COMBOFIX ComboFix 08-06-09.7 - gro 2008-06-10 22:07:17.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.1148 [GMT 2:00] ausgeführt von:: C:\Dokumente und Einstellungen\gro\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . (((((((((((((((((((((((((((((((((((( Weitere L”schungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Programme\CPV C:\Programme\Temporary C:\WINDOWS\2PQPQpexYattis C:\WINDOWS\2PQPQpexYattis\[u]0[/u]0000000000000000000.DLL C:\WINDOWS\3PUP_lcsQafmis C:\WINDOWS\3PUP_lcsQafmis\[u]0[/u]0000000000000000000.DLL C:\WINDOWS\3PUP_lcsQattis C:\WINDOWS\3PUP_lcsQattis\10000000099999999999.DLL C:\WINDOWS\4PUPRPPPPPfmis C:\WINDOWS\4PUPRPPPPPfmis\[u]0[/u]0000000000000000000.DLL C:\WINDOWS\cookies.ini C:\WINDOWS\mslagent C:\WINDOWS\pskt.ini C:\WINDOWS\system32\2PQPQpexYattis C:\WINDOWS\system32\2PQPQpexYattis\[u]0[/u]0000000000000000000.DLL C:\WINDOWS\system32\3PUP_lcsQafmis C:\WINDOWS\system32\3PUP_lcsQafmis\[u]0[/u]0000000000000000000.DLL C:\WINDOWS\system32\3PUP_lcsQattis C:\WINDOWS\system32\3PUP_lcsQattis\10000000099999999999.DLL C:\WINDOWS\system32\4PUPRPPPPPfmis C:\WINDOWS\system32\4PUPRPPPPPfmis\[u]0[/u]0000000000000000000.DLL C:\WINDOWS\system32\bghlbyjt.ini C:\WINDOWS\system32\dgOYayay.ini C:\WINDOWS\system32\dgOYayay.ini2 C:\WINDOWS\system32\dkiavivx.ini C:\WINDOWS\system32\drvvog.dll C:\WINDOWS\system32\fxivpkap.ini C:\WINDOWS\system32\gmeidmmr.ini C:\WINDOWS\system32\gOonoUtv.ini C:\WINDOWS\system32\gOonoUtv.ini2 C:\WINDOWS\system32\haeivjvt.ini C:\WINDOWS\system32\htrmujeb.ini C:\WINDOWS\system32\kehyhoeq.ini C:\WINDOWS\system32\lytkhqyk.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\miuucmsy.dll C:\WINDOWS\system32\mlJDwxUM.dll C:\WINDOWS\system32\nookomeq.ini C:\WINDOWS\system32\rynwdbks.ini C:\WINDOWS\system32\SstvvGgh.ini C:\WINDOWS\system32\SstvvGgh.ini2 C:\WINDOWS\system32\tdjdcemg.ini C:\WINDOWS\system32\uqvnmbkh.ini C:\WINDOWS\system32\x64 C:\WINDOWS\system32\xFfhgMoq.ini C:\WINDOWS\system32\xFfhgMoq.ini2 C:\WINDOWS\system32\xlswvgwb.ini C:\WINDOWS\system32akttzn.exe C:\WINDOWS\system32anticipator.dll C:\WINDOWS\system32awtoolb.dll C:\WINDOWS\system32bdn.com C:\WINDOWS\system32bsva-egihsg52.exe C:\WINDOWS\system32dpcproxy.exe C:\WINDOWS\system32emesx.dll C:\WINDOWS\system32h@tkeysh@@k.dll C:\WINDOWS\system32hoproxy.dll C:\WINDOWS\system32hxiwlgpm.dat C:\WINDOWS\system32hxiwlgpm.exe C:\WINDOWS\system32medup012.dll C:\WINDOWS\system32medup020.dll C:\WINDOWS\system32msgp.exe C:\WINDOWS\system32msnbho.dll C:\WINDOWS\system32mssecu.exe C:\WINDOWS\system32msvchost.exe C:\WINDOWS\system32mtr2.exe C:\WINDOWS\system32mwin32.exe C:\WINDOWS\system32netode.exe C:\WINDOWS\system32newsd32.exe C:\WINDOWS\system32ps1.exe C:\WINDOWS\system32psof1.exe C:\WINDOWS\system32psoft1.exe C:\WINDOWS\system32regc64.dll C:\WINDOWS\system32regm64.dll C:\WINDOWS\system32Rundl1.exe C:\WINDOWS\system32smp C:\WINDOWS\system32sncntr.exe C:\WINDOWS\system32ssurf022.dll C:\WINDOWS\system32ssvchost.com C:\WINDOWS\system32ssvchost.exe C:\WINDOWS\system32sysreq.exe C:\WINDOWS\system32taack.dat C:\WINDOWS\system32taack.exe C:\WINDOWS\system32temp#01.exe C:\WINDOWS\system32thun.dll C:\WINDOWS\system32thun32.dll C:\WINDOWS\system32VBIEWER.OCX C:\WINDOWS\system32vbsys2.dll C:\WINDOWS\system32vcatchpi.dll C:\WINDOWS\system32winlogonpc.exe C:\WINDOWS\system32winsystem.exe C:\WINDOWS\system32WINWGPX.EXE . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_Security ((((((((((((((((((((((( Dateien erstellt von 2008-05-10 bis 2008-06-10 )))))))))))))))))))))))))))))) . 2008-06-10 21:51 . 2008-06-10 21:51 d-------- C:\Programme\CCleaner 2008-06-10 21:35 . 2008-06-10 21:35 d-------- C:\Programme\Trend Micro 2008-06-10 21:13 . 2008-06-10 21:13 d-------- C:\Programme\CleanUp! 2008-06-10 21:09 . 2008-06-10 21:12 d-------- C:\Programme\RegCleaner 2008-06-10 16:45 . 2008-06-10 16:45 d-------- C:\Programme\DNA 2008-06-10 16:45 . 2008-06-10 16:45 d-------- C:\Programme\BitTorrent 2008-06-10 16:45 . 2008-06-10 16:54 d-------- C:\Dokumente und Einstellungen\gro\Anwendungsdaten\DNA 2008-06-10 16:45 . 2008-06-10 21:18 d-------- C:\Dokumente und Einstellungen\gro\Anwendungsdaten\BitTorrent 2008-06-10 14:06 . 2008-06-10 14:06 d-------- C:\Programme\NETGATE 2008-06-10 14:06 . 2008-06-10 21:22 d-------- C:\Dokumente und Einstellungen\gro\Anwendungsdaten\Spy Emergency 2008-06-10 14:06 . 2008-06-10 14:06 d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NETGATE 2008-06-10 14:06 . 2008-05-03 17:15 23,096 --a------ C:\WINDOWS\system32\sremcon.exe 2008-06-10 14:06 . 2008-02-05 12:10 14,392 --a------ C:\WINDOWS\system32\drivers\spyemrg_guard.sys 2008-06-10 14:06 . 2008-02-05 12:10 12,344 --a------ C:\WINDOWS\system32\drivers\spyemrg.sys 2008-06-10 13:41 . 2008-06-10 13:41 d-------- C:\Programme\DAEMON Tools Lite 2008-06-10 12:23 . 2008-06-10 12:31 d-------- C:\Programme\SPYWAREfighter 2008-06-10 11:47 . 2008-06-10 12:14 d-------- C:\Programme\Enigma Software Group 2008-06-10 11:40 . 2008-06-10 11:40 d-------- C:\Dokumente und Einstellungen\gro\Anwendungsdaten\UnH Solutions 2008-06-10 11:39 . 2008-06-10 12:14 d-------- C:\Programme\Browser Sentinel 2 2008-06-09 11:53 . 2008-06-09 11:53 dr------- C:\Dokumente und Einstellungen\LocalService\Favoriten 2008-06-09 11:53 . 2008-06-09 11:53 d-------- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Talkback 2008-06-09 09:58 . 2008-06-10 16:27 d-------- C:\Programme\Spyware Doctor 2008-06-09 09:58 . 2008-06-10 22:15 d-a------ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP 2008-06-09 09:58 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-09 09:58 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-09 09:58 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-09 09:58 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-09 09:55 . 2008-06-10 16:55 d-------- C:\Programme\Google 2008-06-06 09:25 . 2008-06-06 09:25 56 --ah----- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsidmv.dat 2008-06-02 15:46 . 2008-06-02 15:46 d-------- C:\Dokumente und Einstellungen\gro.NBGROSS\Anwendungsdaten\Dell 2008-06-02 15:45 . 2004-08-13 14:47 d--h----- C:\Dokumente und Einstellungen\gro.NBGROSS\Vorlagen 2008-06-02 15:45 . 2004-08-13 14:47 dr------- C:\Dokumente und Einstellungen\gro.NBGROSS\Startmen 2008-06-02 15:45 . 2004-08-13 14:47 d--h----- C:\Dokumente und Einstellungen\gro.NBGROSS\Netzwerkumgebung 2008-06-02 15:45 . 2004-08-13 14:47 d--h----- C:\Dokumente und Einstellungen\gro.NBGROSS\Lokale Einstellungen 2008-06-02 15:45 . 2008-06-02 15:46 dr------- C:\Dokumente und Einstellungen\gro.NBGROSS\Favoriten 2008-06-02 15:45 . 2008-06-02 15:46 dr------- C:\Dokumente und Einstellungen\gro.NBGROSS\Eigene Dateien 2008-06-02 15:45 . 