c:\windows\$NtUninstallKB944533$\mshtml.dll

[-] 2007-10-30 . 7E44238B71A821276EEA8D704191D848 . 3086848 . . [6.00.2900.3243] . . c:\windows\$hf_mig$\KB942615\SP2QFE\mshtml.dll

[-] 2007-08-22 . 4AAFA54B172BDA3B4B7504AA03332A41 . 3079168 . . [6.00.2900.3199] . . c:\windows\$NtUninstallKB942615$\mshtml.dll

[-] 2007-08-22 . A9AC1654BE9D4081A824DC22CAF63092 . 3085824 . . [6.00.2900.3199] . . c:\windows\$hf_mig$\KB939653\SP2QFE\mshtml.dll

[-] 2004-08-03 . CAC51AD576713E5F0CE2251ED3A7FE82 . 3003392 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB939653$\mshtml.dll

[-] 2004-08-03 . CAC51AD576713E5F0CE2251ED3A7FE82 . 3003392 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2gdr\mshtml.dll

[-] 2004-08-03 . CAC51AD576713E5F0CE2251ED3A7FE82 . 3003392 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2qfe\mshtml.dll

.

[-] 2008-04-14 . C6A6E53A0C34EC87883137A6CB87AE5E . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\msvcrt.dll

[-] 2008-04-14 . C536AAD8A71608FE33CD956214EDD366 . 343040 . . [7.0.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\asms\70\msft\windows\mswincrt\msvcrt.dll

[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll

[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll

[-] 2004-08-03 . 365B3C43810E1CF41B3BE1E7180F583B . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll

[-] 2001-08-23 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll

.

[-] 2008-06-20 . ACD8BD448A74F344D46FCAF21BAB92AF . 247296 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll

[-] 2008-06-20 . 4AA50627B01C0E9C6B4C6BD3AF648F12 . 247296 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll

[-] 2008-06-20 . 774274C487493452DF3B0126DBE7FF3B . 247296 . . [5.1.2600.3394] . . c:\windows\system32\mswsock.dll

[-] 2008-06-20 . 774274C487493452DF3B0126DBE7FF3B . 247296 . . [5.1.2600.3394] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2008-06-20 . EB55B1D9978B61E9913EDCD27EEC4C7C . 247296 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll

[-] 2008-04-14 . F12B9D9A069331877D006CC81B4735F9 . 247296 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mswsock.dll

[-] 2004-08-03 . B36E08F680BAE4DFC5C24D00A2DFC9E7 . 247296 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB951748$\mswsock.dll

.

[-] 2009-02-06 . ED4BBAD725A21632FB205452749FC8F5 . 408064 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB975467$\netlogon.dll

[-] 2009-02-06 . ED4BBAD725A21632FB205452749FC8F5 . 408064 . . [5.1.2600.3520] . . c:\windows\system32\netlogon.dll

[-] 2009-02-06 . ED4BBAD725A21632FB205452749FC8F5 . 408064 . . [5.1.2600.3520] . . c:\windows\system32\dllcache\netlogon.dll

[-] 2008-04-14 . 0098D35F91DEAB9C127360A877F2CF84 . 407040 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll

[-] 2004-08-03 . D27395EDCD3416AFD125A9370DCB585C . 407040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB968389$\netlogon.dll

.

[-] 2008-04-14 . C8C0BDABC966B6C24D337DF0A0A399E1 . 17408 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\powrprof.dll

[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll

[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll

.

[-] 2008-04-14 . 5132443DF6FC3771A17AB4AE55DCBC28 . 187904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll

[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll

[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll

.

[-] 2008-04-14 . 44161A59DC33AC2EA9C95438ADFFFB7F . 5120 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sfc.dll

[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll

[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll

.

[-] 2008-04-14 . 4FBC75B74479C7A6F829E0CA19DF3366 . 14336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\svchost.exe

[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe

.

[-] 2008-04-14 . 05903CAC4B98908D55EA5774775B382E . 249856 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\tapisrv.dll

[-] 2005-07-08 . F07061E18613F336A3120229097F7635 . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll

[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll

[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\dllcache\tapisrv.dll

[-] 2004-08-03 . 4584E2A5FE662AB3E7C32936E1449043 . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll

.

[-] 2008-04-14 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll

[-] 2007-03-08 . 78785EFF8CB90CEC1862A4CCFD9A3C3A . 579584 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll

[-] 2007-03-08 . 492E166CFD26A50FB9160DB536FF7D2B . 579072 . . [5.1.2600.3099] . . c:\windows\system32\user32.dll

[-] 2007-03-08 . 492E166CFD26A50FB9160DB536FF7D2B . 579072 . . [5.1.2600.3099] . . c:\windows\system32\dllcache\user32.dll

[-] 2005-03-02 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll

[-] 2005-03-02 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll

[-] 2004-08-03 . 56785FD5236D7B22CF471A6DA9DB46D8 . 578560 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

.

[-] 2008-04-14 . 788F95312E26389D596C0FA55834E106 . 26624 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe

[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe

[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe

.

