hi erstmal
ich habe ein großes problem
gestern ging mein antivirus nich und als ich mein pc heute gestartet hatte kam fservice.exe konnte nicht gefunden werden..
danach startete ich ihn nochmal neu und aufeinmal kamm kein desktop mehr

programme führ ich jetzt nur noch über taskmanager>>datei>>neuer task (ausführen)
hier die logfile

Code: Alles auswählen

Logfile of HijackThis v1.99.1
Scan saved at 12:23:59, on 23.07.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\T-Online\Dialerschutz-Software\DFInject.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\r_server.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\Besitzer\LOKALE~1\Temp\Rar$EX00.906\HijackThis.exe
C:\DOKUME~1\Besitzer\LOKALE~1\Temp\Rar$EX00.375\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tchibo.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 212.35.114.108:8080
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=C:\WINDOWS\system32\fservice.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [T-Online Dialerschutz-Software] "C:\Programme\T-Online\Dialerschutz-Software\defender.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [mmtask] "C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programme\LogMeIn\LogMeInSystray.exe"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: &Google-Suche - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://C:\Programme\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tchibo.de/
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122370968843
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://god.t-online.de/download/ExentCtl.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1122374262984
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37710.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://arcade.icq.com/online2/bejeweled2/popcaploader_v6.cab
O16 - DPF: {F11BFF96-CC7A-4482-819B-91EAE4C454EF} (NTR ActiveX 1.1.6) - http://www.inquiero.com/inquiero/mod/setup/ntractivex116_6.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: LMIinit - LMIinit.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Dialerschutz Dienst (DFSVC) - Unknown owner - C:\Programme\T-Online\Dialerschutz-Software\DFInject.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



Hallöchen,

lässt sich dein Rechner denn noch im abgesicherten Modus starten? Wenn ja, dann könnte man ja von dort aus Reparaturversuche starten...

also habs ma probiert denk es geht aber wenn ich mich mit meim bentuzerkonto angemeldet hab (im abgesicherten) sieht der bildschirm so aus


aber taskmanager geht
ich hab jetzt auch rausgefunden wie ma arbeitsplatz mit taskmanager aufrufen kann sonst hätt ich des bild net uploaden können
und was jetz?
mfg

poste das log von winpfind
http://virus-protect.org/winpfind.html

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=C:\WINDOWS\system32\fservice.exe

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
UPX! 24.04.2006 17:30:04 65536 C:\WINDOWS\IFinst27.exe

Checking %System% folder...
aspack 18.03.2005 18:19:58 2337488 C:\WINDOWS\SYSTEM32\d3dx9_25.dll
aspack 26.05.2005 15:34:52 2297552 C:\WINDOWS\SYSTEM32\d3dx9_26.dll
aspack 22.07.2005 19:59:04 2319568 C:\WINDOWS\SYSTEM32\d3dx9_27.dll
aspack 05.12.2005 18:09:18 2323664 C:\WINDOWS\SYSTEM32\d3dx9_28.dll
aspack 03.02.2006 08:43:16 2332368 C:\WINDOWS\SYSTEM32\d3dx9_29.dll
PEC2 04.08.2004 14:00:00 41118 C:\WINDOWS\SYSTEM32\dfrg.msc
UPX! 22.07.2006 21:51:14 37124 C:\WINDOWS\SYSTEM32\imsn.exe
PTech 14.02.2006 09:20:14 550120 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL
aspack 07.07.2006 03:21:46 6757792 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 04.08.2004 14:00:00 733696 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 04.08.2004 14:00:00 686592 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 04.08.2004 14:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
23.07.2006 13:43:02 S 2048 C:\WINDOWS\bootstat.dat
25.06.2006 15:39:20 H 54156 C:\WINDOWS\QTFont.qfn
13.07.2006 21:08:48 RH 0 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index55.dat
13.07.2006 21:08:50 RH 0 C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\index56.dat
09.07.2006 14:13:20 H 0 C:\WINDOWS\LastGood\INF\oem10.inf
09.07.2006 14:13:20 H 0 C:\WINDOWS\LastGood\INF\oem10.PNF
12.07.2006 21:16:28 H 0 C:\WINDOWS\LastGood\INF\oem11.inf
12.07.2006 21:16:28 H 0 C:\WINDOWS\LastGood\INF\oem11.PNF
27.05.2006 17:34:48 H 0 C:\WINDOWS\LastGood\INF\oem7.inf
27.05.2006 17:34:48 H 0 C:\WINDOWS\LastGood\INF\oem7.PNF
14.06.2006 13:38:10 H 0 C:\WINDOWS\LastGood\INF\oem8.inf
14.06.2006 13:38:10 H 0 C:\WINDOWS\LastGood\INF\oem8.PNF
06.07.2006 16:33:26 H 0 C:\WINDOWS\LastGood\INF\oem9.inf
06.07.2006 16:33:26 H 0 C:\WINDOWS\LastGood\INF\oem9.PNF
16.07.2006 11:42:10 H 4212 C:\WINDOWS\system32\zllictbl.dat
29.05.2006 18:16:04 S 23751 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB916281.cat
01.06.2006 22:28:44 S 11043 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB918439.cat
23.07.2006 13:43:42 H 94208 C:\WINDOWS\system32\config\default.LOG
23.07.2006 13:43:10 H 1024 C:\WINDOWS\system32\config\SAM.LOG
23.07.2006 13:43:04 H 16384 C:\WINDOWS\system32\config\SECURITY.LOG
23.07.2006 14:06:00 H 274432 C:\WINDOWS\system32\config\software.LOG
23.07.2006 13:44:28 H 270336 C:\WINDOWS\system32\config\system.LOG
13.07.2006 12:52:36 H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG
26.06.2006 20:45:06 H 0 C:\WINDOWS\system32\drivers\umdf\MsftWdf_user_01_00_00.Wdf
09.07.2006 14:13:16 HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\a80b4761-f985-4330-991a-b38656b8ca04
09.07.2006 14:13:16 HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\Preferred