2004-08-13 14:47 d--h----- C:\Dokumente und Einstellungen\gro.NBGROSS\Druckumgebung 2008-06-02 15:45 . 2008-02-22 13:13 d-------- C:\Dokumente und Einstellungen\gro.NBGROSS\Anwendungsdaten\Wave Systems Corp 2008-06-02 15:45 . 2008-02-22 13:01 d-------- C:\Dokumente und Einstellungen\gro.NBGROSS\Anwendungsdaten\InstallShield 2008-06-02 15:45 . 2008-06-02 15:46 dr-h----- C:\Dokumente und Einstellungen\gro.NBGROSS\Anwendungsdaten 2008-06-02 15:45 . 2008-06-02 16:58 d-------- C:\Dokumente und Einstellungen\gro.NBGROSS 2008-05-21 16:53 . 2008-05-21 16:53 d-------- C:\UTILS 2008-05-20 15:23 . 2008-05-20 15:23 118 --a------ C:\WINDOWS\system32\MRT.INI 2008-05-20 11:19 . 2008-05-20 11:19 18,432 -r-h----- C:\WINDOWS\system32\svchpg6.exe 2008-05-20 11:19 . 2008-05-20 11:19 29 --a------ C:\WINDOWS\system32\ytwrhgsp.tmp 2008-05-20 11:19 . 2008-05-20 11:19 2 --a------ C:\1343289442 2008-05-20 10:50 . 2008-05-20 10:50 d-------- C:\Programme\Gemeinsame Dateien\Skype 2008-05-20 10:50 . 2008-06-10 16:02 d-------- C:\Dokumente und Einstellungen\gro\Anwendungsdaten\skypePM 2008-05-20 10:50 . 2008-05-20 10:50 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-10 20:13 --------- d-----w C:\Programme\Symantec AntiVirus 2008-06-10 14:14 --------- d-----w C:\Dokumente und Einstellungen\gro\Anwendungsdaten\Skype 2008-06-02 15:25 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft Help 2008-05-20 08:50 --------- d-----w C:\Programme\Skype 2008-05-20 08:50 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype 2008-05-07 13:12 --------- d-----w C:\Programme\SAA DataClient 2008-04-29 08:27 --------- d-----w C:\Programme\Afinion 2008-04-29 08:27 --------- d-----w C:\Dokumente und Einstellungen\gro\Anwendungsdaten\.ProjectViewer 2008-04-23 07:35 --------- d-----w C:\Programme\Rainlendar2 2008-04-22 09:55 --------- d-----w C:\Dokumente und Einstellungen\gro\Anwendungsdaten\PC Tools 2008-04-22 09:03 --------- d-----w C:\Programme\Gemeinsame Dateien\Autodesk Shared 2008-04-22 09:00 --------- d--h--w C:\Programme\InstallShield Installation Information 2008-04-17 09:32 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-04-17 09:32 --------- d-----w C:\Dokumente und Einstellungen\gro\Anwendungsdaten\DAEMON Tools 2008-04-14 14:14 --------- d-----w C:\Programme\IBH_Net 2008-04-14 14:14 --------- d-----w C:\Programme\Gemeinsame Dateien\InstallShield 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 621,344 ------w C:\WINDOWS\system32\dllcache\mswstr10.dll 2008-03-25 04:51 187,168 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-25 04:51 187,168 ------w C:\WINDOWS\system32\dllcache\msjint40.dll 2008-03-24 16:37 155,995 ----a-w C:\WINDOWS\java\Packages\8SOXBZ3P.ZIP 2008-03-20 08:03 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:03 1,845,376 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-18 08:47 274,495 ----a-w C:\WINDOWS\system32\TcAdsDll.dll . (((((((((((((((((((((((((((( Autostart Punkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:00 15360] "Rainlendar2"="C:\Programme\Rainlendar2\Rainlendar2.exe" [ ] "AquaSoft PhotoKalender"="C:\PROGRA~1\AquaSoft\DESKTO~1\DESKTO~1.exe" [ ] "CoolCalendar"="C:\Programme\CooSoft\Cool Calendar\CoolCalendar.exe" [ ] "SpyEmergency"="C:\Programme\NETGATE\Spy Emergency 2008\SpyEmergency.exe" [2008-05-01 15:14 