[-] 2010-04-16 . 0CC0A30F7F06C6A5A40911616CA35085 . 672768 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3GDR\wininet.dll

[-] 2010-04-16 . 68B82A22151D41988B3BCB7C881E2B0E . 674304 . . [6.00.2900.5969] . . c:\windows\$hf_mig$\KB982381\SP3QFE\wininet.dll

[-] 2010-04-16 . C7B31EF1A7F52D99E92BFF1B053D6EB2 . 667648 . . [6.00.2900.3698] . . c:\windows\system32\wininet.dll

[-] 2010-04-16 . C7B31EF1A7F52D99E92BFF1B053D6EB2 . 667648 . . [6.00.2900.3698] . . c:\windows\system32\dllcache\wininet.dll

[-] 2010-04-16 . 4350AD71E6C5F397BB76DFF7C4BCFCBD . 674304 . . [6.00.2900.3698] . . c:\windows\$hf_mig$\KB982381\SP2QFE\wininet.dll

[-] 2010-02-26 . 54B62A6FBDF708F3A3C42382FA7BCCB7 . 667648 . . [6.00.2900.3676] . . c:\windows\$NtUninstallKB982381$\wininet.dll

[-] 2010-02-26 . DB3E27E2A3CD8128AE60C006165A3894 . 674304 . . [6.00.2900.3676] . . c:\windows\$hf_mig$\KB980182\SP2QFE\wininet.dll

[-] 2010-02-26 . 8A54A1EFAF25D51AF0AF6C16A3632F44 . 672768 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3GDR\wininet.dll

[-] 2010-02-26 . D9B4109E317F25D5342DB8EC39446A1C . 674304 . . [6.00.2900.5945] . . c:\windows\$hf_mig$\KB980182\SP3QFE\wininet.dll

[-] 2009-12-22 . FB39AB08021941836E0F554570D73C79 . 667648 . . [6.00.2900.3660] . . c:\windows\$NtUninstallKB980182$\wininet.dll

[-] 2009-12-22 . C8F00B80E215CA7D803D1A932CE01C9E . 674304 . . [6.00.2900.3660] . . c:\windows\$hf_mig$\KB978207\SP2QFE\wininet.dll

[-] 2009-12-22 . 352E386B17F08786A7F0D9D9D909E1FA . 672768 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3GDR\wininet.dll

[-] 2009-12-22 . 7F7A6BC378B622FDFC90C5A5575A83D0 . 674304 . . [6.00.2900.5921] . . c:\windows\$hf_mig$\KB978207\SP3QFE\wininet.dll

[-] 2009-10-29 . C64DCEA39BD8845BADB6CF9DB6E14D8B . 667648 . . [6.00.2900.3640] . . c:\windows\$NtUninstallKB978207$\wininet.dll

[-] 2009-10-29 . 547B7FF3C91C09E7EE82760DA4323706 . 672768 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3GDR\wininet.dll

[-] 2009-10-29 . 132C1D9C2DDCDFF55746D73508250362 . 674304 . . [6.00.2900.5897] . . c:\windows\$hf_mig$\KB976325\SP3QFE\wininet.dll

[-] 2009-10-29 . 66F8DD3C5A2F6B5B839B96F9704B40BA . 674304 . . [6.00.2900.3640] . . c:\windows\$hf_mig$\KB976325\SP2QFE\wininet.dll

[-] 2009-09-25 . 85C9ABE5F08AF31EF47933B4926F17C6 . 667648 . . [6.00.2900.3627] . . c:\windows\$NtUninstallKB976325$\wininet.dll

[-] 2009-09-25 . 1B6142BB8574BD070105289B55D43168 . 674304 . . [6.00.2900.3627] . . c:\windows\$hf_mig$\KB974455\SP2QFE\wininet.dll

[-] 2009-09-25 . C9ACEFE3BE286B40A84D47498CF73CB8 . 672768 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3GDR\wininet.dll

[-] 2009-09-25 . 8DA0021A5283AFC13EF3932EDD5D1CDA . 674304 . . [6.00.2900.5880] . . c:\windows\$hf_mig$\KB974455\SP3QFE\wininet.dll

[-] 2009-06-26 . 6988F148A06D085A49553F3E00E0D062 . 672256 . . [6.00.2900.5835] . . c:\windows\$hf_mig$\KB972260\SP3GDR\wininet.dll

[-] 2009-06-26 . F39EB4C85244526E442AC1C55297C918 . 673792 . . [6.00.2900.5835] . . c:\windows\$hf_mig$\KB972260\SP3QFE\wininet.dll

[-] 2009-06-26 . EC47B51F2A656CC1FB669836E04F9AA3 . 665088 . . [6.00.2900.3592] . . c:\windows\$NtUninstallKB974455$\wininet.dll

[-] 2009-06-26 . 5F14BC3417EDA201007F9BCDE10ABDEE . 673792 . . [6.00.2900.3592] . . c:\windows\$hf_mig$\KB972260\SP2QFE\wininet.dll

[-] 2009-04-29 . 8134E79429BBA1E37FAB26F5A84E1CF5 . 665088 . . [6.00.2900.3562] . . c:\windows\$NtUninstallKB972260$\wininet.dll