Checking for CPL files...
Microsoft Corporation 04.08.2004 14:00:00 70656 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 04.08.2004 14:00:00 555008 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 04.08.2004 14:00:00 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 04.08.2004 14:00:00 138240 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 04.08.2004 14:00:00 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 04.08.2004 14:00:00 157184 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Microsoft Corporation 04.08.2004 14:00:00 359424 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 04.08.2004 14:00:00 133120 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 04.08.2004 14:00:00 381440 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 04.08.2004 14:00:00 69632 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems, Inc. 10.11.2005 14:03:50 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 04.08.2004 14:00:00 189440 C:\WINDOWS\SYSTEM32\main.cpl
Microsoft Corporation 04.08.2004 14:00:00 625152 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 04.08.2004 14:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 04.08.2004 14:00:00 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 04.08.2004 14:00:00 260096 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 04.08.2004 14:00:00 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Sun Microsystems 28.05.2005 20:42:20 45175 C:\WINDOWS\SYSTEM32\plugincpl131_16.cpl
Microsoft Corporation 04.08.2004 14:00:00 117248 C:\WINDOWS\SYSTEM32\powercfg.cpl
Intersil Americas Inc. 14.01.2004 17:09:56 313418 C:\WINDOWS\SYSTEM32\PRISMCFG.cpl
Microsoft Corporation 04.08.2004 14:00:00 303104 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 04.08.2004 14:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 04.08.2004 14:00:00 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 04.08.2004 14:00:00 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 26.05.2005 04:16:22 174872 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 04.08.2004 14:00:00 70656 C:\WINDOWS\SYSTEM32\dllcache\access.cpl
Microsoft Corporation 04.08.2004 14:00:00 555008 C:\WINDOWS\SYSTEM32\dllcache\appwiz.cpl
Microsoft Corporation 04.08.2004 14:00:00 138240 C:\WINDOWS\SYSTEM32\dllcache\desk.cpl
Microsoft Corporation 04.08.2004 14:00:00 80384 C:\WINDOWS\SYSTEM32\dllcache\firewall.cpl
Microsoft Corporation 04.08.2004 14:00:00 157184 C:\WINDOWS\SYSTEM32\dllcache\hdwwiz.cpl
Microsoft Corporation 04.08.2004 14:00:00 359424 C:\WINDOWS\SYSTEM32\dllcache\inetcpl.cpl
Microsoft Corporation 04.08.2004 14:00:00 133120 C:\WINDOWS\SYSTEM32\dllcache\intl.cpl
Microsoft Corporation 04.08.2004 14:00:00 69632 C:\WINDOWS\SYSTEM32\dllcache\joy.cpl
Microsoft Corporation 04.08.2004 14:00:00 189440 C:\WINDOWS\SYSTEM32\dllcache\main.cpl
Microsoft Corporation 04.08.2004 14:00:00 625152 C:\WINDOWS\SYSTEM32\dllcache\mmsys.cpl
Microsoft Corporation 04.08.2004 14:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
Microsoft Corporation 04.08.2004 14:00:00 25600 C:\WINDOWS\SYSTEM32\dllcache\netsetup.cpl
Microsoft Corporation 04.08.2004 14:00:00 260096 C:\WINDOWS\SYSTEM32\dllcache\nusrmgr.cpl
Microsoft Corporation 04.08.2004 14:00:00 32768 C:\WINDOWS\SYSTEM32\dllcache\odbccp32.cpl
Microsoft Corporation 04.08.2004 14:00:00 117248 C:\WINDOWS\SYSTEM32\dllcache\powercfg.cpl
Microsoft Corporation 04.08.2004 14:00:00 159744 C:\WINDOWS\SYSTEM32\dllcache\sapi.cpl
Microsoft Corporation 04.08.2004 14:00:00 303104 C:\WINDOWS\SYSTEM32\dllcache\sysdm.cpl
Microsoft Corporation 04.08.2004 14:00:00 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl
Microsoft Corporation 04.08.2004 14:00:00 94208 C:\WINDOWS\SYSTEM32\dllcache\timedate.cpl
Microsoft Corporation 04.08.2004 14:00:00 148480 C:\WINDOWS\SYSTEM32\dllcache\wscui.cpl
Microsoft Corporation 26.05.2005 04:16:22 174872 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
16.06.2005 17:14:20 HS 84 C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

Checking files in %ALLUSERSPROFILE%\Application Data folder...
09.02.2006 20:41:54 305 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
16.06.2005 18:07:58 HS 62 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\desktop.ini

Checking files in %USERPROFILE%\Startup folder...
16.06.2005 17:14:20 HS 84 C:\Dokumente und Einstellungen\Besitzer\Startmenü\Programme\Autostart\desktop.ini

Checking files in %USERPROFILE%\Application Data folder...
16.06.2005 18:07:58 HS 62 C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\desktop.ini
01.05.2006 16:34:50 2970 C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\wklnhst.dat

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\BriefcaseMenu
{85BBD920-42A0-1069-A2E4-08002B30309D} = syncui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Cryptext
=
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ICQLiteMenu
{73B24247-042E-4EF5-ADC2-42F62E6FD654} = C:\Programme\ICQLite\ICQLiteShell.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Shell Extension for Malware scanning
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} = C:\Programme\AntiVir PersonalEdition Classic\shlext.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programme\WinRAR\rarext.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\BriefcaseMenu
{85BBD920-42A0-1069-A2E4-08002B30309D} = syncui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Cryptext
=
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Shell Extension for Malware scanning
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} = C:\Programme\AntiVir PersonalEdition Classic\shlext.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programme\WinRAR\rarext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Cryptext
=
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ICQLiteMenu
{73B24247-042E-4EF5-ADC2-42F62E6FD654} = C:\Programme\ICQLite\ICQLiteShell.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programme\WinRAR\rarext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
= C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHlprObj Class = C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
SSVHelper Class = C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
Google Toolbar Helper = c:\programme\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tipps und Tricks = %SystemRoot%\system32\shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\programme\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java Konsole : C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}
ButtonText = Recherchieren :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B863453A-26C3-4e1f-A54D-A2CD196348E9}
ButtonText = ICQ Lite : C:\Programme\ICQLite\ICQLite.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = @C:\Programme\Messenger\Msgslang.dll,-61144 : C:\Programme\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Favorites Band = %SystemRoot%\system32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
History Band = %SystemRoot%\system32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer-Band = %SystemRoot%\system32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Adresse : %SystemRoot%\system32\browseui.dll
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = :
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\programme\google\googletoolbar1.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Adresse : %SystemRoot%\system32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\programme\google\googletoolbar1.dll
{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} = :
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = :
{00000000-5736-4205-0008-F7ED0776FB27} = :

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
AGRSMMSG AGRSMMSG.exe
ATIPTA C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
Dit Dit.exe
T-Online Dialerschutz-Software "C:\Programme\T-Online\Dialerschutz-Software\defender.exe"
avgnt "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
MimBoot C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
KernelFaultCheck %systemroot%\system32\dumprep 0 -k
Zone Labs Client "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
ICQ Lite "C:\Programme\ICQLite\ICQLite.exe" -minimize
Cmaudio RunDll32 cmicnfg.cpl,CMICtrlWnd
ATICCC "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
mmtask "C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe"
LogMeIn GUI "C:\Programme\LogMeIn\LogMeInSystray.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
ICQ Lite C:\Programme\ICQLite\ICQLite.exe -trayboot

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
system.ini 0
win.ini 0
bootini 0
services 0
startup 0


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoCDBurning 0
NoSharedDocuments 0
NoResolveTrack 1


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
DirectX For Microsoft® Windows C:\WINDOWS\system32\fservice.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
legalnoticecaption
legalnoticetext
undockwithoutlogon 1
ShutdownWithoutLogon 1
DontDisplayLastUserName 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145
NoFolderOptions 0
FoFileAssociate 0
StartMenuLogoff 0
NoShellSearchButton 0
NoRecentDocsMenu 0
NoUserNameInStartMenu 0
NoRecentDocsNetHood 0
NoLowDiskSpaceChecks 1
NoSimpleStartMenu 0
HideClock 0
NoTrayItemsDisplay 0
NoRecentDocsHistory 0
ClearRecentDocsOnExit 0
NoCDBurning 0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
DisableTaskMgr 0


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\system32\stobject.dll
WPDShServiceObj {AAA288BA-9A4C-45B0-95D7-94D524869DB5} = C:\WINDOWS\system32\WPDShServiceObj.dll
UPnPMonitor {e57ce738-33e8-4c51-8354-bb4de9d215d1} = C:\WINDOWS\system32\upnpui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = C:\WINDOWS\system32\fservice.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent
= Ati2evxx.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit
= LMIinit.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 23.07.2006 14:11:20

Gehe in die Registry
Start - Ausfuehren - regedit

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
DirectX For Microsoft® Windows C:\WINDOWS\system32\fservice.exe -> loeschen

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell = C:\WINDOWS\system32\fservice.exe -> loeschen

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Reg Services = "C:\WINDOWS\System32\ffservice.exe"-> loeschen

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
Windows Reg Services = "C:\WINDOWS\System32\ffservice.exe"-> loeschen

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\
Windows Reg Services = "C:\WINDOWS\System32\ffservice.exe"-> loeschen

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed
Components\{a75aed00-d7bf-11d1-9947-00c0Cf98bbc9}\-> loeschen
StubPath = "C:\\WINDOWS\\System32\\lservice.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr" <--loeschen

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

loeschen

NoSimpleStartMenu
NoTrayItemsDisplay

PC neustarten

**
poste das log vom Silenrunner
http://virus-protect.org/silentrunner.html

ich hab net alles gefunden gab manches net aber mei desktop geht wieder und die fehlermeldung kommt auch nimmer