2071096] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Programme\DellTPad\Apoint.exe" [2007-09-24 22:35 159744] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-05-18 13:45 138008] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-05-18 13:45 162584] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-05-18 13:45 138008] "SunJavaUpdateSched"="C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 15:03 36975] "SigmatelSysTrayApp"="C:\Programme\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-12-05 19:24 405504] "Dell QuickSet"="C:\Programme\Dell\QuickSet\quickset.exe" [2007-07-20 18:55 1228800] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-10-09 06:17 2183168] "WavXMgr"="C:\Programme\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2007-09-10 11:55 92160] "SecureUpgrade"="C:\Programme\Wave Systems Corp\SecureUpgrade.exe" [2007-09-14 12:53 218424] "KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 16:05 282624] "ISUSPM Startup"="C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 18:50 221184] "ISUSScheduler"="C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-07-27 18:50 81920] "RoxioDragToDisc"="C:\Programme\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 11:00 1116920] "PDVDDXSrv"="C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 19:23 118784] "S7UB Start"="C:\Programme\Gemeinsame Dateien\Siemens\S7ubtoox\s7ubtstx.exe" [2007-07-27 19:04 102453] "GrooveMonitor"="C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 01:47 31016] "Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "DeskCal"="C:\PROGRA~1\DESKTO~1\\DeskCal.exe" [ ] "ccApp"="C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [2006-07-19 20:26 52896] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-11-27 16:24 126048] "WinCC flexible Smart Start"="C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2007\HmiSmartStart.exe" [2007-07-20 03:02 159744] "TrueImageMonitor.exe"="C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-17 13:31 1194728] "AcronisTimounterMonitor"="C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-17 13:35 1966928] "Acronis Scheduler2 Service"="C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" [2007-02-16 18:49 149024] "ISTray"="C:\Programme\Spyware Doctor\pctsTray.exe" [2008-02-01 12:55 1103240] "BM5323cb51"="C:\WINDOWS\system32\vukaihpk.dll" [ ] "SpyHunter Security Suite"="C:\Programme\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2008-01-23 14:47 847872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 16:00 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcAPFwv] efcAPFwv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gemsafe] C:\Programme\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll 2006-11-16 17:20 73728 C:\Programme\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify] PCANotify.dll 2004-11-05 12:50 8704 C:\WINDOWS\system32\PCANotify.