[-] 2009-04-29 . 7A9E3F9ED0B2772F352571D26D0A164E . 672256 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3GDR\wininet.dll

[-] 2009-04-29 . 1921E9AE3EEDF5966666E5C46DE9E3A1 . 673792 . . [6.00.2900.3562] . . c:\windows\$hf_mig$\KB969897\SP2QFE\wininet.dll

[-] 2009-04-29 . 4926F4F45F9400B8F535E5F5443A54BA . 673792 . . [6.00.2900.5803] . . c:\windows\$hf_mig$\KB969897\SP3QFE\wininet.dll

[-] 2009-02-20 . D6C05CF7EA4617375C57941E867648C4 . 665088 . . [6.00.2900.3527] . . c:\windows\$NtUninstallKB969897$\wininet.dll

[-] 2009-02-20 . 2A35B8EAB65D43244F64DF891FBD3C21 . 673792 . . [6.00.2900.3527] . . c:\windows\$hf_mig$\KB963027\SP2QFE\wininet.dll

[-] 2009-02-20 . 34D8090A7B1AE7975FAE5259BF840849 . 671744 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3GDR\wininet.dll

[-] 2009-02-20 . DE271547E700E38226FB0DE0BA34D37A . 673280 . . [6.00.2900.5764] . . c:\windows\$hf_mig$\KB963027\SP3QFE\wininet.dll

[-] 2008-10-16 . 8F865B36EA1C77A4F1F0E118560F5775 . 665088 . . [6.00.2900.3462] . . c:\windows\$NtUninstallKB963027$\wininet.dll

[-] 2008-10-16 . 3BDCD8E52A29A36F2A4D76789DF37FE1 . 673280 . . [6.00.2900.3462] . . c:\windows\$hf_mig$\KB958215\SP2QFE\wininet.dll

[-] 2008-10-16 . 7DBE34DA22CAB4BE922638540048379F . 672768 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3QFE\wininet.dll

[-] 2008-10-16 . 10A2C485838D5B95CCF7905E21E9A80A . 671744 . . [6.00.2900.5694] . . c:\windows\$hf_mig$\KB958215\SP3GDR\wininet.dll

[-] 2008-08-20 . 53163D419C4780F65C114E746FAE1E49 . 665088 . . [6.00.2900.3429] . . c:\windows\$NtUninstallKB958215$\wininet.dll

[-] 2008-08-20 . 66AF60C255953898C67993CD665A2D22 . 673280 . . [6.00.2900.3429] . . c:\windows\$hf_mig$\KB956390\SP2QFE\wininet.dll

[-] 2008-08-20 . C5326257F4FEE83E24B06CD4BC08EBA2 . 671744 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3GDR\wininet.dll

[-] 2008-08-20 . 503D9BE987B9A3964816FED082F45771 . 672256 . . [6.00.2900.5659] . . c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll

[-] 2008-06-23 . 878F506D7F69E06BCCDC86C2A4D17633 . 672768 . . [6.00.2900.3395] . . c:\windows\$hf_mig$\KB953838\SP2QFE\wininet.dll

[-] 2008-06-23 . 1B540E19ADC30A53C8410DCBBAB1EF53 . 665088 . . [6.00.2900.3395] . . c:\windows\$NtUninstallKB956390$\wininet.dll

[-] 2008-06-23 . 978542595CF09A86E2EF60552A35C937 . 671744 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3GDR\wininet.dll

[-] 2008-06-23 . 6432638B5CE374D912C0C4F2A9F03DAE . 672256 . . [6.00.2900.5626] . . c:\windows\$hf_mig$\KB953838\SP3QFE\wininet.dll

[-] 2008-04-21 . FBED32C104BD9410E2DA2D3AC1CE4008 . 665088 . . [6.00.2900.3354] . . c:\windows\$NtUninstallKB953838$\wininet.dll

[-] 2008-04-21 . 018ADED93507A4AEA4F55741863DBC9E . 672256 . . [6.00.2900.3354] . . c:\windows\$hf_mig$\KB950759\SP2QFE\wininet.dll

[-] 2008-04-21 . 11D26D87E041000EA4C0128CD0010F7A . 671744 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3GDR\wininet.dll

[-] 2008-04-21 . 645A4A4884EB5EB8453C01531FCBEC3A . 672256 . . [6.00.2900.5583] . . c:\windows\$hf_mig$\KB950759\SP3QFE\wininet.dll

[-] 2008-04-14 . B4AEE98A48917B274FACFB78BBE0BC84 . 671744 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\wininet.dll

[-] 2008-02-16 . 6C49192217DF0509BC6A576535545529 . 671744 . . [6.00.2900.3314] . . c:\windows\$hf_mig$\KB947864\SP2QFE\wininet.dll

[-] 2008-02-16 . 34B6EE86F286B2595539E1617962256D . 665088 . . [6.00.2900.3314] . . c:\windows\$NtUninstallKB950759$\wininet.dll

[-] 2007-12-07 . 84E9262ED72810CFF255BEFD188D4038 . 665088 . . [6.00.2900.3268] . . c:\windows\$NtUninstallKB947864$\wininet.dll