"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"ICQ Lite" = "C:\Programme\ICQLite\ICQLite.exe -trayboot" ["ICQ Ltd."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AGRSMMSG" = "AGRSMMSG.exe" ["Agere Systems"]
"ATIPTA" = "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"Dit" = "Dit.exe" ["ICSI Technology Ltd."]
"T-Online Dialerschutz-Software" = ""C:\Programme\T-Online\Dialerschutz-Software\defender.exe"" ["T-Online International AG"]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"MimBoot" = "C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe" ["Musicmatch, Inc."]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" [MS]
"Zone Labs Client" = ""C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"]
"ICQ Lite" = ""C:\Programme\ICQLite\ICQLite.exe" -minimize" ["ICQ Ltd."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"ATICCC" = ""C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data]
"mmtask" = ""C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe"" ["Musicmatch Inc."]
"LogMeIn GUI" = ""C:\Programme\LogMeIn\LogMeInSystray.exe"" ["LogMeIn, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar1.dll" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universelle Plug & Play-Geräte"
-> {HKLM...CLSID} = "Universelle Plug & Play-Geräte"
\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {HKLM...CLSID} = "AlcoholShellEx"
\InProcServer32\(Default) = "C:\PROGRA~1\Alcohol Soft\Alcohol 120\AXShlEx.dll" ["Alcohol Soft Development Team"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook-Dateisymbolerweiterung"
\InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
-> {HKLM...CLSID} = "ShellLink for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
-> {HKLM...CLSID} = "Shell Icon Handler for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{35786D3C-B075-49b9-88DD-029876E11C01}" = "Portable Devices"
-> {HKLM...CLSID} = "Portable Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS]
"{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}" = "Portable Devices Menu"
-> {HKLM...CLSID} = "Portable Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
INFECTION WARNING! LMIinit\DLLName = "LMIinit.dll" [file not found]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar1.dll" ["Google Inc."]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar1.dll" ["Google Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar1.dll" ["Google Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Recherchieren"

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "@C:\Programme\Messenger\Msgslang.dll,-61144"
"MenuText" = "@C:\Programme\Messenger\Msgslang.dll,-61144"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.tchibo.de/

Missing lines (compared with English-language version):
[Strings]: 1 line


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Service, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["AVIRA GmbH"]
AntiVir Scheduler, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Dialerschutz Dienst, DFSVC, "C:\Programme\T-Online\Dialerschutz-Software\DFInject.exe" [null data]
Machine Debug Manager, MDM, ""C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Remote Administrator Service, r_server, ""C:\WINDOWS\system32\r_server.exe" /service" [empty string]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
LogMeIn Printer Port Monitor\Driver = "LMIport.dll" [file not found]
Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 24 seconds, including 2 seconds for message boxes)

weisst du, dass es einen
Remote Administrator Service, r_server, ""C:\WINDOWS\system32\r_server.exe" /service
auf deinem Rechner gibt ? Also jemand kann sich bei dir einloggen und hat Zugriff auf das System.

-----------------------------------------------------------------------------

multiavtool
http://virus-protect.org/multiavtool.html
klicke "3" - McAfee -- es erscheint ein leeres DOS-Fenster.

bei der Eingabe "3" im MULTIAVTOOL muss eine Internetverbindung vorhanden sein

- man muss eingeben, was gescannt werden soll
- C:\Windows\System32 -> dann beginnt der Scan, man sollte dann auch scannen lassen:
- C:\Windows
- C:\

* klicke "6 --> der PC wird neustarten --> suche die 3 Scanreporte in C:\AV-CLS

ja des mit dem remote weiß ich
ich habs entpackt auf c aber wenn ich auf Start Menu shortcut geh erscheintnur kurz ein dos fenster und verschwindet dan wieder

warum laedst du so etwas ? es ist immer ein Sicherheitsrisiko....
mache den virenscan und poste die reports

ja ich habs ja wieder runter

aber multiavtool funktioniert nicht
ich habe es auf c: entpackt und wollte wie beschrieben Start Menu shortcut anklicken aber des dos-fenster is nach 1 sekunde wieder verschwunden was mir aber aufgefallen is es läuft trotzdem noch wenn ich im task-manager prozesse anschaue

oder hab ich was falsch gemacht
mfg

mache einen Onlinescan mit panda und post den report
http://virus-protect.org/onlinescan.html

hier der scan

Incident Status Location

Adware:adware/cws Not disinfected c:\windows\system32\paytime.exe
Spyware:spyware/new.net Not disinfected c:\windows\NDNuninstall7_22.exe
Adware:adware/whenusearch Not disinfected Windows Registry

edit

ffservice
http://virus-protect.org/artikel/spyware/ffservice.html

Sendet Informationen über:

Computername
Prozessorgeschwindigkeit
CPU Typ
IP Adresse
Aktueller Malware Status
Informationen über das Netzwerk
Geöffneter Port
Informationen über laufende Prozesse
Systemzeit
Benutzername
Lokale Aktivität des Benutzers
besuchte URLs
Information über das Windows Betriebsystem

Möglichkeiten der Fernkontrolle:

Verzeichnis auflisten
Datei herunterladen
Registry editieren
Datei ausführen
System neu starten
Emails verschicken
System herunterfahren
Prozess beenden

---------------------------------------------------------------------------------------

stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

Kopiere diese 4 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html

Soll ich des angeben?????

ffservice
http://virus-protect.org/artikel/spyware/ffservice.html

Sendet Informationen über:

Computername
Prozessorgeschwindigkeit
CPU Typ
IP Adresse
Aktueller Malware Status
Informationen über das Netzwerk
Geöffneter Port
Informationen über laufende Prozesse
Systemzeit
Benutzername
Lokale Aktivität des Benutzers
besuchte URLs
Information über das Windows Betriebsystem

Möglichkeiten der Fernkontrolle:

Verzeichnis auflisten
Datei herunterladen
Registry editieren
Datei ausführen
System neu starten
Emails verschicken
System herunterfahren
Prozess beenden

Also clean up hab ich gemacht und hier die ergebnisse von datfind (der letzten 3 monate)




Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: 14EC-668C

Verzeichnis von C:\WINDOWS\system32

24.07.2006 14:28 54.112 vsconfig.xml
23.07.2006 19:20 0 asfiles.txt
23.07.2006 19:17 2.550 Uninstall.ico
23.07.2006 19:17 1.406 Help.ico
23.07.2006 19:17 30.590 pavas.ico
22.07.2006 21:51 37.124 imsn.exe
21.07.2006 13:15 13.032 LMIport.dll
21.07.2006 13:15 23.016 LMImirr.dll
21.07.2006 13:15 9.576 LMImirr2.dll
21.07.2006 13:15 11.496 LMIinit.dll
16.07.2006 19:05 2.422 wpa.dbl
16.07.2006 11:42 4.212 zllictbl.dat
15.07.2006 20:29 4.096 crash
13.07.2006 12:54 396.120 perfh009.dat
13.07.2006 12:54 60.784 perfc009.dat
13.07.2006 12:54 410.198 perfh007.dat
13.07.2006 12:54 73.384 perfc007.dat
13.07.2006 12:54 913.204 PerfStringBackup.INI
07.07.2006 03:21 6.757.792 MRT.exe
26.06.2006 20:46 16.832 amcompat.tlb
26.06.2006 20:46 23.392 nscompat.tlb
22.06.2006 20:28 664 d3d9caps.dat
20.06.2006 23:33 42.920 vsutil_loc0407.dll
20.06.2006 23:33 394.872 vsdatant.sys
20.06.2006 23:32 71.672 zlcommdb.dll
20.06.2006 23:32 83.960 zlcomm.dll
20.06.2006 23:32 440.312 vsutil.dll
20.06.2006 23:32 100.344 vsxml.dll
20.06.2006 23:32 59.384 vswmi.dll
20.06.2006 23:32 71.672 vsregexp.dll
20.06.2006 23:32 268.280 vspubapi.dll
20.06.2006 23:32 157.688 vsinit.dll
20.06.2006 23:32 104.440 vsmonapi.dll
20.06.2006 23:32 83.960 vsdata.dll
20.06.2006 23:32 796.584 libeay32_0.9.6l.dll
15.06.2006 11:09 11.496 LMIinit.dll.000.bak
14.06.2006 13:21 158.752 FNTCACHE.DAT
12.06.2006 20:16 57.384 avsda.dll
01.06.2006 20:47 27.648 jgpl400.dll
01.06.2006 20:47 163.840 jgdw400.dll
29.05.2006 17:30 1.494.016 shdocvw.dll
19.05.2006 17:09 3.073.536 mshtml.dll
19.05.2006 15:09 95.744 iphlpapi.dll
19.05.2006 15:09 148.480 dnsapi.dll
19.05.2006 15:09 112.128 dhcpcsvc.dll
18.05.2006 07:36 450.560 jscript.dll
16.05.2006 16:43 19.968 linkinfo.dll
14.05.2006 10:48 181.248 rasmans.dll
11.05.2006 10:57 27.136 xpsp3res.dll
10.05.2006 07:23 664.064 wininet.dll
10.05.2006 07:22 474.624 shlwapi.dll
10.05.2006 07:22 615.936 urlmon.dll
10.05.2006 07:22 448.512 mshtmled.dll
10.05.2006 07:22 146.432 msrating.dll
10.05.2006 07:22 532.480 mstime.dll
10.05.2006 07:22 39.424 pngfilt.dll
10.05.2006 07:22 96.768 inseng.dll
10.05.2006 07:22 16.384 jsproxy.dll
10.05.2006 07:22 251.392 iepeers.dll
10.05.2006 07:22 205.312 dxtrans.dll
10.05.2006 07:22 357.888 dxtmsft.dll
10.05.2006 07:22 1.056.256 danim.dll
10.05.2006 07:22 55.808 extmgr.dll
10.05.2006 07:22 1.022.976 browseui.dll
10.05.2006 07:22 152.064 cdfview.dll
10.05.2006 02:49 269.824 Audiodev.dll
10.05.2006 02:49 7.757.312 wmploc.dll
10.05.2006 02:14 3.749.888 WpdShext.dll
10.05.2006 02:14 97.792 wmpshell.dll
10.05.2006 02:13 262.656 wmerror.dll
10.05.2006 02:12 8.192 asferror.dll
09.05.2006 22:36 6.656 WdfMgr.exe
09.05.2006 22:36 6.656 uWDF.exe
09.05.2006 22:26 36.864 WMDMPS.dll
09.05.2006 22:26 31.744 WMDMLOG.dll
09.05.2006 22:26 203.776 wmpsrcwp.dll
09.05.2006 22:26 237.056 wmpasf.dll
09.05.2006 22:26 992.256 WMNetMgr.dll
09.05.2006 22:26 4.096 MP43DMOD.dll
09.05.2006 22:26 221.696 WMASF.dll
09.05.2006 22:26 4.096 MP4SDMOD.dll
09.05.2006 22:26 564.736 WMSPDMOD.dll
09.05.2006 22:26 4.096 wmsdmod.dll
09.05.2006 22:26 4.096 MPG4DMOD.dll
09.05.2006 22:26 433.152 wmpeffects.dll
09.05.2006 22:26 1.063.424 WMADMOE.dll
09.05.2006 22:26 212.480 msnetobj.dll
09.05.2006 22:26 26.112 MsPMSNSv.dll
09.05.2006 22:26 201.728 qasf.dll
09.05.2006 22:26 165.376 MsPMSP.dll
09.05.2006 22:26 10.394.624 wmp.dll
09.05.2006 22:26 705.024 WMADMOD.dll
09.05.2006 22:26 4.096 wdfApi.dll
09.05.2006 22:26 1.280.000 WMSPDMOE.dll
09.05.2006 22:26 4.096 WMVADVD.dll
09.05.2006 22:26 417.280 wmdrmdev.dll
09.05.2006 22:26 301.056 wmpdxm.dll
09.05.2006 22:26 1.641.472 wmpencen.dll
09.05.2006 22:26 337.408 wmdrmnet.dll
09.05.2006 22:26 306.688 MSWMDM.dll
09.05.2006 22:26 4.096 wmvdmoe2.dll
09.05.2006 22:26 135.680 wmpps.dll
09.05.2006 22:26 4.096 wmvdmod.dll
09.05.2006 22:26 4.096 WMVADVE.DLL
09.05.2006 22:26 219.648 CEWMDM.dll
09.05.2006 22:26 155.136 wmidx.dll
09.05.2006 22:26 4.096 wmsdmoe2.dll
09.05.2006 22:26 9.728 LAPRXY.dll
09.05.2006 22:22 2.463.744 wmvcore.dll
09.05.2006 21:02 230.400 l3codecp.acm
09.05.2006 21:02 84.480 logagent.exe
09.05.2006 21:01 1.463.808 WMVDECOD.dll
09.05.2006 21:01 1.359.360 WMVSDECD.dll
09.05.2006 21:00 241.152 MPG4DECD.dll
09.05.2006 21:00 299.520 MP4SDECD.dll
09.05.2006 21:00 1.455.616 WMVENCOD.dll
09.05.2006 21:00 770.560 WMVSENCD.dll
09.05.2006 21:00 241.152 MP43DECD.dll
09.05.2006 21:00 636.928 WMVXENCD.dll
09.05.2006 21:00 546.816 wmpmde.dll
09.05.2006 21:00 382.976 MFPLAT.dll
09.05.2006 21:00 1.350.656 drmv2clt.dll
09.05.2006 20:59 513.536 wmdrmsdk.dll
09.05.2006 20:59 417.280 MSSCP.dll
09.05.2006 20:59 229.376 drmupgds.exe
09.05.2006 20:59 585.216 blackbox.dll
09.05.2006 20:58 13.824 wpdshextautoplay.exe
09.05.2006 20:58 52.224 WPDShServiceObj.dll
09.05.2006 20:58 670.208 wpd_ci.dll
09.05.2006 20:58 103.424 PortableDeviceWiaCompat.dll
09.05.2006 20:58 188.928 PortableDeviceWMDRM.dll
09.05.2006 20:58 345.600 PortableDeviceApi.dll
09.05.2006 20:58 101.376 PortableDeviceClassExtension.dll
09.05.2006 20:58 343.552 WPDSp.dll
09.05.2006 20:58 55.808 wpdmtpus.dll
09.05.2006 20:58 35.840 wpdconns.dll
09.05.2006 20:58 144.896 wpdmtp.dll
09.05.2006 20:58 13.312 wpdtrace.dll
09.05.2006 20:58 168.960 PortableDeviceTypes.dll
09.05.2006 20:57 11.264 ehETW.dll
09.05.2006 20:45 304.640 MSDelta.dll
09.05.2006 20:00 22.752 spupdsvc.exe
08.05.2006 15:18 7.920 ractrlkeyhook.dll
01.05.2006 16:40 8.464 sporder.dll
24.04.2006 17:33 2.368 SVKP.sys
19.04.2006 00:34 421.888 pxdrv.dll
19.04.2006 00:34 109.568 pxinsi64.exe
19.04.2006 00:34 172.032 pxmas.dll
19.04.2006 00:34 372.736 px.dll
19.04.2006 00:34 61.440 pxhpinst.exe
19.04.2006 00:34 56.320 pxinsa64.exe
19.04.2006 00:34 339.968 pxwave.dll
19.04.2006 00:34 28.672 vxblock.dll
19.04.2006 00:30 3.596.288 qt-dx331.dll
18.04.2006 15:47 21.840 SIntfNT.dll
18.04.2006 15:47 17.212 SIntf32.dll
18.04.2006 15:47 12.067 SIntf16.dll
14.04.2006 18:31 386 oeminfo.ini
14.04.2006 18:31 18.578 OEMLOGO.BMP
11.04.2006 14:30 93.752 WUDFCoinstaller.dll
11.04.2006 14:27 304.640 WUDFx.dll
11.04.2006 14:27 130.048 WudfHost.exe
11.04.2006 14:26 54.272 WudfSvc.dll
11.04.2006 14:26 158.208 WudfPlatform.dll
10.04.2006 20:37 118.784 DivXCodecUpdateChecker.exe
08.04.2006 16:19 2.228.048 BIKINI2.scr
08.04.2006 11:54 503.808 msvcp71.dll
06.04.2006 10:54 73.728 asuninst.exe
03.04.2006 10:59 128 xposer.cfg
03.04.2006 10:59 128 asinst.cfg

______________________________________________________

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: 14EC-668C

Verzeichnis von C:\DOKUME~1\Besitzer\LOKALE~1\Temp

24.07.2006 14:46 240 datFind.zip
24.07.2006 14:45 339.099 xkn9y1df.exe
24.07.2006 14:29 692 dfupdate.ini
24.07.2006 14:29 16.384 Perflib_Perfdata_ae8.dat
24.07.2006 14:29 16.384 Perflib_Perfdata_ae0.dat
24.07.2006 14:29 16.384 Perflib_Perfdata_160.dat
24.07.2006 14:29 16.384 ~DF236A.tmp
24.07.2006 14:29 512 ~DF1302.tmp
24.07.2006 14:29 16.384 ~DF12F1.tmp
24.07.2006 12:37 1.968.417 o1fvc9c7.exe
24.07.2006 10:54 9.632 ICQ9.tmp
24.07.2006 10:54 3.507 ICQ8.tmp
24.07.2006 08:59 1.340 wmplog12.sqm
24.07.2006 08:58 0 0z01A.tmp
24.07.2006 08:58 0 dsz17.tmp
23.07.2006 21:38 1.164 wmplog11.sqm
23.07.2006 21:38 0 9k4290.tmp
23.07.2006 19:32 8.736 java_install_reg.log
23.07.2006 17:00 1.176 wmplog10.sqm
23.07.2006 13:59 16.384 ~DF9CA.tmp
23.07.2006 13:59 16.384 ~DF9E6.tmp
23.07.2006 13:59 16.384 ~DF992.tmp
23.07.2006 13:59 16.384 ~DF9AE.tmp
23.07.2006 13:59 16.384 ~DFF085.tmp
23.07.2006 13:59 16.384 ~DFEBB2.tmp
23.07.2006 13:38 16.384 ~DFD75D.tmp
23.07.2006 13:38 16.384 ~DFD2BB.tmp
23.07.2006 12:14 16.384 ~DF58FB.tmp
23.07.2006 12:14 16.384 ~DF58DF.tmp
23.07.2006 12:14 16.384 ~DF58C1.tmp
23.07.2006 12:14 16.384 ~DF584E.tmp
23.07.2006 12:14 16.384 ~DF312B.tmp
23.07.2006 12:14 16.384 ~DF298E.tmp
23.07.2006 12:02 16.384 ~DFE174.tmp
23.07.2006 12:02 16.384 ~DFDCAE.tmp
22.07.2006 21:37 16.384 ~DF7ACF.tmp
22.07.2006 21:37 16.384 ~DF7AED.tmp
22.07.2006 21:37 16.384 ~DF7B0F.tmp
22.07.2006 21:37 16.384 ~DF7AB3.tmp
22.07.2006 21:16 0 fl1.exe
22.07.2006 21:16 0 fl2.exe
22.07.2006 20:48 16.384 ~DFA277.tmp
22.07.2006 20:48 16.384 ~DF9217.tmp
19.07.2006 21:14 0 raa29.tmp
18.07.2006 18:10 1.176 wmplog09.sqm
18.07.2006 14:50 73.276 ~e5.0001
17.07.2006 20:59 16.384 ~DF914B.tmp
17.07.2006 20:59 16.384 ~DF912F.tmp
17.07.2006 20:59 16.384 ~DF9167.tmp
17.07.2006 20:59 16.384 ~DF9183.tmp
17.07.2006 20:11 1.176 wmplog08.sqm
17.07.2006 19:47 16.384 ~DF76E7.tmp
17.07.2006 19:47 16.384 ~DF4937.tmp
17.07.2006 14:08 10.725 ICQ7.tmp
17.07.2006 14:08 3.970 ICQ6.tmp
17.07.2006 12:40 16.384 ~DF97FA.tmp
17.07.2006 12:40 16.384 ~DF97C2.tmp
17.07.2006 12:40 16.384 ~DF97A6.tmp
17.07.2006 12:40 16.384 ~DF97DE.tmp
17.07.2006 12:39 16.384 ~DFFD8F.tmp
17.07.2006 12:39 16.384 ~DFF364.tmp
16.07.2006 20:35 1.164 wmplog07.sqm
16.07.2006 20:35 0 nm9A.tmp
16.07.2006 20:35 1.164 wmplog06.sqm
16.07.2006 20:34 0 kk49.tmp
16.07.2006 19:18 1.176 wmplog05.sqm
16.07.2006 13:51 734 karoltmp.kdw
15.07.2006 21:38 234 _isdelet.ini
15.07.2006 19:20 550.068.817 beta1.4full.zip
15.07.2006 18:04 1.196 wmplog04.sqm
15.07.2006 18:02 0 gj219.tmp
15.07.2006 15:26 799.827 hamachi-update-1.0.0.59.exe
14.07.2006 20:20 4.383 ICQ2E.tmp
14.07.2006 20:20 10.581 ICQ2F.tmp
14.07.2006 20:20 19.139 ICQ2D.tmp
14.07.2006 20:20 6.305 ICQ2C.tmp
13.07.2006 16:17 1.108 wmplog03.sqm
13.07.2006 16:17 0 eaw23.tmp
13.07.2006 13:53 0 raa4.tmp
11.07.2006 21:09 4.817.151 BattleTanx.7z
11.07.2006 13:05 1.440 wmplog02.sqm
10.07.2006 17:57 1.176 wmplog01.sqm
10.07.2006 17:29 1.520 wmplog00.sqm
09.07.2006 19:19 1.030.545 95vdyukd.exe
09.07.2006 17:54 0 raa86.tmp
09.07.2006 17:54 0 raa85.tmp
09.07.2006 14:47 0 raa6F.tmp
09.07.2006 09:47 16.384 ~DFD05D.tmp
07.07.2006 14:57 0 82l9.tmp
06.07.2006 20:19 1.536 ~DFD740.tmp
06.07.2006 19:52 0 8t631.tmp
06.07.2006 18:17 55.584.182 coop_v_1.0_package.zip
06.07.2006 18:00 16.384 ~DFD692.tmp
05.07.2006 13:06 0 wnq5.tmp
05.07.2006 13:05 0 ys74.tmp
04.07.2006 19:38 6.638 FRONTPG.log
04.07.2006 19:32 153 wecerr.txt
04.07.2006 19:26 77.641 tmp-5.xpi
04.07.2006 19:22 0 2487.tmp
04.07.2006 19:22 0 vg46.tmp
04.07.2006 19:21 0 35p5.tmp
04.07.2006 14:52 16.384 ~DF4C3B.tmp
04.07.2006 14:52 16.384 ~DF3F90.tmp
03.07.2006 17:00 0 q9c6.tmp
03.07.2006 17:00 0 3ri4.tmp
03.07.2006 16:59 0 24D0C.dmp
03.07.2006 16:58 0 165E9.dmp
02.07.2006 13:13 16.384 ~DF3ED4.tmp
02.07.2006 13:13 16.384 ~DF3EF0.tmp
02.07.2006 13:13 16.384 ~DF3F0C.tmp
02.07.2006 13:13 16.384 ~DF3EB8.tmp
02.07.2006 12:55 16.384 ~DF4B88.tmp
02.07.2006 12:55 16.384 ~DF1D62.tmp
02.07.2006 10:54 16.384 Perflib_Perfdata_d30.dat
02.07.2006 10:53 16.384 Perflib_Perfdata_660.dat
29.06.2006 20:04 16.384 ~DFD433.tmp
29.06.2006 20:04 16.384 ~DFCE4B.tmp
29.06.2006 20:04 16.384 ~DFB8EC.tmp
29.06.2006 20:04 16.384 ~DFAD21.tmp
29.06.2006 20:03 16.384 ~DF773F.tmp
29.06.2006 20:03 16.384 ~DF5087.tmp
29.06.2006 15:29 16.384 ~DFEAA4.tmp
29.06.2006 15:14 15.248 dd_netfx20UI2948.txt
29.06.2006 15:14 4.629.236 dd_netfx20MSI2948.txt
29.06.2006 15:12 5.012 ASPNETSetup_00001.log
29.06.2006 14:55 16.384 ~DF2F5B.tmp
29.06.2006 14:55 16.384 ~DF2F93.tmp
29.06.2006 14:55 16.384 ~DF2F77.tmp
29.06.2006 14:55 16.384 ~DF2F3F.tmp
29.06.2006 14:42 16.384 ~DFD1B.tmp
29.06.2006 14:42 16.384 ~DFC9E7.tmp
29.06.2006 13:54 16.384 Perflib_Perfdata_ba4.dat
29.06.2006 13:54 16.384 Perflib_Perfdata_4f0.dat
29.06.2006 13:48 16.384 Perflib_Perfdata_ad0.dat
29.06.2006 13:48 16.384 Perflib_Perfdata_808.dat
27.06.2006 20:00 45.240 mod36.tmp
27.06.2006 17:20 4.592 temp.ani
27.06.2006 17:16 46.596 drm_dialogs.dll
27.06.2006 15:43 4.383 ICQ4.tmp
27.06.2006 15:43 10.581 ICQ5.tmp
27.06.2006 14:34 16.384 ~DFB8D0.tmp
26.06.2006 19:03 16.384 Perflib_Perfdata_bec.dat
26.06.2006 19:03 16.384 Perflib_Perfdata_be4.dat
26.06.2006 19:02 16.384 Perflib_Perfdata_568.dat
25.06.2006 15:45 1.607 google.gif
25.06.2006 15:43 1.104 QTInstallCode.log
25.06.2006 15:39 1.542 qtplugin.log
25.06.2006 15:39 450.048 526083.mst
25.06.2006 15:39 450.048 569cba.mst
24.06.2006 20:37 12.097 ICQ51.tmp
24.06.2006 20:37 4.658 ICQ50.tmp
24.06.2006 19:15 11.544 ICQ40.tmp
24.06.2006 19:15 4.463 ICQ3F.tmp
24.06.2006 18:34 9.510 ICQ3C.tmp
24.06.2006 18:34 4.166 ICQ3B.tmp
24.06.2006 18:29 4.463 ICQ38.tmp
24.06.2006 18:29 11.544 ICQ39.tmp
24.06.2006 16:11 0 fbf1E.tmp
24.06.2006 13:07 667.688 tmp-4.xpi
23.06.2006 22:03 18.029 ICQ2B.tmp
23.06.2006 22:03 6.381 ICQ2A.tmp
23.06.2006 19:36 16.384 Perflib_Perfdata_718.dat
22.06.2006 20:53 16.384 Perflib_Perfdata_c9c.dat
22.06.2006 20:53 16.384 Perflib_Perfdata_c94.dat
22.06.2006 20:53 16.384 Perflib_Perfdata_404.dat
22.06.2006 20:47 16.384 Perflib_Perfdata_a04.dat
22.06.2006 20:47 16.384 Perflib_Perfdata_9fc.dat
22.06.2006 20:46 16.384 Perflib_Perfdata_f0.dat
22.06.2006 20:14 243.662.848 sno86bqo.exe
22.06.2006 16:06 870.668 dd_vsinstall80.txt
22.06.2006 16:06 31.422 uxeventlog.txt
22.06.2006 16:06 352 msinterr.txt
22.06.2006 16:05 411.943 dd_depcheck80.txt
22.06.2006 16:03 0 tkq35.tmp
21.06.2006 21:01 667.688 tmp-3.xpi
21.06.2006 21:01 67.996 tmp-2.xpi
21.06.2006 16:15 0 kbk16.tmp
21.06.2006 15:04 0 uj636.tmp
21.06.2006 15:00 0 5nw35.tmp
21.06.2006 14:58 0 23v34.tmp
21.06.2006 14:56 0 cpm33.tmp
21.06.2006 14:54 1.066 mmmxl.log
21.06.2006 14:49 28.518 header_bg.jpg
21.06.2006 14:46 717 control.xml
21.06.2006 14:40 16.384 ~DF6E94.tmp
21.06.2006 14:40 16.384 ~DF6077.tmp
20.06.2006 20:30 0 neo1B.tmp
20.06.2006 12:53 16.384 ~DFA8C4.tmp
20.06.2006 12:53 16.384 ~DFA8E0.tmp
20.06.2006 12:53 16.384 ~DFA8A8.tmp
20.06.2006 12:53 16.384 ~DFA8FC.tmp
20.06.2006 12:51 16.384 ~DF181A.tmp
20.06.2006 12:51 16.384 ~DF1836.tmp
20.06.2006 12:51 16.384 ~DF17E2.tmp
20.06.2006 12:51 16.384 ~DF17FE.tmp
20.06.2006 12:42 16.384 ~DFA503.tmp
20.06.2006 12:41 16.384 ~DF6C59.tmp
19.06.2006 20:36 0 5iq2C.tmp
19.06.2006 20:35 0 go82B.tmp
19.06.2006 20:35 0 5xu29.tmp
19.06.2006 20:34 0 0i427.tmp
19.06.2006 20:34 1.775 b55f36ff3ea411a804c72ba227e53c1f.jpg
19.06.2006 19:45 16.384 ~DFBA52.tmp
19.06.2006 19:45 16.384 ~DFA9FF.tmp
18.06.2006 20:02 0 jo98.tmp
18.06.2006 20:02 0 w6q7.tmp
18.06.2006 19:09 0 y4v5.tmp
15.06.2006 21:41 16.384 ~DF8639.tmp
15.06.2006 21:41 16.384 ~DF861D.tmp
15.06.2006 21:41 16.384 ~DF85E3.tmp
15.06.2006 21:41 16.384 ~DF8601.tmp
15.06.2006 21:12 0 h6c2D.tmp
15.06.2006 21:11 0 1662B.tmp
15.06.2006 21:11 0 tfp2A.tmp
15.06.2006 21:09 0 3a428.tmp
15.06.2006 21:09 0 r1v27.tmp
15.06.2006 21:09 0 isi25.tmp
15.06.2006 20:28 16.384 ~DF3942.tmp
15.06.2006 20:28 16.384 ~DF29C5.tmp
14.06.2006 20:05 16.384 ~DFA559.tmp
14.06.2006 20:05 16.384 ~DF9B4E.tmp
14.06.2006 18:46 16.384 ~DFBD4C.tmp
14.06.2006 18:46 16.384 ~DFAE33.tmp
14.06.2006 13:25 1.085.442 setup.exe
14.06.2006 11:11 10.581 ICQ29.tmp
14.06.2006 11:11 4.383 ICQ28.tmp
14.06.2006 11:11 18.278 ICQ27.tmp
14.06.2006 11:11 6.374 ICQ26.tmp
14.06.2006 11:10 12.065 ICQ25.tmp
14.06.2006 11:10 3.873 ICQ24.tmp
14.06.2006 11:10 10.105 ICQ23.tmp
14.06.2006 11:10 3.491 ICQ20.tmp
14.06.2006 11:10 18.499 ICQ1F.tmp
14.06.2006 11:10 6.112 ICQ1C.tmp
14.06.2006 11:10 6.374 ICQ1A.tmp
14.06.2006 11:10 18.278 ICQ1B.tmp
14.06.2006 11:10 18.029 ICQ19.tmp
14.06.2006 11:10 6.381 ICQ16.tmp
14.06.2006 11:09 13.155 ICQ15.tmp
14.06.2006 11:09 4.375 ICQ14.tmp
14.06.2006 11:09 4.375 ICQ12.tmp
14.06.2006 11:09 13.155 ICQ13.tmp
13.06.2006 22:00 0 jol30.tmp
13.06.2006 21:58 0 jzo2F.tmp
13.06.2006 21:58 0 qyk2E.tmp
13.06.2006 21:58 0 h3g2C.tmp
13.06.2006 21:57 0 4hk2B.tmp
13.06.2006 21:57 0 77t2A.tmp
13.06.2006 21:56 0 oj829.tmp
13.06.2006 21:56 0 ol228.tmp
13.06.2006 21:55 0 rjf26.tmp
13.06.2006 21:54 0 1ka25.tmp
13.06.2006 21:54 0 y9v24.tmp
13.06.2006 21:53 0 vgd22.tmp
13.06.2006 19:57 16.384 ~DF661A.tmp
13.06.2006 18:49 16.384 ~DFC73F.tmp
13.06.2006 09:06 16.384 ~DFB212.tmp
12.06.2006 20:17 0 k8020.tmp
12.06.2006 20:17 0 int1E.tmp
12.06.2006 20:12 0 7uy1A.tmp
12.06.2006 20:12 0 msr19.tmp
12.06.2006 20:12 0 vcf17.tmp
12.06.2006 18:45 12.177 ICQ11.tmp
12.06.2006 18:45 4.851 ICQ10.tmp
12.06.2006 15:51 16.384 ~DF98AD.tmp
12.06.2006 13:43 16.384 ~DF7FC7.tmp
12.06.2006 11:26 16.384 ~DFE67A.tmp
12.06.2006 11:26 16.384 ~DFE642.tmp
12.06.2006 11:26 16.384 ~DFE65E.tmp
12.06.2006 11:26 16.384 ~DFE696.tmp
12.06.2006 11:25 16.384 ~DF46FF.tmp
12.06.2006 11:25 16.384 ~DF4737.tmp
12.06.2006 11:25 16.384 ~DF471B.tmp
12.06.2006 11:25 16.384 ~DF46E3.tmp
12.06.2006 11:25 16.384 ~DF22E9.tmp
12.06.2006 11:25 16.384 ~DF1DBD.tmp
12.06.2006 09:54 45.240 modA.tmp
12.06.2006 09:32 16.384 ~DFF059.tmp
11.06.2006 20:53 16.384 ~DFAEAC.tmp
11.06.2006 19:54 16.384 ~DF8700.tmp
11.06.2006 18:15 45.240 mod2A.tmp
11.06.2006 18:11 45.240 mod25.tmp
11.06.2006 18:06 45.240 mod1F.tmp
11.06.2006 18:03 45.240 mod1D.tmp
11.06.2006 12:11 16.384 ~DF7CD5.tmp
11.06.2006 11:23 16.384 ~DFA907.tmp
10.06.2006 20:04 16.384 ~DF93F9.tmp
10.06.2006 11:50 16.384 ~DF86E3.tmp
10.06.2006 11:49 16.384 ~DFC048.tmp
10.06.2006 08:48 16.384 ~DF4214.tmp
09.06.2006 17:27 45.240 mod2B.tmp
09.06.2006 17:02 45.240 mod24.tmp
09.06.2006 17:02 4.851 ICQ21.tmp
09.06.2006 17:02 12.177 ICQ22.tmp
09.06.2006 17:01 45.240 mod20.tmp
09.06.2006 16:59 45.240 mod1C.tmp
09.06.2006 16:59 45.240 mod1A.tmp
09.06.2006 16:53 9.632 ICQ18.tmp
09.06.2006 16:53 3.507 ICQ17.tmp
09.06.2006 10:11 16.384 Perflib_Perfdata_d20.dat
09.06.2006 10:11 16.384 Perflib_Perfdata_91c.dat
09.06.2006 10:11 0 JET8B9D.tmp
09.06.2006 10:11 16.384 ~DF411E.tmp
08.06.2006 20:31 16.384 ~DFBE5.tmp
08.06.2006 18:46 16.384 ~DF3B4A.tmp
08.06.2006 18:46 0 JET3301.tmp
03.06.2006 10:39 16.384 ~DF2786.tmp
02.06.2006 14:42 16.384 ~DFE9C4.tmp
02.06.2006 14:06 671.494 tmp-1.xpi
02.06.2006 14:04 16.384 ~DFEF9B.tmp
01.06.2006 19:17 16.384 ~DF8B89.tmp
01.06.2006 15:35 16.384 ~DF96C1.tmp
31.05.2006 18:36 16.384 ~DF3F8A.tmp
31.05.2006 16:22 16.384 ~DF50E4.tmp
31.05.2006 14:39 16.384 ~DF1070.tmp
31.05.2006 14:39 16.384 ~DF1054.tmp
31.05.2006 14:39 16.384 ~DF1038.tmp
31.05.2006 14:39 16.384 ~DF101A.tmp
31.05.2006 14:38 16.384 ~DF8415.tmp
31.05.2006 14:38 16.384 ~DF59DA.tmp
30.05.2006 19:11 16.384 ~DFE6DB.tmp
30.05.2006 14:38 16.384 ~DFBAA1.tmp
29.05.2006 18:32 16.384 ~DFCD48.tmp
29.05.2006 13:38 16.384 ~DFC1A1.tmp
29.05.2006 12:38 16.384 ~DFE2A9.tmp
28.05.2006 19:44 16.384 ~DF9ED9.tmp
28.05.2006 14:08 16.384 ~DF735D.tmp
28.05.2006 14:02 16.384 ~DF4E22.tmp
28.05.2006 10:52 16.384 Perflib_Perfdata_d28.dat
28.05.2006 10:52 16.384 Perflib_Perfdata_914.dat
28.05.2006 10:51 0 JETAC4.tmp
28.05.2006 10:51 16.384 ~DFD738.tmp
27.05.2006 21:03 16.384 ~DF7C23.tmp
27.05.2006 17:51 16.384 ~DF4BF1.tmp
27.05.2006 17:44 16.384 ~DF4A40.tmp
27.05.2006 17:44 16.384 Perflib_Perfdata_f90.dat
27.05.2006 17:44 16.384 Perflib_Perfdata_df4.dat
27.05.2006 17:44 16.384 Perflib_Perfdata_9b8.dat
27.05.2006 17:43 0 JET8FE2.tmp
27.05.2006 17:43 16.384 ~DF8528.tmp
27.05.2006 15:05 16.384 ~DF3823.tmp
27.05.2006 14:48 16.384 ~DF28B4.tmp
27.05.2006 14:33 420 MSI2283f.LOG
27.05.2006 14:32 16.384 ~DFE4D9.tmp
27.05.2006 12:35 0 JET6E74.tmp
27.05.2006 11:07 16.384 ~DF4BFD.tmp
26.05.2006 19:41 16.384 ~DF28EA.tmp
26.05.2006 14:18 16.384 ~DF2B0E.tmp
25.05.2006 16:18 16.384 ~DFC15A.tmp
25.05.2006 14:31 121.064 set7.tmp
25.05.2006 13:04 701 TWAIN.LOG
25.05.2006 13:04 156 Twunk001.MTX
25.05.2006 13:04 2 Twain001.Mtx
25.05.2006 13:03 0 Twunk002.MTX
25.05.2006 10:49 16.384 ~DFC57F.tmp
24.05.2006 18:48 16.384 ~DF6EA.tmp
24.05.2006 15:56 16.384 ~DF40DD.tmp
24.05.2006 15:51 107.512 SetA.tmp
24.05.2006 15:31 16.384 ~DFD26F.tmp
24.05.2006 15:31 16.384 ~DFBA10.tmp
24.05.2006 14:27 16.384 ~DF57FA.tmp
23.05.2006 20:03 16.384 ~DF1D0.tmp
23.05.2006 19:40 0 ggcF.tmp
23.05.2006 19:40 0 jl5E.tmp
23.05.2006 19:38 0 1kuC.tmp
23.05.2006 19:38 0 y5jB.tmp
23.05.2006 19:37 0 fesA.tmp
23.05.2006 19:34 0 zmb8.tmp
23.05.2006 19:07 16.384 ~DFDBE5.tmp
23.05.2006 15:52 16.384 ~DF85F9.tmp
23.05.2006 01:17 238 1F1205F7.TMP
22.05.2006 18:55 16.384 ~DFC1BD.tmp
22.05.2006 17:18 16.384 ~DFF1B9.tmp
22.05.2006 15:58 16.384 ~DF41AF.tmp
22.05.2006 14:25 16.384 ~DF75C0.tmp
21.05.2006 19:17 16.384 ~DFC608.tmp
21.05.2006 19:12 32.768 ~DF15B9.tmp
21.05.2006 19:06 16.384 ~DF6DB.tmp
21.05.2006 18:08 0 bq018.tmp
21.05.2006 18:06 0 mpk17.tmp
21.05.2006 18:06 0 z1h15.tmp
21.05.2006 18:06 0 l8d14.tmp
21.05.2006 18:06 0 8xy12.tmp
21.05.2006 18:06 0 6pw11.tmp
21.05.2006 18:04 0 kzw10.tmp
21.05.2006 18:04 0 wsrE.tmp
21.05.2006 18:04 0 9ykD.tmp
21.05.2006 18:04 0 z2yC.tmp
21.05.2006 18:04 0 gpvB.tmp
21.05.2006 18:03 0 0ix9.tmp
21.05.2006 18:02 0 itt8.tmp
21.05.2006 18:02 0 f107.tmp
21.05.2006 17:51 16.384 ~DFDDDB.tmp
21.05.2006 11:37 16.384 ~DFD4E1.tmp
20.05.2006 19:38 16.384 ~DF824D.tmp
20.05.2006 18:54 16.384 ~DFB6F6.tmp
20.05.2006 18:54 16.384 ~DFB695.tmp
20.05.2006 18:54 16.384 ~DFB639.tmp
20.05.2006 18:34 16.384 ~DF5DF.tmp
20.05.2006 18:34 16.384 ~DF4A.tmp
20.05.2006 11:42 16.384 ~DF3C66.tmp
20.05.2006 10:15 16.384 ~DFFD7F.tmp
19.05.2006 19:55 0 0fr11.tmp
19.05.2006 19:54 0 yef10.tmp
19.05.2006 19:52 0 fonF.tmp
19.05.2006 19:52 0 eniD.tmp
19.05.2006 19:52 0 36gC.tmp
19.05.2006 19:52 0 x34B.tmp
19.05.2006 19:52 0 zzn9.tmp
19.05.2006 19:20 16.384 ~DF8B37.tmp
19.05.2006 16:13 5.961 GLGA6.tmp
19.05.2006 16:12 12.800 GLMA4.tmp
19.05.2006 16:12 165.376 GLCA3.tmp
19.05.2006 14:09 16.384 ~DF9AF0.tmp
18.05.2006 20:12 16.384 ~DF7123.tmp
18.05.2006 19:59 648.465 0n4pfnz6.zip
18.05.2006 19:19 16.384 ~DF4F4D.tmp
18.05.2006 18:59 0 hsq1C.tmp
18.05.2006 17:22 15.148 ICQC.tmp
18.05.2006 17:22 5.185 ICQB.tmp
18.05.2006 17:21 0 1frA.tmp
18.05.2006 17:10 27.136 icq_as_trojan.doc
18.05.2006 17:00 40.448 allround.doc
17.05.2006 20:48 0 5pw7.tmp
17.05.2006 20:18 16.384 ~DF4E04.tmp
17.05.2006 18:44 16.384 ~DFB594.tmp
17.05.2006 16:30 16.384 ~DF2104.tmp
17.05.2006 15:34 16.384 ~DF577E.tmp
16.05.2006 20:07 16.384 ~DF730E.tmp
16.05.2006 19:51 2.002 vbc1FB.tmp
16.05.2006 19:40 1.068 dd_vserror80.txt
16.05.2006 18:26 0 q3725.tmp
16.05.2006 18:22 0 eyk24.tmp
16.05.2006 18:22 0 w8m23.tmp
16.05.2006 17:31 5.217 ICQ1D.tmp
16.05.2006 17:31 14.462 ICQ1E.tmp
16.05.2006 16:47 16.384 ~DFE124.tmp
16.05.2006 16:43 512 ~DFCFF2.tmp
16.05.2006 16:43 16.384 ~DFCFDC.tmp
16.05.2006 16:43 16.384 ~DFCF59.tmp
16.05.2006 16:43 512 ~DFCFCE.tmp
16.05.2006 16:43 512 ~DFCF4B.tmp
16.05.2006 16:43 16.384 ~DFCEDB.tmp
16.05.2006 16:43 16.384 ~DFCE9E.tmp
16.05.2006 16:43 512 ~DFCEB4.tmp
16.05.2006 16:43 16.384 ~DFA685.tmp
16.05.2006 16:43 16.384 ~DFCC83.tmp
16.05.2006 16:43 512 ~DFCC91.tmp
16.05.2006 16:43 16.384 ~DF4945.tmp
16.05.2006 16:43 0 JETBFC.tmp
16.05.2006 15:43 0 JET4CF2.tmp
16.05.2006 15:43 16.384 ~DF22D.tmp
15.05.2006 19:47 16.384 ~DFE9AB.tmp
15.05.2006 19:43 16.384 ~DFB515.tmp
15.05.2006 16:54 16.384 ~DFAC0A.tmp
15.05.2006 13:39 16.384 ~DF312.tmp
14.05.2006 18:40 0 ng036.tmp
14.05.2006 16:23 920.068 tmp.xpi
14.05.2006 14:57 4.240.200 ricrpgcc.exe
14.05.2006 14:57 3.404.116 rxp5w85g.exe
14.05.2006 13:48 16.384 ~DF4331.tmp
13.05.2006 16:52 47.540 removefiles.txttemp
13.05.2006 16:51 16 persistent_state
13.05.2006 16:24 458 STG2A.tmp
13.05.2006 16:23 3.584 6df55b.mst
13.05.2006 14:24 16.384 ~DFBE64.tmp
13.05.2006 12:10 33 searchurl.txt
13.05.2006 12:06 27.146 VBF.tmp
13.05.2006 12:06 5.721 VBE.tmp
13.05.2006 11:34 16.384 ~DF4683.tmp
12.05.2006 19:47 16.384 ~DF4A14.tmp
12.05.2006 16:16 29.956 AAX6F.tmp
12.05.2006 16:16 49.388 AAX66.tmp
12.05.2006 16:16 49.388 AAX59.tmp
12.05.2006 16:15 49.388 AAX53.tmp
12.05.2006 16:14 28.416 AAX50.tmp
12.05.2006 16:13 49.388 AAX3D.tmp
12.05.2006 16:12 49.388 AAX37.tmp
12.05.2006 1