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiHacker] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Programme\\Gemeinsame Dateien\\Siemens\\SQLANY\\dbsrv9.exe"= "C:\\Programme\\Siemens\\SIMATIC WinCC flexible\\WinCC flexible 2007\\TraceServer.exe"= "C:\\Programme\\Gemeinsame Dateien\\Siemens\\SQLANY\\dbeng9.exe"= "C:\\WINDOWS\\system32\\IBHLink.exe"= "C:\\WINDOWS\\system32\\winver.exe"= "C:\\Programme\\Afinion\\Afinion Project Viewer\\PViewer\\jre\\launch4j-tmp\\VMStarter.exe"= "C:\\Programme\\Skype\\Phone\\Skype.exe"= "C:\\Programme\\BitTorrent\\bittorrent.exe"= R0 PBADRV;PBADRV;C:\WINDOWS\system32\DRIVERS\PBADRV.sys [2007-09-07 11:57] R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 12:35] R1 SpyEmrg;Spy Emergency Driver;C:\WINDOWS\system32\Drivers\spyemrg.sys [2008-02-05 12:10] R2 Dpmtrcdd;Dpmtrcdd;C:\WINDOWS\system32\DRIVERS\dpmtrcdd.sys [2007-06-25 16:47] R2 s7snsrtx;PROFINET IO RT-Protocol;C:\WINDOWS\system32\DRIVERS\s7snsrtx.sys [2007-07-30 13:06] R2 SNTIE;SIMATIC Industrial Ethernet (ISO);C:\WINDOWS\system32\DRIVERS\sntie.sys [2007-08-10 10:34] R2 TcCam;TwinCAT CAM Server;C:\TwinCAT\Driver\TcCam.sys [2008-03-11 13:25] R2 TcIo;TwinCAT IO Server;C:\TwinCAT\Driver\TcIo.sys [2008-03-13 13:25] R2 TcNc;TwinCAT NC Server;C:\TwinCAT\Driver\TcNc.sys [2007-12-08 13:25] R2 TcPlc;TwinCAT IEC1131 Server;C:\TwinCAT\Driver\TcPlc.sys [2007-12-06 14:23] R2 TcRouter;TwinCAT Router Server;C:\TwinCAT\Driver\TcRouter.sys [2007-08-20 13:25] R2 TcRTime;TwinCAT Realtime Server;C:\TwinCAT\Driver\TcRTime.sys [2008-03-13 13:25] R2 WavxDMgr;WavxDMgr;C:\WINDOWS\system32\DRIVERS\WavxDMgr.sys [2007-09-10 11:55] R3 DXEC01;DXEC01;C:\WINDOWS\system32\drivers\dxec01.sys [2006-11-02 14:32] R3 fwkbdrtm;fwkbdrtm;C:\WINDOWS\system32\drivers\fwkbdrtm.sys [2007-07-19 21:56] R3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;C:\WINDOWS\system32\Drivers\spyemrg_guard.sys [2008-02-05 12:10] R3 WaveFDE;Wave System Power Monitor Device Driver;C:\WINDOWS\system32\DRIVERS\WaveFDE.sys [2007-09-06 11:18] S2 qandr;qandr;C:\WINDOWS\system32\drivers\qandr.sys [] S3 dpmcslv;dpmcslv;C:\WINDOWS\system32\drivers\dpmcslv.sys [2005-07-04 17:04] S3 s7oefs_x;SIMATIC MPI/EFS Driver;C:\WINDOWS\system32\drivers\s7oefs_x.sys [2002-10-18 03:34] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-10 22:16:03 Windows 5.1.2600 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostart Eintr„ge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Programme\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Programme\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll PROCESS: C:\WINDOWS\explorer.exe -> C:\Programme\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll . ------------------------ Other Running Processes ------------------------ . C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\WLTRYSVC.EXE C:\WINDOWS\system32\BCMWLTRY.EXE C:\WINDOWS\system32\scardsvr.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe C:\Programme\Broadcom\ASFIPMon\AsfIpMon.exe C:\Programme\Symantec AntiVirus\DefWatch.exe C:\Programme\Microsoft SQL Server\MSSQL$WINCCFLEXIBLE\Binn\sqlservr.exe C:\Programme\Dell\QuickSet\NicConfigSvc.exe C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe C:\Programme\Symantec AntiVirus\SavRoam.exe C:\Programme\Spyware Doctor\pctsAuxs.exe C:\Programme\Spyware Doctor\pctsSvc.exe C:\Programme\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe C:\Programme\Microsoft SQL Server\MSSQL$WINCCFLEXIBLE\Binn\sqlagent.EXE C:\WINDOWS\system32\stacsv.exe C:\Programme\Symantec AntiVirus\Rtvscan.exe C:\TwinCAT\EventLogger\TcEventLogger.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Programme\DellTPad\ApMsgFwd.exe C:\Programme\DellTPad\ApntEx.exe C:\Programme\DellTPad\hidfind.exe C:\TwinCAT\TCATSysSrv.exe C:\Programme\Gemeinsame Dateien\Siemens\SWS\almsrv\almsrvx.exe C:\Programme\Gemeinsame Dateien\Siemens\ALMPanelPlugin\ALMPanelPlugin.exe C:\Programme\Gemeinsame Dateien\Siemens\SQLANY\dbsrv9.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Programme\Digital Line Detect\DLG.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe . ************************************************************************** . Zeit der Fertigstellung: 2008-06-10 22:21:59 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-10 20:21:51 16 Verzeichnis(se), 106,870,046,720 Bytes frei 20 Verzeichnis(se), 106,731,327,488 Bytes frei 332 --- E O F --- 2008-05-20 13:23:13 HIJACKTHIS Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:42, on 2008-06-10 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe C:\Programme\Broadcom\ASFIPMon\AsfIpMon.exe C:\Programme\Symantec AntiVirus\DefWatch.exe C:\Programme\Microsoft SQL Server\MSSQL$WINCCFLEXIBLE\Binn\sqlservr.exe C:\Programme\Dell\QuickSet\NICCONFIGSVC.exe C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe C:\Programme\Symantec AntiVirus\SavRoam.exe C:\Programme\Spyware Doctor\pctsAuxs.exe C:\Programme\Spyware Doctor\pctsSvc.exe C:\Programme\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe C:\Programme\Microsoft SQL Server\MSSQL$WINCCFLEXIBLE\Binn\sqlagent.EXE C:\WINDOWS\system32\StacSV.exe C:\Programme\Symantec AntiVirus\Rtvscan.exe C:\TwinCAT\EventLogger\TcEventLogger.exe C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\TwinCAT\TCATSysSrv.exe C:\Programme\Gemeinsame Dateien\Siemens\sws\almsrv\almsrvx.exe C:\WINDOWS\Explorer.EXE C:\Programme\Gemeinsame Dateien\Siemens\ALMPanelPlugin\ALMPanelPlugin.exe C:\Programme\DellTPad\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\igfxpers.exe C:\Programme\DellTPad\ApMsgFwd.exe C:\Programme\DellTPad\Apntex.exe C:\Programme\DellTPad\HidFind.exe C:\Programme\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Programme\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Programme\Dell\QuickSet\quickset.exe C:\WINDOWS\system32\WLTRAY.exe C:\Programme\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Programme\Wave Systems Corp\SecureUpgrade.exe C:\WINDOWS\system32\KADxMain.exe C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Programme\Roxio\Drag-to-Disc\DrgToDsc.exe C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Programme\Gemeinsame Dateien\Siemens\S7ubtoox\s7ubtstx.exe C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Programme\Digital Line Detect\DLG.exe C:\Programme\Gemeinsame Dateien\Siemens\Sqlany\dbsrv9.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mainsrv/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/default.aspx?c=at&l=de&s=gen O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Programme\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [WavXMgr] C:\Programme\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe O4 - HKLM\..\Run: [SecureUpgrade] C:\Programme\Wave Systems Corp\SecureUpgrade.exe O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Programme\Roxio\Drag-to-Disc\DrgToDsc.exe" O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Programme\CyberLink\PowerDVD DX\PDVDDXSrv.exe" O4 - HKLM\..\Run: [S7UB Start] "C:\Programme\Gemeinsame Dateien\Siemens\S7ubtoox\s7ubtstx.exe" -StartDB O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DeskCal] C:\PROGRA~1\DESKTO~1\\DeskCal.exe "C:\PROGRA~1\DESKTO~1\" O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [WinCC flexible Smart Start] "C:\Programme\Siemens\SIMATIC WinCC flexible\WinCC flexible 2007\HmiSmartStart.exe" /startup O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [BM5323cb51] Rundll32.exe "C:\WINDOWS\system32\vukaihpk.dll",s O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Programme\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Rainlendar2] C:\Programme\Rainlendar2\Rainlendar2.exe O4 - HKCU\..\Run: [AquaSoft PhotoKalender] "C:\PROGRA~1\AquaSoft\DESKTO~1\DESKTO~1.EXE" "-p|Photokalender.ads" "-t|3 Monate unregelmäßig.pwt" O4 - HKCU\..\Run: [CoolCalendar] C:\Programme\CooSoft\Cool Calendar\CoolCalendar.exe O4 - HKCU\..\Run: [SpyEmergency] "C:\Programme\NETGATE\Spy Emergency 2008\SpyEmergency.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = C:\Programme\Digital Line Detect\DLG.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = saa.local O17 - HKLM\Software\..\Telephony: DomainName = saa.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = saa.local O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: efcAPFwv - efcAPFwv.dll (file missing) O20 - Winlogon Notify: gemsafe - C:\Programme\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe O23 - Service: Automation License Manager Service (almservice) - SIEMENS AG - C:\Programme\Gemeinsame Dateien\Siemens\sws\almsrv\almsrvx.exe O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Programme\Broadcom\ASFIPMon\AsfIpMon.exe O23 - Service: pcAnywhere Host-Modul (awhost32) - Symantec Corporation - C:\Programme\Symantec\pcAnywhere\awhost32.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programme\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Programme\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: S7 Global Services (s7asysvx) - SIEMENS AG - C:\Programme\Siemens\Step7\S7BIN\s7asysvx.exe O23 - Service: SIMATIC IEPG Help Service (s7oiehsx) - SIEMENS AG - C:\Programme\Gemeinsame Dateien\Siemens\S7IEPG\s7oiehsx.exe O23 - Service: S7TraceServiceX - SIEMENS AG - C:\Programme\Gemeinsame Dateien\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programme\Symantec AntiVirus\SavRoam.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Programme\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Programme\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programme\Symantec AntiVirus\Rtvscan.exe O23 - Service: TcEventLogger - Unknown owner - C:\TwinCAT\EventLogger\TcEventLogger.exe O23 - Service: TwinCAT Nc Interpreter (TcNcI) - Beckhoff GmbH - C:\TwinCAT\CNC\TcNcI.exe O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Programme\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe O23 - Service: TdmService - Wave Systems Corp. - C:\Programme\Wave Systems Corp\Trusted Drive Manager\TdmService.exe O23 - Service: TwinCAT System Service - BECKHOFF Automation - C:\TwinCAT\TCATSysSrv.exe O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Programme\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 13155 bytes DATFIND Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 5010-F862 Verzeichnis von C:\WINDOWS\system32 2008-06-10 16:26 25,926 ikhcore.log 2008-06-09 09:59 428,738 perfh009.dat 2008-06-09 09:59 73,062 perfc009.dat 2008-06-09 09:59 445,044 perfh007.dat 2008-06-09 09:59 86,868 perfc007.dat 2008-06-09 09:59 1,046,366 PerfStringBackup.INI 2008-06-09 09:05 2,206 wpa.dbl 2008-05-20 15:23 118 MRT.INI 2008-05-20 11:19 29 ytwrhgsp.tmp 2008-05-20 11:19 18,432 svchpg6.exe 2008-05-20 10:50 56 ezsidmv.dat 2008-05-09 23:35 16,863,864 MRT.exe 2008-05-08 11:10 44,032 TABCTL32.oca 2008-05-08 11:10 36,352 COMDLG32.oca 2008-05-08 11:10 77,312 MSFLXGRD.oca 2008-05-08 11:10 267,264 MSCOMCTL.oca 2008-05-04 20:38 323,520 FNTCACHE.DAT 2008-05-03 17:15 23,096 sremcon.exe 2008-04-29 13:43 25,600 MSCOMM32.oca 2008-04-29 13:42 45,568 AdsOcx.oca 2008-04-29 13:42 241,664 comctl32.oca 2008-04-29 13:42 64,512 shdocvw.oca 2008-03-25 06:51 621,344 mswstr10.dll 2008-03-25 06:51 187,168 msjint40.dll 2008-03-25 06:50 355,104 msxbde40.dll 2008-03-25 06:50 838,432 mswdat10.dll 2008-03-25 06:50 264,992 mstext40.dll 2008-03-25 06:50 559,904 msrepl40.dll 2008-03-25 06:50 322,336 msrd3x40.dll 2008-03-25 06:50 432,928 msrd2x40.dll 2008-03-25 06:50 355,104 mspbde40.dll 2008-03-25 06:50 219,936 msltus40.dll 2008-03-25 06:50 248,608 msjtes40.dll 2008-03-25 06:50 60,192 msjter40.dll 2008-03-25 06:50 355,112 msjetoledb40.dll 2008-03-25 06:50 1,516,568 msjet40.dll 2008-03-25 06:50 326,432 msexcl40.dll 2008-03-25 06:50 518,944 msexch40.dll 2008-03-20 10:03 1,845,376 win32k.sys 2008-03-18 10:47 274,495 TcAdsDll.dll 2008-03-15 17:01 23,392 nscompat.tlb 2008-03-15 17:01 16,832 amcompat.tlb 2008-03-07 20:02 50,458 interceptor.sys 2008-03-07 20:02 45,056 WNASPI32.DLL 2008-03-06 11:53 266,114 TZLog.log 2008-03-04 13:57 664 d3d9caps.dat 2008-03-04 12:00 0 sntieno.log 2008-03-04 11:57 403 $winnt$.inf Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 5010-F862 Verzeichnis von C:\WINDOWS 2008-06-10 22:47 4,081 sremcon_drivers.dat 2008-06-10 22:47 248 sremcon_winlogon.dat 2008-06-10 22:47 1,766 sremcon_startup.dat 2008-06-10 22:34 55,701 WindowsUpdate.log 2008-06-10 22:33 0 0.log 2008-06-10 22:32 4,604 ModemLog_Conexant HDA D330 MDC V.92 Modem.txt 2008-06-10 22:31 2,048 bootstat.dat 2008-06-10 22:30 32,556 SchedLgU.Txt 2008-06-10 22:30 4,605 wincmd.ini 2008-06-10 22:15 227 system.ini 2008-06-10 09:49 142 BM5323cb51.xml 2008-05-20 11:41 63 vbaddin.ini 2008-05-04 14:42 69 UtahS7Integrate.ini 2008-04-29 09:05 103,614 BM5323cb51.txt 2008-04-25 09:05 422 ODBC.INI 2008-04-03 09:50 6,983 citamis.str 2008-03-17 11:35 4,161 ODBCINST.INI 2008-03-17 11:34 1,309 vb.ini 2008-03-15 17:01 635 win.ini 2008-03-14 18:07 316,640 WMSysPr9.prx 2008-03-14 15:55 99 WirelessFTP.INI 2008-03-11 15:32 21,243 WinCCflexOCX12.TXT 2008-03-11 15:30 0 HmiRTmSim.INI 2008-03-10 12:51 0 VPC32.INI 2008-03-07 21:38 1,167 mozver.dat 2008-03-06 11:04 0 nsreg.dat 2008-03-04 12:07 131,007 instreport.txt Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 5010-F862 Verzeichnis von C:\WINDOWS\temp 2008-06-10 22:32 0 JET73E.tmp 2008-06-10 22:32 0 T30DebugLogFile.txt 2008-06-10 22:32 16,384 Perflib_Perfdata_1e0.dat 2008-06-10 22:17 0 JET6080.tmp 4 Datei(en) 16,384 Bytes 0 Verzeichnis(se), 106,746,277,888 Bytes frei . . . Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 5010-F862 Verzeichnis von C:\WINDOWS\Downloaded Program Files 2004-08-13 14:53 65 desktop.ini 2004-07-27 18:48 323,584 isusweb.dll 2002-07-25 20:13 24,576 dwusplay.dll 2002-07-25 20:13 196,608 dwusplay.exe 2000-01-20 16:25 1,162 Microsoft XML Parser for Java.osd 5 Datei(en) 545,995 Bytes 0 Verzeichnis(se), 106,746,277,888 Bytes frei