[-] 2007-12-07 . 273F4B37B80C8D398713A88B788FE59B . 671744 . . [6.00.2900.3268] . . c:\windows\$hf_mig$\KB944533\SP2QFE\wininet.dll

[-] 2007-10-11 . DC532B5BD08E02DF13C9F166D0F4F73B . 665088 . . [6.00.2900.3231] . . c:\windows\$NtUninstallKB944533$\wininet.dll

[-] 2007-10-11 . 6BE2CDDC28610D9E73E54678A131B253 . 671744 . . [6.00.2900.3231] . . c:\windows\$hf_mig$\KB942615\SP2QFE\wininet.dll

[-] 2007-08-22 . 8D3CCA79F45918F6164B5BE5A3364B19 . 664576 . . [6.00.2900.3199] . . c:\windows\$NtUninstallKB942615$\wininet.dll

[-] 2007-08-22 . D6140D5095E62BD609DF3201C7B854AC . 671232 . . [6.00.2900.3199] . . c:\windows\$hf_mig$\KB939653\SP2QFE\wininet.dll

[-] 2004-08-03 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB939653$\wininet.dll

[-] 2004-08-03 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2gdr\wininet.dll

[-] 2004-08-03 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . c:\windows\SoftwareDistribution\Download\49614e7ab3df7743b69cfa71be971b93\backup\sp2qfe\wininet.dll

.

[-] 2008-04-14 . 6A35E2D6F5F052C84EC2CEB296389439 . 82432 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ws2_32.dll

[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll

[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll

.

[-] 2008-04-14 . C7D8A0517CBF16B84F657DE87EBE9D4B . 19968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ws2help.dll

[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll

[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2help.dll

.

[-] 2008-04-14 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\explorer.exe

[-] 2007-06-13 . 64D320C0E301EEDC5A4ADBBDC5024F7F . 1036288 . . [6.00.2900.3156] . . c:\windows\explorer.exe

[-] 2007-06-13 . 64D320C0E301EEDC5A4ADBBDC5024F7F . 1036288 . . [6.00.2900.3156] . . c:\windows\system32\dllcache\explorer.exe

[-] 2007-06-13 . 331ED93570BAF3CFE30340298762CD56 . 1036288 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

[-] 2004-08-03 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

.

[-] 2008-04-14 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\regedit.exe

[-] 2004-08-03 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\regedit.exe

[-] 2004-08-03 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regedit.exe

.

[-] 2008-04-14 . E08D638BA3D3DD6DF6E31216AB66AE0B . 1287680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ole32.dll

[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\ole32.dll

[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\dllcache\ole32.dll

[-] 2005-07-26 . 24EDF93FD04CA1A98D32F092DD4F9953 . 1286144 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll

[-] 2005-04-28 . D3653209882B5645223B1EA958EEE3A6 . 1286656 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll

[-] 2005-04-28 . 9752FA23CE81D3A2BD2125F40C24A723 . 1285120 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\ole32.dll

[-] 2004-08-03 . D700449AD3045E81680C25A79620A171 . 1281536 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\ole32.dll

.

[-] 2008-04-14 . 052F968390A85D37D5EE8BE3AB2A83A2 . 406016 . . [1.0420.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\usp10.dll

[-] 2004-08-03 . E4E40EAFF464EBE7752BAD3D82AF1715 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\usp10.dll

[-] 2004-08-03 . E4E40EAFF464EBE7752BAD3D82AF1715 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\dllcache\usp10.dll

.

[-] 2008-04-14 . 671ABB33C712B1585A5BF7ADD36AD96E . 4096 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ksuser.dll

[-] 2004-08-03 . 4721744CE11F385073F6F9F7831752C7 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ksuser.dll

[-] 2004-08-03 . 4721744CE11F385073F6F9F7831752C7 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\ksuser.dll

[-] 2004-08-03 . 4721744CE11F385073F6F9F7831752C7 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\ksuser.dll

.

[-] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-04-14 . EDAFBE25FB6480CE68F688BA691890DC . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\wscntfy.exe

[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe

[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe

.

[-] 2008-04-14 . 0ADA34871A2E1CD2CAAFED1237A47750 . 129024 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\xmlprov.dll

[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll

[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll

.

[-] 2008-04-14 . 04955AA695448C181B367D964AF158AA . 56320 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll

[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll

[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll

.

[-] 2008-04-14 . 5251425B86EA4A3532B8BB8D14044E61 . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\sfcfiles.dll

[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll

.

[-] 2008-04-14 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ctfmon.exe

[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe

[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe

.

[-] 2008-04-14 . 40602EBFBE06AA075C8E4560743F6883 . 135168 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\shsvcs.dll

[-] 2006-12-19 . 521A4CB71CC419FDF60DB83E7308AE2B . 135168 . . [6.00.2900.3051] . . c:\windows\system32\shsvcs.dll

[-] 2006-12-19 . 521A4CB71CC419FDF60DB83E7308AE2B . 135168 . . [6.00.2900.3051] . . c:\windows\system32\dllcache\shsvcs.dll

[-] 2006-12-19 . B5B37E7C51A551F60A1254E63C878FA9 . 135680 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll

[-] 2004-08-03 . BAC5F7F0C2B8C1B9832594851E0F9914 . 135168 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll

.

[-] 2008-04-14 . E4CD1F3D84E1C2CA0B8CF7501E201593 . 59904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\regsvc.dll

[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll

[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll

.

[-] 2008-04-14 . A050194A44D7FA8D7186ED2F4E8367AE . 193536 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\schedsvc.dll

[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll

[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll

.

[-] 2008-04-14 . 4DF5B05DFAEC29E13E1ED6F6EE12C500 . 71680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ssdpsrv.dll

[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll

[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll

.

[-] 2008-04-14 . B7DE02C863D8F5A005A7BF375375A6A4 . 297472 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\termsrv.dll

[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll

[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll

.

[-] 2008-04-14 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\hnetcfg.dll

[-] 2004-08-03 . AE93E415220A4C0112768A0DEE36D28D . 348672 . . [5.1.2600.2180] . . c:\windows\system32\hnetcfg.dll

[-] 2004-08-03 . AE93E415220A4C0112768A0DEE36D28D . 348672 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\hnetcfg.dll

.

[-] 2008-04-14 . D45960BE52C3C610D361977057F98C54 . 175616 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\appmgmts.dll

[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll

[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll

.

[-] 2001-08-23 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

.

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\aec.sys

[-] 2006-02-15 00:30 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\$hf_mig$\KB900485\SP2QFE\aec.sys

[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\Driver Cache\i386\aec.sys

[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\dllcache\aec.sys

[-] 2006-02-15 00:22 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\drivers\aec.sys

[-] 2004-08-03 20:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtUninstallKB900485$\aec.sys

.

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ip6fw.sys

[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys

[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

.

[-] 2008-04-14 02:22 . ACC19BA6876AF18768EE87931CAD14E2 . 927504 . . [4.1.0.61] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mfc40u.dll

[-] 2006-11-01 19:17 . B80F1D82969BD31392F1867936E96448 . 927504 . . [4.1.0.61] . . c:\windows\system32\mfc40u.dll

[-] 2006-11-01 19:17 . B80F1D82969BD31392F1867936E96448 . 927504 . . [4.1.0.61] . . c:\windows\system32\dllcache\mfc40u.dll

[-] 2001-08-23 12:00 . 31DD27AB47F62D383505F35CA972748B . 924432 . . [4.1.6140] . . c:\windows\$NtUninstallKB924667$\mfc40u.dll

.

[-] 2008-04-14 . B7550A7107281D170CE85524B1488C98 . 33792 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\msgsvc.dll

[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll

[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll

.

[-] 2008-04-14 02:22 . 6E18978B749F0696A774DE3F2CB142DD . 52736 . . [9.0.1.56] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\mspmsnsv.dll

[-] 2004-08-03 22:57 . D68CC4EBF7B03FD770D5962295AD814E . 52736 . . [9.0.1.56] . . c:\windows\system32\mspmsnsv.dll

[-] 2004-08-03 22:57 . D68CC4EBF7B03FD770D5962295AD814E . 52736 . . [9.0.1.56] . . c:\windows\system32\dllcache\mspmsnsv.dll

.

[-] 2010-02-17 . FEDB0FDF1FE02ECC7A823A690175B876 . 2066048 . . [5.1.2600.3670] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe

[-] 2010-02-17 . FEDB0FDF1FE02ECC7A823A690175B876 . 2066048 . . [5.1.2600.3670] . . c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2010-02-16 . 4854CB137C17525E5FEA0AA1B4438880 . 2024448 . . [5.1.2600.3670] . . c:\windows\system32\ntkrnlpa.exe

[-] 2010-02-16 . 9F24D01B6027FED0423FD28F1055E3DD . 2069120 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntkrnlpa.exe

[-] 2010-02-16 . CEE28C8C47E52F185F9F8F3A2E31880C . 2069248 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntkrnlpa.exe

[-] 2009-12-09 . 2E72317A93EF61138E43DCF7CD423EDF . 2068480 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntkrnlpa.exe

[-] 2009-12-09 . 39F1FED7491AC4A659917BE1DB151344 . 2023424 . . [5.1.2600.3654] . . c:\windows\$NtUninstallKB979683$\ntkrnlpa.exe

[-] 2009-12-09 . ADB6D671931D876CD7D53A5E2C147DBB . 2068352 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3GDR\ntkrnlpa.exe

[-] 2009-08-04 . C50ED62BB5CDC5AD4F3985ED39C6AE87 . 2068480 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe

[-] 2009-08-04 . 602A85B23E5D9E6402D7205AFBE6FEB4 . 2068352 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3GDR\ntkrnlpa.exe

[-] 2009-08-04 . 7C9540461F095497E0F0696092569C87 . 2023424 . . [5.1.2600.3610] . . c:\windows\$NtUninstallKB977165$\ntkrnlpa.exe

[-] 2009-02-10 . 321917CFF934663C48C1E91A930E5D71 . 2068352 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe

[-] 2009-02-09 . 4DAA5039B88A46B90FD34D8F89DE3AF9 . 2023424 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB971486$\ntkrnlpa.exe

[-] 2009-02-09 . 1F9DA92672B8B5720C5FB1E87D8F249F . 2068480 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe

[-] 2008-08-14 . C789B5AEA9AB71C5BEF6DD568F744842 . 2068352 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe

[-] 2008-08-14 . A13D8649ECBF1445B0B0DE569EE04609 . 2018304 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe

[-] 2008-08-14 . 8F54D426024BC7E45A6F32253BBB572E . 2065280 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe

[-] 2008-08-14 . 326C258774EB791E78FEA8A9E14D5C3E . 2068352 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe

[-] 2008-04-14 . E51980EF65CED4490A7395A06C08DA34 . 2068224 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntkrnlpa.exe

[-] 2007-02-28 . 9B9CA27AD315C02B71510238574894B2 . 2061696 . . [5.1.2600.3093] . . c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe

[-] 2007-02-28 . 9DC58C5BDEDCCB8298C8A2D6D4996EC4 . 2018304 . . [5.1.2600.3093] . . c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe

[-] 2005-03-02 . AE8364004BBFD70461D2EF34888D3360 . 2059264 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe

[-] 2005-03-02 . A3724446ACB9DE8D890CFABD146CD0AD . 2017792 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe

[-] 2004-08-03 . F8D35488D41B19A306A454FFC0ED0336 . 2017792 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe

.

[-] 2008-04-14 02:22 . 56AF4064996FA5BAC9C449B1514B4770 . 438272 . . [5.1.2400.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntmssvc.dll

[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll

[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll

.

[-] 2008-04-14 . 1DFD8975D8C89214B98D9387C1125B49 . 186880 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\upnphost.dll

[-] 2007-02-05 . 5C686B95470AC24E133AB4DAC4639A6C . 185856 . . [5.1.2600.3077] . . c:\windows\$hf_mig$\KB931261\SP2QFE\upnphost.dll

[-] 2007-02-05 . 855790C1BACED245A6B210AF430ED17B . 185856 . . [5.1.2600.3077] . . c:\windows\system32\upnphost.dll

[-] 2007-02-05 . 855790C1BACED245A6B210AF430ED17B . 185856 . . [5.1.2600.3077] . . c:\windows\system32\dllcache\upnphost.dll

[-] 2004-08-03 . 09D4A2D7C5A8ABEC227D118765FAADDF . 185856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB931261$\upnphost.dll

.

[-] 2008-04-14 . 9236E736EDB57BE7D1EF6274410E3BAC . 367616 . . [5.3.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\dsound.dll

[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll

[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll

.

[-] 2008-04-14 . 36969CF86E51EC8ED202B40F2FA80AA6 . 1689088 . . [5.03.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\d3d9.dll

[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\d3d9.dll

[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\d3d9.dll

.

[-] 2008-04-14 . 4A37188B83B00DD9CFBA049687AD0DAF . 279552 . . [5.03.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ddraw.dll

[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll

[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\ddraw.dll

.

[-] 2008-04-14 02:22 . 5D7F5A46975D2E59A6FECB6C231D200F . 84992 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\olepro32.dll

[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll

[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\olepro32.dll

.

[-] 2008-04-14 . C47FD93010649AC0D79022D9B69ADBE4 . 41984 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\perfctrs.dll

[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll

[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\perfctrs.dll

.

[-] 2008-04-14 . F86000634319F71535BCE6B06995EE99 . 18944 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\version.dll

[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll

[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\version.dll

.

[-] 2008-04-14 . 3BFE49B4CDFAC83B0F3C79412895A179 . 93184 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\iexplore.exe

[-] 2004-08-03 . B39A6AF04A431E317C85BF061719E705 . 93184 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\iexplore.exe

.

[-] 2010-02-17 . 786F98EFD090AD93F03E3BD95FB68714 . 2192256 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3GDR\ntoskrnl.exe

[-] 2010-02-16 . B76CEA13602DC99EE0E655E4798C24AA . 2189184 . . [5.1.2600.3670] . . c:\windows\Driver Cache\i386\ntoskrnl.exe

[-] 2010-02-16 . B76CEA13602DC99EE0E655E4798C24AA . 2189184 . . [5.1.2600.3670] . . c:\windows\system32\dllcache\ntoskrnl.exe

[-] 2010-02-16 . C5E80D6BD860BB6180E1F89FA3E48136 . 2146304 . . [5.1.2600.3670] . . c:\windows\system32\ntoskrnl.exe

[-] 2010-02-16 . 4456016C2FF1A8CCCAC8309C9B76E2F5 . 2192384 . . [5.1.2600.5938] . . c:\windows\$hf_mig$\KB979683\SP3QFE\ntoskrnl.exe

[-] 2009-12-09 . A97847B2D30F4A299B35239D26BAD948 . 2191616 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3QFE\ntoskrnl.exe

[-] 2009-12-09 . 43EFD54785807AD9F1EF94AE3F0179CF . 2145280 . . [5.1.2600.3654] . . c:\windows\$NtUninstallKB979683$\ntoskrnl.exe

[-] 2009-12-09 . F71185C58C105BDB2BE1AEEAF4198F6E . 2191488 . . [5.1.2600.5913] . . c:\windows\$hf_mig$\KB977165\SP3GDR\ntoskrnl.exe

[-] 2009-08-04 . 121AEDCE2F5A65D63C9D51B9198FA7B3 . 2191488 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3GDR\ntoskrnl.exe

[-] 2009-08-04 . 4B86421F2D85D9A4ECB06885C40B8EEB . 2191616 . . [5.1.2600.5857] . . c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe

[-] 2009-08-04 . 1C1535EF3A07A3B23001BE1072E63B3B . 2145280 . . [5.1.2600.3610] . . c:\windows\$NtUninstallKB977165$\ntoskrnl.exe

[-] 2009-02-10 . D3453310FC92736E674FFDC6E3F455B7 . 2191488 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe

[-] 2009-02-09 . EA9A7CCE036D7F4121191CE903584F09 . 2145280 . . [5.1.2600.3520] . . c:\windows\$NtUninstallKB971486$\ntoskrnl.exe

[-] 2009-02-09 . FEE1600B76B196D9993CD468DA7524F7 . 2191360 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe

[-] 2008-08-14 . 59282EFE7147C011530E51FF92BA86AC . 2191488 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe

[-] 2008-08-14 . 04876E6755E505B76CE1BBB7816B1BF4 . 2138624 . . [5.1.2600.3427] . . c:\windows\$NtUninstallKB956572$\ntoskrnl.exe

[-] 2008-08-14 . C7153F3F41C63C8CB912E973F2780495 . 2188288 . . [5.1.2600.3427] . . c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe

[-] 2008-08-14 . 934FBEA25F8DE017ABFC6169B8446D94 . 2191488 . . [5.1.2600.5657] . . c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe

[-] 2008-04-14 . 354C9291513BCE4D0ED6B0C6A15470F8 . 2191360 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\ntoskrnl.exe

[-] 2007-02-28 . E1DE7A10D46959560C3B617227D95C19 . 2184448 . . [5.1.2600.3093] . . c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe

[-] 2007-02-28 . 495D541A116E7F1B79ED9BD588F54A71 . 2138624 . . [5.1.2600.3093] . . c:\windows\$NtUninstallKB956841$\ntoskrnl.exe

[-] 2005-03-02 . EB5538A452E0E99169E2B6CDB62FF9D2 . 2181888 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe

[-] 2005-03-02 . 3DDC2BC3D32B2FC505D09B8B8974D5BB . 2138112 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB931784$\ntoskrnl.exe

[-] 2004-08-03 . C3EC5DD56E3EB15D80AF9FCEE030CABD . 2150912 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\ntoskrnl.exe

.

[-] 2008-04-14 . FE77A85495065F3AD59C5C65B6C54182 . 171520 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll

[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-04-14 . 7B353059E665F8B7AD2BBEAEF597CF45 . 177152 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\w32time.dll

[-] 2004-08-03 . C6D874CD2A5B83CD11CDEBD28A638584 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\w32time.dll

[-] 2004-08-03 . C6D874CD2A5B83CD11CDEBD28A638584 . 176640 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\w32time.dll

.

[-] 2008-04-14 . BC2C5985611C5356B24AEB370953DED9 . 334336 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\wiaservc.dll

[-] 2006-12-19 . 452AA1C0E7FEE4B2E78D32BCF36FCEBE . 334336 . . [5.1.2600.3051] . . c:\windows\$hf_mig$\KB927802\SP2QFE\wiaservc.dll

[-] 2006-12-19 . 25E9B30AF1FA1B9AF1853577F39FF20B . 334336 . . [5.1.2600.3051] . . c:\windows\system32\wiaservc.dll

[-] 2006-12-19 . 25E9B30AF1FA1B9AF1853577F39FF20B . 334336 . . [5.1.2600.3051] . . c:\windows\system32\dllcache\wiaservc.dll

[-] 2004-08-03 . 7E751068ADA60FC77638622E86A7CD9E . 333824 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB927802$\wiaservc.dll

.

[-] 2008-04-14 . 2CF969B9BF1EF069075DCDCE309FAAE1 . 18944 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\midimap.dll

[-] 2004-08-03 . 32641AE4D340C1AC2D9B3A3BD71F5C47 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\midimap.dll

[-] 2004-08-03 . 32641AE4D340C1AC2D9B3A3BD71F5C47 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\midimap.dll

.

[-] 2008-04-14 . 469FED8597896DB77B49384BE90E2E0A . 7680 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\rasadhlp.dll

[-] 2006-06-26 . 45F87F6E7AB4F79B5C719B78C289DB66 . 7680 . . [5.1.2600.2938] . . c:\windows\$hf_mig$\KB920683\SP2QFE\rasadhlp.dll

[-] 2006-06-26 . DC940E8932827D65180F6A71BD4BD878 . 8192 . . [5.1.2600.2938] . . c:\windows\system32\rasadhlp.dll

[-] 2006-06-26 . DC940E8932827D65180F6A71BD4BD878 . 8192 . . [5.1.2600.2938] . . c:\windows\system32\dllcache\rasadhlp.dll

[-] 2004-08-03 . 84028E2EBE7A25494766673A5FF4B304 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB920683$\rasadhlp.dll

.

(((((((((((((((((((((((((((((   SnapShot@2011-10-20_12.46.25   )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-10-25 05:31 . 2011-10-25 05:31        16384              c:\windows\Temp\Perflib_Perfdata_728.dat

+ 2004-08-04 00:37 . 2004-08-03 22:37        23552              c:\windows\system32\drivers\mouclass.sys

- 2004-08-04 00:37 . 2004-08-03 23:10        23552              c:\windows\system32\drivers\mouclass.sys

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952]

"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2005-05-21 925696]

"TrueImageMonitor.exe"="c:\programme\Acronis\TrueImageEnterpriseServer\TrueImageMonitor.exe" [2006-06-20 1106422]

"AcronisTimounterMonitor"="c:\programme\Acronis\TrueImageEnterpriseServer\TimounterMonitor.exe" [2006-06-20 1848150]

"Acronis Scheduler2 Service"="c:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" [2006-06-20 126976]

"NeroFilterCheck"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-03-22 8425472]

"nwiz"="nwiz.exe" [2007-03-22 1622016]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-03-22 81920]

"NGTray"="c:\programme\Symantec\Ghost\ngtray.exe" [2006-12-04 222856]

"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2007-06-26 312320]

"Control Center"="c:\programme\Digitus\MFP Server Control Center\Control Center.exe" [2007-04-04 5543424]

"EEventManager"="c:\programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2004-08-05 118784]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"Update-Tool"="c:\programme\OPEN-XCHANGE\OXlook\UpdateTool.exe" [2007-09-06 761096]

"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

.

c:\dokumente und einstellungen\k.arnts\Startmenü\Programme\Autostart\

OpenOffice.org 2.3.lnk - c:\programme\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]

.

c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\

Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2009-4-20 295606]

Adobe Reader Synchronizer.lnk - c:\programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1116\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1116\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1116\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1118\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1118\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1118\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1121\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1121\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1121\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1129\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1129\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1129\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1147\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1147\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1147\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1148\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1148\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-1148\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-2608\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-2608\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-2608\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-500\Scripts\Logoff\0\0]

"Script"=firefox_logout.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-500\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1046382145-4157110220-636751702-500\Scripts\Logon\0\1]

"Script"=firefox_login.vbs

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1578240273-668469433-1050887974-500\Scripts\Logon\0\0]

"Script"=login.bat

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Programme\\Acronis\\TrueImageEnterpriseServer\\TrueImage.exe"=

"c:\\WINDOWS\\system32\\javaw.exe"=

"c:\\Programme\\Symantec\\Ghost\\ngctw32.exe"=

"c:\\Programme\\Digitus\\MFP Server Control Center\\Control Center.exe"=

.

R0 IPGXII;IPGXII;c:\windows\system32\drivers\IPFD1286.sys [09.02.2009 14:32 62528]

R2 AntiVirMailService;Avira AntiVir MailGuard;c:\programme\Avira\AntiVir Desktop\avmailc.exe [26.05.2009 11:16 340136]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [26.05.2009 11:16 136360]

R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [26.05.2009 11:16 428200]

R2 NGCLIENT;Symantec Ghost Client Agent;c:\programme\Symantec\Ghost\ngctw32.exe [04.12.2006 15:32 632456]

R3 KUSBusByTCPMasterBus;Master Bus of Kernel USB Software Bus by TCP;c:\windows\system32\drivers\KUSBusByTCPMasterBus.sys [13.03.2007 18:15 52352]

S3 KUSBusByTCP;%KUSBusByUSB.SvcDesc%;c:\windows\system32\drivers\KUSBusByTCP.sys [13.03.2007 18:15 77312]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyServer = 192.168.2.110:8100

uInternet Settings,ProxyOverride = 192.168.2.251;<local>

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll

TCP: Interfaces\{9B7F5306-BC2A-45FB-873A-C7BAAC963708}: NameServer = 192.168.2.250,192.168.2.252

FF - ProfilePath - c:\dokumente und einstellungen\Administrator.AWT\Anwendungsdaten\Mozilla\Firefox\Profiles\1nc1d3r.default\

FF - prefs.js: network.proxy.type - 0

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-10-25 12:30

Windows 5.1.2600 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]

"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\ð•€|ÿÿÿÿ.•€|ù•6~*]

"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(752)

c:\programme\Avira\AntiVir Desktop\avsda.dll

.

- - - - - - - > 'lsass.exe'(808)

c:\programme\Avira\AntiVir Desktop\avsda.dll

c:\programme\Bonjour\mdnsNSP.dll

.

Zeit der Fertigstellung: 2011-10-25  12:33:14

ComboFix-quarantined-files.txt  2011-10-25 10:33

ComboFix2.txt  2011-10-20 12:51

.

Vor Suchlauf: 10 Verzeichnis(se), 78.338.678.784 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 78.327.148.544 Bytes frei

.

- - End Of File - - 9F658E91C406EFB82DECFDC6705FD54C

--- --- ---

Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner Quarantine in C:\Qoobox in eine Datei zippen
3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten