abnow.com, dauer Bluescreen, was kann ich noch machen

maggus2012 · 27.02.2012, 15:23

Hallo Board!

Hab mir wohl einen Trojaner/Virus namens abnow.com eingefangen. Bin echt verzweifelt! Schreibe an dem Rechner gerade meine Dissertation. PC nur noch im Bluescreen.

Rechner: Laptop; Acer Aspire Timeline, I3,
System: Win7 64bit home premium
Hinweis:Kein CD-laufwerk vorhanden
wichtigsten Dateien teilweise per Dropbox gesichert

Alles ging schnell. beim googeln bin ich immer auf abnow.com gelandet. Erst nur Firefox, dann auch IE.

Habe dann den Hinweis auf eine Software gefunden. Endet auf "...Doctor" (grünes Icon in der Taskleiste). Installiert und laufen lassen. Hat in allen drei angezeigten Gebieten etwas gefunden. Das war jeweils mit "leichte Gefahrenstufe" gekennzeichnet. Beim Systemscan habe ich kurz auf Pause gedrückt. 2 Minuten später BlueScreen.

seither fährt sich der Rechner hoch. Passwort für Win eingeben. Kurze Ladezeit und wieder Bluescreen. Abgesicherter Modus ebenfalls.

Was kann und muss ich tun Leute? Meine Prioritäten:
Priorität 1 = Datensicherung (Dissertation, Mails/Outlook, sonstige Dateien)
Priorität 2 = System wieder zum laufen bringen.

Kann mir jemand von euch Könnern helfen? Was kann ich tun? Muss ich mir sorgen um Passwörter etc. machen (OnlineShopping, -Banking)?

Habt vielen vielen Danke für jede Art von Hinweis, Hilfe und und und... Wenn noch Infos notwendig sind, bitte sagen - ich werde mein bestes tun. Danke!

Grüße
Maggus

Psychotic · 27.02.2012, 15:31

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld

Gruß,
PsYcHoTiC

maggus2012 · 27.02.2012, 15:37

Danke für deine schnelle Antwort! Das bringt mich schon mal ein wenig runter. Bin gerade fix und alle.

Psychotic · 27.02.2012, 18:12

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scans durchführen zu denen du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
Poste die Logfiles direkt in deinen Thread. Nicht anhängen, außer, ich fordere dich dazu auf. Erschwert mir nämlich das Auswerten.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1: FRST

Downloade dir bitte Farbar's Recovery Scan Tool x64
und speichere diese auf einen USB Stick.

Schließe den USB Stick an das infizierte System an

Du musst das System nun in die System Reparatur Option booten.

Über den Boot Manager

Starte den Rechner neu auf.
Während dem Hochfahren drücke mehrmals die F8 Taste
Wähle nun Computer reparieren.
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD

Lege die Windows CD in dein Laufwerk.
Starte den Rechner neu auf und starte von der CD
Wähle die Spracheinstellungen und klicke "Weiter".
Klicke auf Computerreparaturoptionen !!
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.
Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
Schließe Notepad wieder
Gib nun bitte folgenden Befehl ein.
e:\frst.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

maggus2012 · 27.02.2012, 19:52

Danke für die Anleitung. Ich habe versucht diese auszuführen. Der Code der Auswertung folgt unten. Einmal mehr ein großes DANKE vorab.

Folgendes kann ich für die Beschreibung ergänzen:

Es sind bei mir nicht "Computerreperaturoptionen" erschienen, sondern "Systemwiederherstellungsoptionen". Die Eingabeaufforderung war in der Liste enthalten.
Die frst.exe heißt tatsächlich frst64.exe.
Der Scanvorgang wurde erst beim 2. Start ausgeführt.

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool Version: 27-02-2012
Ran by SYSTEM at 27-02-2012 19:45:31
Running from F:\
Windows 7 Home Premium   (X64) OS Language: German Standard 
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-22] (Alcor Micro Corp.)
HKLM\...\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [x]
HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [166424 2010-04-21] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [391192 2010-04-21] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [413720 2010-04-21] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [9996320 2010-01-19] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3 [877600 2010-01-19] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [585376 2010-05-25] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [354464 2010-05-25] (Atheros Commnucations)
HKLM\...\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe [345648 2010-03-08] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2010-02-02] (Acer Incorporated)
HKLM\...\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2306448 2010-07-21] (Microsoft Corporation)
HKLM\...\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent [x]
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1680976 2010-10-28] (Logitech, Inc.)
HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2399632 2011-04-13] (Microsoft Corporation)
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k [260608 2010-03-08] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d [201512 2009-12-24] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [401192 2009-12-24] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-04-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [960080 2010-05-25] (Dritek System Inc.)
HKLM-x32\...\Run: [MDS_Menu] "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso" UpdateWithCreateOnce "Software\CyberLink\MediaShow Espresso\5.6" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [ArcadeMovieService] "C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe" [124136 2010-04-23] (CyberLink Corp.)
HKLM-x32\...\Run: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2010-12-07] (Google)
HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [31072 2008-10-25] (Microsoft Corporation)
HKLM-x32\...\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start [63360 2010-12-08] (DivX, LLC)
HKLM-x32\...\Run: [Win7PDF] C:\Program Files\PDF Printer for Windows 7\PDF.exe [x]
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-28] ()
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-07] (Apple Inc.)
HKLM-x32\...\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe [220744 2011-12-16] (Geek Software GmbH)
HKLM-x32\...\Run: [ISTray] "C:\Program Files (x86)\PC Tools\PC Tools Security\pctsGui.exe" /hideGUI [2659768 2012-01-11] (PC Tools)
HKU\wilogs\...\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s [929168 2011-11-08] (Samsung)
HKU\wilogs\...\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3508624 2011-11-08] (Samsung Electronics Co., Ltd.)
HKU\wilogs\...\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2011-11-08] ()
HKU\wilogs\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59240 2011-11-11] (Apple Inc.)
HKU\wilogs\...\Run: [Copernic Desktop Search - Home] "C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [1648600 2011-11-22] (Copernic Inc.)
HKU\wilogs\...\Run: [Remote Control Editor] "C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe" [x]
HKU\wilogs\...\Winlogon: [Shell] C:\Users\wilogs\AppData\Local\f1be3786\X [38912 2012-02-26] ()
HKLM\...\Runonce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [x]
Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
AppInit_DLLs:   
SubSystems: [Windows] ==> ZeroAccess

==================== Services (Whitelisted) ======

2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [47776 2010-05-25] (Atheros Commnucations)
2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [462184 2011-08-30] (Apple Inc.)
2 Browser Defender Update Service; "C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe" [546768 2012-01-16] (Threat Expert Ltd.)
2 crystalaps; \\.\globalrootC:\Windows\system32\svchost.exe -k netsvcs [27136 2009-07-13] (Microsoft Corporation)
2 DsiWMIService; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [325200 2010-05-25] (Dritek System Inc.)
2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [820768 2010-02-02] (Acer Incorporated)
3 GoogleDesktopManager-051210-111108; "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [30192 2010-12-07] (Google)
2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
3 LBTServ; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [357456 2010-10-28] (Logitech, Inc.)
2 lvtuner; C:\Windows\System32\msftpsvc.dll [5120 2009-07-13] (Iomega)
2 lxcg_device; \\.\globalrootC:\Windows\system32\svchost.exe -k netsvcs [27136 2009-07-13] (Microsoft Corporation)
3 Microsoft Office Groove Audit Service; "C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe" [65888 2008-10-25] (Microsoft Corporation)
2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [250368 2010-03-08] (NewTech Infosystems, Inc.)
2 RichVideo; "C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe" [244904 2010-02-03] ()
2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated)
2 sdAuxService; C:\Program Files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [402336 2012-01-11] (PC Tools)
2 sdCoreService; C:\Program Files (x86)\PC Tools\PC Tools Security\pctsSvc.exe [1117624 2012-01-11] (PC Tools)
2 UNS; "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe" [2320920 2010-03-03] (Intel Corporation)

========================== Drivers (Whitelisted) =============

3 amdkmdag; C:\Windows\System32\DRIVERS\atipmdag.sys [6406144 2010-04-21] (ATI Technologies Inc.)
3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [38248 2010-05-20] (Atheros)
3 ATHDFU; C:\Windows\System32\Drivers\AthDfu.sys [55336 2010-05-20] (Windows (R) Win 7 DDK provider)
3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [294760 2010-05-20] (Atheros)
3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [32296 2010-05-20] (Atheros)
3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [202792 2010-05-20] (Atheros)
3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [52584 2010-05-20] (Atheros)
3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [156392 2010-05-20] (Atheros)
3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [264040 2010-05-25] (Atheros)
3 CYDTV_SRV; C:\Windows\System32\drivers\cydtv.sys [576480 2010-07-13] ( )
3 intelkmd; C:\Windows\System32\DRIVERS\igdpmd64.sys [10322848 2010-04-21] (Intel Corporation)
3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [63568 2010-08-24] (Logitech, Inc.)
3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [57936 2010-08-24] (Logitech, Inc.)
3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-08-02] (Apple Inc.)
3 PCTBD; C:\Windows\System32\Drivers\PCTBD64.sys [70760 2011-09-28] (PC Tools)
0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [367912 2011-11-14] (PC Tools)
0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [453896 2011-12-01] (PC Tools)
0 pctEFA; C:\Windows\System32\drivers\pctEFA64.sys [1096688 2011-12-01] (PC Tools)
1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [230952 2012-01-11] (PC Tools)

========================== NetSvcs (Whitelisted) ===========
NETSVC: smbusp
NETSVC: lvtuner

============ One Month Created Files and Folders ==============

2012-02-27 07:03 - 2012-02-27 07:03 - 0278224 ____A C:\Windows\Minidump\022712-73757-01.dmp
2012-02-27 07:00 - 2012-02-27 07:00 - 0278224 ____A C:\Windows\Minidump\022712-54303-01.dmp
2012-02-27 06:57 - 2012-02-27 06:57 - 0270472 ____A C:\Windows\Minidump\022712-52712-01.dmp
2012-02-27 06:54 - 2012-02-27 06:54 - 0278280 ____A C:\Windows\Minidump\022712-56269-01.dmp
2012-02-27 06:51 - 2012-02-27 06:51 - 0278280 ____A C:\Windows\Minidump\022712-50123-01.dmp
2012-02-27 05:20 - 2012-02-27 05:20 - 0278448 ____A C:\Windows\Minidump\022712-18548-01.dmp
2012-02-27 05:16 - 2012-02-27 05:16 - 0270472 ____A C:\Windows\Minidump\022712-28532-01.dmp
2012-02-27 05:14 - 2012-02-27 05:14 - 0278448 ____A C:\Windows\Minidump\022712-18142-01.dmp
2012-02-27 05:12 - 2012-02-27 05:12 - 0278448 ____A C:\Windows\Minidump\022712-28204-01.dmp
2012-02-27 04:46 - 2012-02-27 04:46 - 0002251 ____A C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk
2012-02-27 04:46 - 2012-02-27 04:46 - 0000000 ____D C:\Program Files (x86)\PC Tools
2012-02-27 04:46 - 2012-01-16 07:28 - 2246608 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2012-02-27 04:46 - 2012-01-16 07:28 - 1681360 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2012-02-27 04:46 - 2012-01-16 07:28 - 0767952 ____A C:\Windows\BDTSupport.dll
2012-02-27 04:46 - 2012-01-16 07:28 - 0149456 ____A (PC Tools) C:\Windows\SGDetectionTool.dll
2012-02-27 04:46 - 2012-01-11 07:19 - 0092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys
2012-02-27 04:46 - 2012-01-11 07:17 - 0014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys
2012-02-27 04:46 - 2012-01-11 07:14 - 0339608 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys
2012-02-27 04:46 - 2012-01-11 07:14 - 0145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys
2012-02-27 04:46 - 2011-09-28 04:14 - 0070760 ____A (PC Tools) C:\Windows\System32\Drivers\PCTBD64.sys
2012-02-27 04:46 - 2011-05-17 06:47 - 0003488 ____A C:\Windows\UDB.zip
2012-02-27 04:46 - 2010-08-20 01:50 - 0000882 ____A C:\Windows\RegSDImport.xml
2012-02-27 04:46 - 2010-01-22 00:44 - 0000879 ____A C:\Windows\RegISSImport.xml
2012-02-27 04:46 - 2008-11-26 03:08 - 0000131 ____A C:\Windows\IDB.zip
2012-02-27 04:44 - 2012-02-27 04:44 - 1768896 ____A C:\Windows\System32\Drivers\Cat.DB
2012-02-27 04:44 - 2012-01-11 07:19 - 0230952 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys
2012-02-27 04:44 - 2011-12-01 07:07 - 1096688 ____A (PC Tools) C:\Windows\System32\Drivers\pctEFA64.sys
2012-02-27 04:44 - 2011-12-01 07:07 - 0453896 ____A (PC Tools) C:\Windows\System32\Drivers\pctDS64.sys
2012-02-27 04:44 - 2011-11-14 06:12 - 0367912 ____A (PC Tools) C:\Windows\System32\Drivers\PCTCore64.sys
2012-02-27 04:43 - 2012-02-27 04:46 - 0000000 ____D C:\Users\All Users\PC Tools
2012-02-27 04:43 - 2012-02-27 04:46 - 0000000 ____D C:\ProgramData\PC Tools
2012-02-27 04:43 - 2012-02-27 04:43 - 0002601 ____A C:\Users\wilogs\Desktop\sd9setup[1].exe.lnk
2012-02-27 04:43 - 2012-02-27 04:43 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\TestApp
2012-02-27 03:55 - 2012-02-27 03:55 - 0438158 ____A C:\Users\wilogs\Desktop\LAH_Dispo_Direkt_V2.docx
2012-02-27 02:13 - 2012-02-27 02:25 - 0719836 ____A C:\Users\wilogs\Desktop\Sortiment Screenshots.pptx
2012-02-27 00:01 - 2012-02-27 00:01 - 0000000 __SHD C:\Windows\System32\%APPDATA%
2012-02-26 23:58 - 2012-02-27 07:03 - 0000000 __ASH C:\Windows\System32\dds_log_trash.cmd
2012-02-26 23:53 - 2012-02-26 23:56 - 0000000 __SHD C:\Users\wilogs\AppData\Local\f1be3786
2012-02-24 01:48 - 2012-02-24 01:48 - 4226142 ____A C:\Users\wilogs\Downloads\Somebody That I Used to Know - Walk off the Earth (Gotye - Cover).mp3
2012-02-24 01:47 - 2012-02-24 01:47 - 3999065 ____A C:\Users\wilogs\Downloads\Radio 538 Gotye - Somebody That I Used To Know (Jeroen Nieuwenhuize remix).mp4.mp3
2012-02-24 01:47 - 2012-02-24 01:47 - 3906278 ____A C:\Users\wilogs\Downloads\Gotye Ft. Kimbra - Somebody That I Used To Know ( Dimenson Vocal House Remix 2012 ).mp3
2012-02-24 01:46 - 2012-02-24 01:46 - 3907532 ____A C:\Users\wilogs\Downloads\Gotye- Somebody That I Used To Know feat. Kimbra 720p.mp3
2012-02-23 08:33 - 2012-02-23 08:33 - 0010948 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120223_0833808.csv
2012-02-23 01:28 - 2012-02-23 01:28 - 0179788 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.3.pdf
2012-02-23 01:27 - 2012-02-23 01:27 - 0461065 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.2.pdf
2012-02-22 01:59 - 2012-02-22 01:59 - 0001156 ____A C:\Users\wilogs\Downloads\vorlage-koederseite.zip
2012-02-21 11:13 - 2012-01-04 01:59 - 14164480 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-02-21 11:13 - 2012-01-04 01:58 - 0509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-02-21 11:13 - 2012-01-04 01:03 - 12868096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-02-21 11:13 - 2012-01-04 01:03 - 0442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2012-02-21 11:13 - 2012-01-02 22:24 - 0515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-02-21 11:13 - 2012-01-02 21:44 - 0478208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2012-02-21 11:04 - 2012-01-13 20:02 - 3143168 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-02-21 11:04 - 2011-12-27 19:59 - 0499200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2012-02-21 11:04 - 2011-11-16 23:17 - 0152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-02-21 11:04 - 2011-11-16 23:17 - 0095088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-02-21 11:04 - 2011-11-16 23:15 - 0460296 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-02-21 11:04 - 2011-11-16 23:12 - 0395776 ____A (Microsoft Corporation) C:\Windows\System32\webio.dll
2012-02-21 11:04 - 2011-11-16 23:11 - 0136192 ____A (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2012-02-21 11:04 - 2011-11-16 23:11 - 0028672 ____A (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2012-02-21 11:04 - 2011-11-16 23:11 - 0028160 ____A (Microsoft Corporation) C:\Windows\System32\secur32.dll
2012-02-21 11:04 - 2011-11-16 23:10 - 0340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-02-21 11:04 - 2011-11-16 23:08 - 1446912 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2012-02-21 11:04 - 2011-11-16 23:05 - 0031232 ____A (Microsoft Corporation) C:\Windows\System32\lsass.exe
2012-02-21 11:04 - 2011-11-16 21:39 - 0314368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2012-02-21 11:04 - 2011-11-16 21:39 - 0224768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2012-02-21 11:04 - 2011-11-16 21:39 - 0022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2012-02-21 11:04 - 2011-11-16 21:35 - 0096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2012-02-21 11:04 - 2011-10-25 21:22 - 1572864 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
2012-02-21 11:04 - 2011-10-25 21:22 - 0366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-02-21 11:04 - 2011-10-25 21:19 - 0043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2012-02-21 11:04 - 2011-10-25 20:28 - 1328640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2012-02-21 11:04 - 2011-10-25 20:28 - 0514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-02-21 11:01 - 2011-12-16 00:42 - 0634368 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
2012-02-21 11:01 - 2011-12-15 23:59 - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2012-02-21 11:01 - 2011-10-14 22:25 - 0723456 ____A (Microsoft Corporation) C:\Windows\System32\EncDec.dll
2012-02-21 11:01 - 2011-10-14 21:48 - 0534528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2012-02-21 11:00 - 2011-12-16 00:45 - 1501184 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-02-21 11:00 - 2011-12-16 00:45 - 1197568 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-02-21 11:00 - 2011-12-16 00:45 - 0134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-02-21 11:00 - 2011-12-16 00:42 - 9335296 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-02-21 11:00 - 2011-12-16 00:42 - 1026560 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2012-02-21 11:00 - 2011-12-16 00:42 - 0703488 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-02-21 11:00 - 2011-12-16 00:42 - 0097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-02-21 11:00 - 2011-12-16 00:42 - 0082944 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-02-21 11:00 - 2011-12-16 00:41 - 0064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-02-21 11:00 - 2011-12-16 00:41 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-02-21 11:00 - 2011-12-16 00:40 - 2458624 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-02-21 11:00 - 2011-12-16 00:40 - 12372480 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-02-21 11:00 - 2011-12-16 00:40 - 0445952 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-02-21 11:00 - 2011-12-16 00:40 - 0256000 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-02-21 11:00 - 2011-12-16 00:40 - 0247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-02-21 11:00 - 2011-12-16 00:38 - 0012288 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-02-21 11:00 - 2011-12-16 00:02 - 1230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-02-21 11:00 - 2011-12-16 00:02 - 0981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-02-21 11:00 - 2011-12-16 00:02 - 0132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-02-21 11:00 - 2011-12-15 23:59 - 5999104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-02-21 11:00 - 2011-12-15 23:59 - 0606208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2012-02-21 11:00 - 2011-12-15 23:59 - 0599552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-02-21 11:00 - 2011-12-15 23:59 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-02-21 11:00 - 2011-12-15 23:59 - 0064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2012-02-21 11:00 - 2011-12-15 23:58 - 2072576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-02-21 11:00 - 2011-12-15 23:58 - 10991104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-02-21 11:00 - 2011-12-15 23:58 - 0381440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2012-02-21 11:00 - 2011-12-15 23:58 - 0185856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2012-02-21 11:00 - 2011-12-15 23:58 - 0176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-02-21 11:00 - 2011-12-15 23:58 - 0048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-02-21 11:00 - 2011-12-15 23:58 - 0044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2012-02-21 11:00 - 2011-12-15 23:56 - 0012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2012-02-21 11:00 - 2011-12-15 23:26 - 0482816 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-02-21 11:00 - 2011-12-15 22:49 - 0386048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2012-02-21 11:00 - 2011-12-15 22:43 - 1638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-02-21 11:00 - 2011-12-15 22:15 - 1638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-02-21 11:00 - 2011-11-16 23:14 - 1739160 ____A (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2012-02-21 11:00 - 2011-11-16 21:41 - 1292592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2012-02-21 11:00 - 2011-11-04 21:17 - 0002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2012-02-21 11:00 - 2011-11-04 20:30 - 0002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2012-02-21 10:58 - 2011-11-19 07:07 - 0077312 ____A (Microsoft Corporation) C:\Windows\System32\packager.dll
2012-02-21 10:58 - 2011-11-19 06:06 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2012-02-21 09:28 - 2012-02-21 09:28 - 0272191 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4 1.pdf
2012-02-19 02:43 - 2012-02-19 04:09 - 0000000 ____D C:\Users\wilogs\Desktop\Besuchermatrix_Bilder
2012-02-19 02:06 - 2012-02-19 02:06 - 0141619 ____A C:\Users\wilogs\Downloads\mod_super_login_J1.7_J2.5_v2.5.0.zip
2012-02-19 01:22 - 2012-02-19 01:30 - 4510449 ____A C:\Users\wilogs\Downloads\jsn_epic_docs(1).zip
2012-02-19 00:42 - 2012-02-19 00:42 - 1389328 ____A C:\Users\wilogs\Downloads\com_jce_2021.zip
2012-02-19 00:38 - 2012-02-19 00:38 - 0017578 ____A C:\Users\wilogs\Downloads\plg_extravote.zip
2012-02-19 00:28 - 2012-02-19 00:28 - 0811287 ____A C:\Users\wilogs\Downloads\jsn_epic_pro_unlimited_j2.5_4.3.0_install.zip
2012-02-18 02:22 - 2012-02-21 05:43 - 0017232 ____A C:\Users\wilogs\Desktop\Stoff_Ausschuss_Verschrottung.docx
2012-02-17 03:11 - 2012-02-17 03:11 - 0000000 ____D C:\Users\wilogs\Downloads\BoxofBundles01
2012-02-17 01:56 - 2012-02-17 02:55 - 216698241 ____A C:\Users\wilogs\Downloads\BoxofBundles01.zip
2012-02-16 12:12 - 2012-02-16 12:13 - 0755197 ____A (ErstenWare                                                  ) C:\Users\wilogs\Downloads\signcrtr.exe
2012-02-16 11:31 - 2012-02-16 12:04 - 0010866 ____A C:\Users\wilogs\Desktop\Qualitative_Kennzahlen.xlsx
2012-02-16 04:22 - 2012-02-16 04:22 - 0077159 ____A C:\Users\wilogs\Desktop\Musterartikel-für-die-redaktionelle-Einbindung-bei-Publishern.pdf
2012-02-16 03:39 - 2012-02-21 01:48 - 0000000 ____D C:\Users\wilogs\Desktop\Bewertung Monetär
2012-02-15 23:41 - 2012-02-15 23:41 - 0003177 ____A C:\Users\wilogs\Downloads\press9-joomla.zip
2012-02-15 23:33 - 2012-02-15 23:44 - 170203312 ____A C:\Users\wilogs\Downloads\VideoSpin_2_0_Setup_2_.exe
2012-02-15 10:19 - 2012-02-15 10:19 - 0002636 ____A C:\Users\wilogs\Downloads\hider_plugin_content_v1_51.zip
2012-02-15 05:36 - 2012-02-15 05:36 - 0029463 ____A C:\Users\wilogs\Downloads\readlesstext_1.5(1).zip
2012-02-15 05:33 - 2012-02-15 05:33 - 0039388 ____A C:\Users\wilogs\Downloads\readlesstext_1.5.zip
2012-02-15 04:43 - 2012-02-15 04:43 - 2187836 ____A C:\Users\wilogs\Downloads\com_pinme_pinboard_3.1.4.zip
2012-02-14 08:52 - 2012-02-14 08:52 - 0118063 ____A C:\Users\wilogs\Downloads\com_rsmonials_153_J15.zip
2012-02-14 08:52 - 2012-02-14 08:52 - 0006244 ____A C:\Users\wilogs\Downloads\mod_rsmonialscroller_1532_J15.zip
2012-02-14 08:52 - 2012-02-14 08:52 - 0004122 ____A C:\Users\wilogs\Downloads\mod_rsmonials_1531_J15.zip
2012-02-14 08:50 - 2012-02-14 08:50 - 0018921 ____A C:\Users\wilogs\Downloads\plg_extravote_15.zip
2012-02-14 08:36 - 2012-02-14 08:36 - 0003095 ____A C:\Users\wilogs\Downloads\plgSearchReviews_3.0.12_final.zip
2012-02-14 08:35 - 2012-02-14 08:35 - 0625919 ____A C:\Users\wilogs\Downloads\com_simple_review-3.0.9_final_joomla1.5_1.6.zip
2012-02-14 08:35 - 2012-02-14 08:35 - 0005339 ____A C:\Users\wilogs\Downloads\mod_simple_review_latest-3.0.5_final_joomla1.5_1.6.zip
2012-02-14 03:47 - 2012-02-15 00:06 - 0035506 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120214_0347353.csv
2012-02-11 07:40 - 2012-02-11 07:40 - 0040181 ____A C:\Users\wilogs\Downloads\Fotolia_33589002_XS.jpg
2012-02-11 07:26 - 2012-02-11 07:26 - 0010591 ____A C:\Users\wilogs\Downloads\Mustersiegel_2.jpg
2012-02-11 07:23 - 2012-02-11 07:23 - 0004924 ____A C:\Users\wilogs\Downloads\Mustersiegel.jpg
2012-02-09 06:24 - 2012-02-09 06:24 - 0013806 ____A C:\Users\wilogs\Documents\hs_err_pid6692.log
2012-02-07 12:03 - 2012-02-27 06:54 - 0857890 ____A C:\Windows\ntbtlog.txt
2012-02-07 12:03 - 2012-02-07 12:03 - 0922360 ____A C:\Windows\Minidump\020712-15802-01.dmp
2012-02-06 22:15 - 2012-02-06 22:15 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Beschreibung_Bewertung.pptx
2012-02-05 00:12 - 2012-02-05 00:12 - 0044571 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Kontoauszug_Nr._1.pdf
2012-02-05 00:12 - 2012-02-05 00:12 - 0044499 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Kontoauszug_Nr._4.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037894 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._10.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037879 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._7.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037767 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._9.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037751 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._8.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037708 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._5.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037479 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._11.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037471 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._6.pdf
2012-01-28 00:52 - 2012-02-27 07:03 - 0000000 ____D C:\Windows\Minidump
2012-01-28 00:52 - 2012-01-28 00:52 - 1056600 ____A C:\Windows\Minidump\012812-36847-01.dmp
2012-01-28 00:51 - 2012-02-27 07:03 - 341535227 ____A C:\Windows\MEMORY.DMP
2012-01-28 00:48 - 2012-01-28 00:48 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Microsoft Office PowerPoint-Präsentation (neu).pptx


============ 3 Months Modified Files and Folders =============

2012-02-27 19:45 - 2012-02-27 19:45 - 0000000 ____D C:\FRST
2012-02-27 07:03 - 2012-02-27 07:03 - 0278224 ____A C:\Windows\Minidump\022712-73757-01.dmp
2012-02-27 07:03 - 2012-02-26 23:58 - 0000000 __ASH C:\Windows\System32\dds_log_trash.cmd
2012-02-27 07:03 - 2012-01-28 00:52 - 0000000 ____D C:\Windows\Minidump
2012-02-27 07:03 - 2012-01-28 00:51 - 341535227 ____A C:\Windows\MEMORY.DMP
2012-02-27 07:03 - 2009-07-13 21:08 - 0000006 ___AH C:\Windows\Tasks\SA.DAT
2012-02-27 07:03 - 2009-07-13 20:51 - 0136381 ____A C:\Windows\setupact.log
2012-02-27 07:02 - 2010-09-16 08:44 - 2960461824 __ASH C:\hiberfil.sys
2012-02-27 07:00 - 2012-02-27 07:00 - 0278224 ____A C:\Windows\Minidump\022712-54303-01.dmp
2012-02-27 06:57 - 2012-02-27 06:57 - 0270472 ____A C:\Windows\Minidump\022712-52712-01.dmp
2012-02-27 06:54 - 2012-02-27 06:54 - 0278280 ____A C:\Windows\Minidump\022712-56269-01.dmp
2012-02-27 06:54 - 2012-02-07 12:03 - 0857890 ____A C:\Windows\ntbtlog.txt
2012-02-27 06:51 - 2012-02-27 06:51 - 0278280 ____A C:\Windows\Minidump\022712-50123-01.dmp
2012-02-27 05:23 - 2010-12-07 06:30 - 0000043 ____A C:\Users\Public\Documents\AtherosServiceConfig.ini
2012-02-27 05:20 - 2012-02-27 05:20 - 0278448 ____A C:\Windows\Minidump\022712-18548-01.dmp
2012-02-27 05:16 - 2012-02-27 05:16 - 0270472 ____A C:\Windows\Minidump\022712-28532-01.dmp
2012-02-27 05:14 - 2012-02-27 05:14 - 0278448 ____A C:\Windows\Minidump\022712-18142-01.dmp
2012-02-27 05:12 - 2012-02-27 05:12 - 0278448 ____A C:\Windows\Minidump\022712-28204-01.dmp
2012-02-27 05:08 - 2010-09-16 08:51 - 1684466 ____A C:\Windows\WindowsUpdate.log
2012-02-27 04:54 - 2010-12-07 16:10 - 0000000 ____D C:\Users\wilogs\AppData\Local\CrashDumps
2012-02-27 04:50 - 2011-10-30 16:15 - 0000000 ____D C:\Users\wilogs\AppData\Local\E60B6EBC-B67B-440A-96ED-0C586EB6C24E.aplzod
2012-02-27 04:49 - 2010-12-07 07:22 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Dropbox
2012-02-27 04:46 - 2012-02-27 04:46 - 0002251 ____A C:\Users\Public\Desktop\PC Tools Spyware Doctor.lnk
2012-02-27 04:46 - 2012-02-27 04:46 - 0000000 ____D C:\Program Files (x86)\PC Tools
2012-02-27 04:46 - 2012-02-27 04:43 - 0000000 ____D C:\Users\All Users\PC Tools
2012-02-27 04:46 - 2012-02-27 04:43 - 0000000 ____D C:\ProgramData\PC Tools
2012-02-27 04:44 - 2012-02-27 04:44 - 1768896 ____A C:\Windows\System32\Drivers\Cat.DB
2012-02-27 04:43 - 2012-02-27 04:43 - 0002601 ____A C:\Users\wilogs\Desktop\sd9setup[1].exe.lnk
2012-02-27 04:43 - 2012-02-27 04:43 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\TestApp
2012-02-27 04:08 - 2010-12-07 13:49 - 0000000 ____D C:\Users\All Users\boost_interprocess
2012-02-27 04:08 - 2010-12-07 13:49 - 0000000 ____D C:\ProgramData\boost_interprocess
2012-02-27 04:05 - 2012-01-24 11:43 - 0000000 ____D C:\Windows\tessdata
2012-02-27 03:55 - 2012-02-27 03:55 - 0438158 ____A C:\Users\wilogs\Desktop\LAH_Dispo_Direkt_V2.docx
2012-02-27 02:33 - 2009-07-13 20:45 - 0017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-02-27 02:33 - 2009-07-13 20:45 - 0017600 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-02-27 02:27 - 2010-12-07 07:24 - 0000000 ___RD C:\Users\wilogs\Documents\My Dropbox
2012-02-27 02:26 - 2010-05-10 15:15 - 0040788 ____A C:\Windows\PFRO.log
2012-02-27 02:25 - 2012-02-27 02:13 - 0719836 ____A C:\Users\wilogs\Desktop\Sortiment Screenshots.pptx
2012-02-27 01:40 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\NDF
2012-02-27 00:09 - 2009-07-13 18:34 - 0001398 _RASH C:\Windows\System32\Drivers\etc\hosts
2012-02-27 00:01 - 2012-02-27 00:01 - 0000000 __SHD C:\Windows\System32\%APPDATA%
2012-02-26 23:57 - 2011-07-01 06:13 - 0414368 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-02-26 23:56 - 2012-02-26 23:53 - 0000000 __SHD C:\Users\wilogs\AppData\Local\f1be3786
2012-02-26 23:06 - 2011-05-28 01:24 - 0000000 ____D C:\Users\wilogs\AppData\Local\Paint.NET
2012-02-24 22:59 - 2010-12-07 13:50 - 0000000 ____D C:\Users\wilogs\Documents\Bluetooth Folder
2012-02-24 03:03 - 2010-12-07 15:03 - 0001016 ____A C:\Users\wilogs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2012-02-24 03:03 - 2010-12-07 15:01 - 0000669 ____A C:\Windows\wininit.ini
2012-02-24 01:48 - 2012-02-24 01:48 - 4226142 ____A C:\Users\wilogs\Downloads\Somebody That I Used to Know - Walk off the Earth (Gotye - Cover).mp3
2012-02-24 01:47 - 2012-02-24 01:47 - 3999065 ____A C:\Users\wilogs\Downloads\Radio 538 Gotye - Somebody That I Used To Know (Jeroen Nieuwenhuize remix).mp4.mp3
2012-02-24 01:47 - 2012-02-24 01:47 - 3906278 ____A C:\Users\wilogs\Downloads\Gotye Ft. Kimbra - Somebody That I Used To Know ( Dimenson Vocal House Remix 2012 ).mp3
2012-02-24 01:46 - 2012-02-24 01:46 - 3907532 ____A C:\Users\wilogs\Downloads\Gotye- Somebody That I Used To Know feat. Kimbra 720p.mp3
2012-02-23 14:46 - 2010-12-07 07:05 - 0000000 ___RD C:\Users\wilogs\Desktop\Privat
2012-02-23 13:20 - 2010-12-07 07:14 - 0000000 ___RD C:\wilogs
2012-02-23 08:33 - 2012-02-23 08:33 - 0010948 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120223_0833808.csv
2012-02-23 01:28 - 2012-02-23 01:28 - 0179788 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.3.pdf
2012-02-23 01:27 - 2012-02-23 01:27 - 0461065 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4.2.pdf
2012-02-22 01:59 - 2012-02-22 01:59 - 0001156 ____A C:\Users\wilogs\Downloads\vorlage-koederseite.zip
2012-02-21 21:50 - 2010-12-07 06:28 - 0000174 ___SH C:\Users\wilogs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
2012-02-21 21:44 - 2009-07-13 20:45 - 0412992 ____A C:\Windows\System32\FNTCACHE.DAT
2012-02-21 12:01 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\SysWOW64\de-DE
2012-02-21 12:01 - 2009-07-13 19:20 - 0000000 ____D C:\Windows\System32\de-DE
2012-02-21 09:28 - 2012-02-21 09:28 - 0272191 ____A C:\Users\wilogs\Desktop\JS_Diss_Kapitel_4 1.pdf
2012-02-21 05:43 - 2012-02-18 02:22 - 0017232 ____A C:\Users\wilogs\Desktop\Stoff_Ausschuss_Verschrottung.docx
2012-02-21 01:48 - 2012-02-16 03:39 - 0000000 ____D C:\Users\wilogs\Desktop\Bewertung Monetär
2012-02-21 01:20 - 2010-12-07 07:43 - 0011539 ____A C:\Users\wilogs\gsview64.ini
2012-02-19 04:09 - 2012-02-19 02:43 - 0000000 ____D C:\Users\wilogs\Desktop\Besuchermatrix_Bilder
2012-02-19 02:06 - 2012-02-19 02:06 - 0141619 ____A C:\Users\wilogs\Downloads\mod_super_login_J1.7_J2.5_v2.5.0.zip
2012-02-19 01:30 - 2012-02-19 01:22 - 4510449 ____A C:\Users\wilogs\Downloads\jsn_epic_docs(1).zip
2012-02-19 00:42 - 2012-02-19 00:42 - 1389328 ____A C:\Users\wilogs\Downloads\com_jce_2021.zip
2012-02-19 00:38 - 2012-02-19 00:38 - 0017578 ____A C:\Users\wilogs\Downloads\plg_extravote.zip
2012-02-19 00:28 - 2012-02-19 00:28 - 0811287 ____A C:\Users\wilogs\Downloads\jsn_epic_pro_unlimited_j2.5_4.3.0_install.zip
2012-02-18 09:38 - 2010-12-07 07:36 - 0000000 ____D C:\Program Files (x86)\Mozilla Firefox
2012-02-17 12:47 - 2010-09-16 18:39 - 0644328 ____A C:\Windows\System32\perfh007.dat
2012-02-17 12:47 - 2010-09-16 18:39 - 0126574 ____A C:\Windows\System32\perfc007.dat
2012-02-17 12:47 - 2009-07-13 21:13 - 1473532 ____A C:\Windows\System32\PerfStringBackup.INI
2012-02-17 03:11 - 2012-02-17 03:11 - 0000000 ____D C:\Users\wilogs\Downloads\BoxofBundles01
2012-02-17 02:55 - 2012-02-17 01:56 - 216698241 ____A C:\Users\wilogs\Downloads\BoxofBundles01.zip
2012-02-16 12:13 - 2012-02-16 12:12 - 0755197 ____A (ErstenWare                                                  ) C:\Users\wilogs\Downloads\signcrtr.exe
2012-02-16 12:04 - 2012-02-16 11:31 - 0010866 ____A C:\Users\wilogs\Desktop\Qualitative_Kennzahlen.xlsx
2012-02-16 04:22 - 2012-02-16 04:22 - 0077159 ____A C:\Users\wilogs\Desktop\Musterartikel-für-die-redaktionelle-Einbindung-bei-Publishern.pdf
2012-02-16 03:42 - 2012-01-05 12:21 - 0018271 ____A C:\Users\wilogs\Desktop\Diss_Timer.xlsx
2012-02-15 23:44 - 2012-02-15 23:33 - 170203312 ____A C:\Users\wilogs\Downloads\VideoSpin_2_0_Setup_2_.exe
2012-02-15 23:41 - 2012-02-15 23:41 - 0003177 ____A C:\Users\wilogs\Downloads\press9-joomla.zip
2012-02-15 10:19 - 2012-02-15 10:19 - 0002636 ____A C:\Users\wilogs\Downloads\hider_plugin_content_v1_51.zip
2012-02-15 05:36 - 2012-02-15 05:36 - 0029463 ____A C:\Users\wilogs\Downloads\readlesstext_1.5(1).zip
2012-02-15 05:33 - 2012-02-15 05:33 - 0039388 ____A C:\Users\wilogs\Downloads\readlesstext_1.5.zip
2012-02-15 04:43 - 2012-02-15 04:43 - 2187836 ____A C:\Users\wilogs\Downloads\com_pinme_pinboard_3.1.4.zip
2012-02-15 00:06 - 2012-02-14 03:47 - 0035506 ____A C:\Users\wilogs\Downloads\keyword_ideas_20120214_0347353.csv
2012-02-14 08:52 - 2012-02-14 08:52 - 0118063 ____A C:\Users\wilogs\Downloads\com_rsmonials_153_J15.zip
2012-02-14 08:52 - 2012-02-14 08:52 - 0006244 ____A C:\Users\wilogs\Downloads\mod_rsmonialscroller_1532_J15.zip
2012-02-14 08:52 - 2012-02-14 08:52 - 0004122 ____A C:\Users\wilogs\Downloads\mod_rsmonials_1531_J15.zip
2012-02-14 08:50 - 2012-02-14 08:50 - 0018921 ____A C:\Users\wilogs\Downloads\plg_extravote_15.zip
2012-02-14 08:36 - 2012-02-14 08:36 - 0003095 ____A C:\Users\wilogs\Downloads\plgSearchReviews_3.0.12_final.zip
2012-02-14 08:35 - 2012-02-14 08:35 - 0625919 ____A C:\Users\wilogs\Downloads\com_simple_review-3.0.9_final_joomla1.5_1.6.zip
2012-02-14 08:35 - 2012-02-14 08:35 - 0005339 ____A C:\Users\wilogs\Downloads\mod_simple_review_latest-3.0.5_final_joomla1.5_1.6.zip
2012-02-13 12:02 - 2011-02-17 22:24 - 0000000 ____D C:\Users\wilogs\AppData\Local\ElevatedDiagnostics
2012-02-11 10:23 - 2010-12-07 23:10 - 0000326 ____A C:\Windows\EasyCT.INI
2012-02-11 07:40 - 2012-02-11 07:40 - 0040181 ____A C:\Users\wilogs\Downloads\Fotolia_33589002_XS.jpg
2012-02-11 07:26 - 2012-02-11 07:26 - 0010591 ____A C:\Users\wilogs\Downloads\Mustersiegel_2.jpg
2012-02-11 07:23 - 2012-02-11 07:23 - 0004924 ____A C:\Users\wilogs\Downloads\Mustersiegel.jpg
2012-02-09 06:24 - 2012-02-09 06:24 - 0013806 ____A C:\Users\wilogs\Documents\hs_err_pid6692.log
2012-02-07 12:03 - 2012-02-07 12:03 - 0922360 ____A C:\Windows\Minidump\020712-15802-01.dmp
2012-02-06 22:15 - 2012-02-06 22:15 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Beschreibung_Bewertung.pptx
2012-02-05 00:12 - 2012-02-05 00:12 - 0044571 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Kontoauszug_Nr._1.pdf
2012-02-05 00:12 - 2012-02-05 00:12 - 0044499 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Kontoauszug_Nr._4.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037894 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._10.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037879 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._7.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037767 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._9.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037751 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._8.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037708 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._5.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037479 ____A C:\Users\wilogs\Downloads\2012-02-05_09.11_8307865_Mitteilung_Nr._11.pdf
2012-02-05 00:11 - 2012-02-05 00:11 - 0037471 ____A C:\Users\wilogs\Downloads\2011-11-15_21.46_8307865_Mitteilung_Nr._6.pdf
2012-01-29 23:35 - 2011-04-21 11:58 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Canon
2012-01-28 20:10 - 2010-12-07 07:17 - 0279656 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2012-01-28 00:52 - 2012-01-28 00:52 - 1056600 ____A C:\Windows\Minidump\012812-36847-01.dmp
2012-01-28 00:48 - 2012-01-28 00:48 - 0000165 ___AH C:\Users\wilogs\Desktop\~$Microsoft Office PowerPoint-Präsentation (neu).pptx
2012-01-26 15:41 - 2010-12-07 23:03 - 54585368 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-01-25 11:52 - 2012-01-25 11:52 - 0016627 ____A C:\Users\wilogs\Downloads\Gewinnspiel_original_Foto.jpg
2012-01-25 11:42 - 2012-01-25 11:42 - 0016154 ____A C:\Users\wilogs\Downloads\Umfragen_Gewinnspiel.jpg
2012-01-24 11:42 - 2012-01-24 11:42 - 0159757 ____A (Free OCR) C:\Users\wilogs\Downloads\freeocr.exe
2012-01-24 10:59 - 2010-12-07 07:27 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Skype
2012-01-24 10:38 - 2010-12-07 08:05 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\skypePM
2012-01-24 10:38 - 2010-12-07 07:27 - 0000000 ___RD C:\Program Files (x86)\Skype
2012-01-24 10:38 - 2010-12-07 07:27 - 0000000 ____D C:\Users\All Users\Skype
2012-01-24 10:38 - 2010-12-07 07:27 - 0000000 ____D C:\ProgramData\Skype
2012-01-23 23:23 - 2011-12-23 10:41 - 0000000 ____D C:\Users\wilogs\Desktop\A5 Anschaffung
2012-01-23 08:14 - 2011-11-11 06:21 - 0000000 ____D C:\Users\wilogs\Desktop\2011_11_15_I-VK-42_Inhalte
2012-01-19 23:32 - 2012-01-19 23:32 - 0002787 ____A C:\Users\wilogs\Downloads\mod_amazon_banner_1.5.zip
2012-01-19 23:32 - 2012-01-19 23:32 - 0002787 ____A C:\Users\wilogs\Downloads\mod_amazon_banner_1.5(1).zip
2012-01-19 22:45 - 2012-01-19 22:40 - 0000000 ___RD C:\Users\wilogs\Desktop\Bibliothek
2012-01-16 07:28 - 2012-02-27 04:46 - 2246608 ____A (Threat Expert Ltd.) C:\Windows\PCTBDCore.dll
2012-01-16 07:28 - 2012-02-27 04:46 - 1681360 ____A (Threat Expert Ltd.) C:\Windows\PCTBDRes.dll
2012-01-16 07:28 - 2012-02-27 04:46 - 0767952 ____A C:\Windows\BDTSupport.dll
2012-01-16 07:28 - 2012-02-27 04:46 - 0149456 ____A (PC Tools) C:\Windows\SGDetectionTool.dll
2012-01-13 20:02 - 2012-02-21 11:04 - 3143168 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-01-11 23:32 - 2012-01-11 23:32 - 0000000 ____D C:\Windows\System32\Macromed
2012-01-11 12:45 - 2012-01-11 12:45 - 12852642 ____A C:\Users\wilogs\Downloads\16-gesetze-napoleon-hill.zip
2012-01-11 07:19 - 2012-02-27 04:46 - 0092896 ____A (PC Tools) C:\Windows\System32\Drivers\pctplsg64.sys
2012-01-11 07:19 - 2012-02-27 04:44 - 0230952 ____A (PC Tools) C:\Windows\System32\Drivers\PCTSD64.sys
2012-01-11 07:17 - 2012-02-27 04:46 - 0014776 ____A (PC Tools) C:\Windows\System32\Drivers\pctBTFix64.sys
2012-01-11 07:14 - 2012-02-27 04:46 - 0339608 ____A (PC Tools) C:\Windows\System32\Drivers\pctgntdi64.sys
2012-01-11 07:14 - 2012-02-27 04:46 - 0145432 ____A (PC Tools) C:\Windows\System32\Drivers\pctwfpfilter64.sys
2012-01-09 23:38 - 2012-01-06 00:45 - 0001242 ____A C:\Users\wilogs\Desktop\iPhonePhotos.lnk
2012-01-09 23:37 - 2012-01-09 23:36 - 0002600 ____A C:\Users\wilogs\Desktop\Diss_Images_PDF.lnk
2012-01-09 23:35 - 2012-01-09 23:34 - 0002758 ____A C:\Users\wilogs\Desktop\Diss_Images_Orignal.lnk
2012-01-07 09:06 - 2010-12-29 05:05 - 0000034 ____A C:\Windows\cdplayer.ini
2012-01-07 08:56 - 2012-01-07 08:46 - 0000000 ____D C:\Users\wilogs\Desktop\zufall
2012-01-04 01:59 - 2012-02-21 11:13 - 14164480 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-01-04 01:58 - 2012-02-21 11:13 - 0509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
2012-01-04 01:03 - 2012-02-21 11:13 - 12868096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-01-04 01:03 - 2012-02-21 11:13 - 0442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2012-01-02 22:24 - 2012-02-21 11:13 - 0515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
2012-01-02 21:44 - 2012-02-21 11:13 - 0478208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2011-12-30 12:06 - 2011-11-21 14:14 - 0000000 ____D C:\Program Files (x86)\Android
2011-12-30 12:00 - 2010-12-07 06:27 - 0000000 ____D C:\Users\wilogs\AppData\LocalLow
2011-12-30 11:58 - 2011-12-03 08:57 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\TerraTec
2011-12-27 19:59 - 2012-02-21 11:04 - 0499200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2011-12-27 14:17 - 2011-12-27 14:16 - 17299192 ____A ({code:GDConstant|CompanyName}                               ) C:\Users\wilogs\Downloads\RecoverMyFiles-Setup-German.exe
2011-12-23 10:39 - 2011-05-16 04:11 - 0000000 ____D C:\Program Files (x86)\PDF24
2011-12-22 22:20 - 2009-07-13 21:08 - 0032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2011-12-21 04:29 - 2011-12-21 04:29 - 52580303 ____A C:\Users\wilogs\Downloads\Schatzkammer Gratistemplate.zip
2011-12-21 04:29 - 2011-12-21 04:29 - 2500346 ____A C:\Users\wilogs\Downloads\Gruene-Blaetter.zip
2011-12-19 03:22 - 2010-12-07 06:28 - 0109232 ____A C:\Users\wilogs\AppData\Local\GDIPFONTCACHEV1.DAT
2011-12-19 00:18 - 2010-12-07 08:34 - 0000000 ____D C:\Users\All Users\Microsoft Help
2011-12-19 00:18 - 2010-12-07 08:34 - 0000000 ____D C:\ProgramData\Microsoft Help
2011-12-19 00:15 - 2009-07-13 18:34 - 0000478 ____A C:\Windows\win.ini
2011-12-18 02:21 - 2011-12-18 02:21 - 0000000 ____D C:\Program Files\iTunes
2011-12-18 02:21 - 2011-12-18 02:21 - 0000000 ____D C:\Program Files\iPod
2011-12-18 02:21 - 2011-01-05 09:23 - 0000000 ____D C:\Program Files (x86)\iTunes
2011-12-18 02:18 - 2011-12-18 02:18 - 0000000 ____D C:\Program Files (x86)\QuickTime
2011-12-18 02:17 - 2011-01-11 13:32 - 0000000 ____D C:\Users\wilogs\AppData\Roaming\Apple Computer
2011-12-16 00:45 - 2012-02-21 11:00 - 1501184 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2011-12-16 00:45 - 2012-02-21 11:00 - 1197568 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2011-12-16 00:45 - 2012-02-21 11:00 - 0134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2011-12-16 00:42 - 2012-02-21 11:01 - 0634368 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
2011-12-16 00:42 - 2012-02-21 11:00 - 9335296 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2011-12-16 00:42 - 2012-02-21 11:00 - 1026560 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2011-12-16 00:42 - 2012-02-21 11:00 - 0703488 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2011-12-16 00:42 - 2012-02-21 11:00 - 0097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2011-12-16 00:42 - 2012-02-21 11:00 - 0082944 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2011-12-16 00:41 - 2012-02-21 11:00 - 0064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2011-12-16 00:41 - 2012-02-21 11:00 - 0057856 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2011-12-16 00:40 - 2012-02-21 11:00 - 2458624 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2011-12-16 00:40 - 2012-02-21 11:00 - 12372480 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2011-12-16 00:40 - 2012-02-21 11:00 - 0445952 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2011-12-16 00:40 - 2012-02-21 11:00 - 0256000 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2011-12-16 00:40 - 2012-02-21 11:00 - 0247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2011-12-16 00:38 - 2012-02-21 11:00 - 0012288 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2011-12-16 00:02 - 2012-02-21 11:00 - 1230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2011-12-16 00:02 - 2012-02-21 11:00 - 0981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2011-12-16 00:02 - 2012-02-21 11:00 - 0132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2011-12-15 23:59 - 2012-02-21 11:01 - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2011-12-15 23:59 - 2012-02-21 11:00 - 5999104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2011-12-15 23:59 - 2012-02-21 11:00 - 0606208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2011-12-15 23:59 - 2012-02-21 11:00 - 0599552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2011-12-15 23:59 - 2012-02-21 11:00 - 0067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2011-12-15 23:59 - 2012-02-21 11:00 - 0064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2011-12-15 23:58 - 2012-02-21 11:00 - 2072576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2011-12-15 23:58 - 2012-02-21 11:00 - 10991104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2011-12-15 23:58 - 2012-02-21 11:00 - 0381440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2011-12-15 23:58 - 2012-02-21 11:00 - 0185856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2011-12-15 23:58 - 2012-02-21 11:00 - 0176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2011-12-15 23:58 - 2012-02-21 11:00 - 0048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2011-12-15 23:58 - 2012-02-21 11:00 - 0044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2011-12-15 23:56 - 2012-02-21 11:00 - 0012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2011-12-15 23:26 - 2012-02-21 11:00 - 0482816 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2011-12-15 22:49 - 2012-02-21 11:00 - 0386048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2011-12-15 22:43 - 2012-02-21 11:00 - 1638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2011-12-15 22:15 - 2012-02-21 11:00 - 1638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2011-12-13 10:34 - 2011-12-13 10:34 - 0165156 ____A C:\Users\wilogs\Downloads\06leas.zip
2011-12-11 10:44 - 2011-12-11 10:44 - 3090412 ____A C:\Users\wilogs\Downloads\TheConradRangaliIslandTheOverWaterSpa2.jpg
2011-12-06 23:29 - 2011-12-06 23:29 - 0035707 ____A C:\Users\wilogs\Documents\qry_RTNR_Summe_1E_V1.xlsx
2011-12-05 12:39 - 2010-12-07 23:27 - 0000000 ___RD C:\Privat
2011-12-04 01:23 - 2011-12-04 01:23 - 0000664 ____A C:\Users\wilogs\Downloads\KD_Muenchen_neu.ini
2011-12-03 10:59 - 2011-12-03 10:59 - 0031114 ____A C:\Users\wilogs\Downloads\dvb-c_de_Landshut-I_KDG.conf
2011-12-03 10:59 - 2011-12-03 10:59 - 0023958 ____A C:\Users\wilogs\Downloads\lamedb
2011-12-03 10:59 - 2011-12-03 10:58 - 0014555 ____A C:\Users\wilogs\Downloads\export.zip
2011-12-03 10:59 - 2011-12-03 10:58 - 0007646 ____A C:\Users\wilogs\Downloads\export(1).zip
2011-12-03 10:47 - 2011-12-03 10:47 - 0117915 ____A C:\Users\wilogs\Downloads\Astra_DVB-S.chl
2011-12-03 09:04 - 2011-12-03 09:04 - 0000000 ____D C:\Program Files\Common Files\TerraTec
2011-12-03 09:04 - 2010-05-10 15:06 - 0000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2011-12-02 01:37 - 2011-11-22 22:49 - 0000000 ____D C:\Users\wilogs\Desktop\SD_Karte Save Arbeit
2011-12-01 07:07 - 2012-02-27 04:44 - 1096688 ____A (PC Tools) C:\Windows\System32\Drivers\pctEFA64.sys
2011-12-01 07:07 - 2012-02-27 04:44 - 0453896 ____A (PC Tools) C:\Windows\System32\Drivers\pctDS64.sys
2011-12-01 00:13 - 2011-12-01 00:12 - 0000000 ____D C:\Users\wilogs\Desktop\IEF71

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe
[2011-06-30 13:33] - [2011-02-25 21:33] - 2614784 ____A (Microsoft Corporation) 2AF58D15EDC06EC6FDACCE1F19482BBF

C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

========================= Memory info ====================== 

Percentage of memory in use: 18%
Total physical RAM: 3764.43 MB
Available physical RAM: 3063.81 MB
Total Pagefile: 3762.57 MB
Available Pagefile: 3054.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: (Festplatte) (Fixed) (Total:452.97 GB) (Free:333.54 GB) NTFS
2 Drive e: (PQSERVICE) (Fixed) (Total:12.7 GB) (Free:2.56 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive f: (ACHTUNG_DIS) (Removable) (Total:1.87 GB) (Free:1.87 GB) FAT
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

  Datentr„ger ###  Status         Gr”áe    Frei     Dyn  GPT
  ---------------  -------------  -------  -------  ---  ---
  Datentr„ger 0    Online          465 GB      0 B         
  Datentr„ger 1    Online         1912 MB      0 B         

Datentr„gerpartitionierung wird beendet...


==========================================================

Last Boot: 2012-02-21 07:36

======================= End Of Log ==========================

Psychotic · 27.02.2012, 23:53

Fix mit FRST

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

SubSystems: [Windows] ==> ZeroAccess
C:\Users\wilogs\AppData\Local\f1be3786

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST64.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

maggus2012 · 28.02.2012, 07:05

Guten morgen Marius,

Danke dir zu deiner Antwort gestern in später Stunde.

Nachfolgend der Code nach der Aktion Fixlist.txt

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 27-02-2012
Ran by SYSTEM at 2012-02-28 07:00:02 R:1
Running from F:\

==============================================

HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored.
C:\Users\wilogs\AppData\Local\f1be3786 moved successfully.

==== End of Fixlog ====

Vielen vielen Dank. Gruß und einen erfolgreichen Tag.
Maggus

Psychotic · 28.02.2012, 11:00

Bekommst du immer noch bluescreens?

maggus2012 · 28.02.2012, 11:19

Hallo Marius!

hab die Kiste heruntergefahren und neu gestartet. Ergebnis: Bluescreen wenige Sekunden nach dem Login.

Danach gestartet im abgesicherten Modus. Ergebnis: Bluescreen nach ca.45-60 Sekunden. Das "Hilfe und Support von Microsoft" Fenster war vollständig geladen.

Erneut hochgefahren (regulär) und bei Login n i c h t angemeldet, sondern Button zum ordnungsgemäßen herunterfahren genutzt. Beim runterfahren wieder Bluescreen.

"Fehlersuche" oder Eingrenzung meinerseits...
Habe noch einmal die ersten Schritte von frst64.exe ausgeführt und folgendes gesehen! Nach der Auswahl der Sprache kommt ein Fenster, dass es mir ermöglicht einen Benutzer auszuwählen und ein Passwort anzugeben.

In diesem Feld steht einmal "HomeGroupUsers$" und einmal der Name, dem ich dem Gerät einmal verpasst habe. >>> Der Scan und Fix sind jeweils über den vergebenen Computernamen gelaufen. Das Passwort meines regulären Windows Login hatte ich hier jeweils angegeben. Korrekt?

Schließt sich die Frage an, ob ich Scan und ggf. Fix über "HomeGroupUsers$" laufen lassen soll/muss? Und, ob hier oder generell eine Passwortangabe erfoderlich ist?

Ein weiteres Mal herzlichen Dank Marius und dem Trojaner-Board-Team!

Maggus

Psychotic · 28.02.2012, 20:06

Fix mit FRST

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\wilogs\...\Winlogon: [Shell] C:\Users\wilogs\AppData\Local\f1be3786\X
2 lvtuner; C:\Windows\System32\msftpsvc.dll [5120 2009-07-13] (Iomega)
SubSystems: [Windows] ==> ZeroAccess
NETSVC: lvtuner
C:\Users\wilogs\AppData\Local\f1be3786
C:\Windows\System32\msftpsvc.dll
C:\Windows\System32\%APPDATA%

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

maggus2012 · 28.02.2012, 23:10

Hallo Marius!

Unten das Log. für den erneuten Fix von dir.

Erster Start nach dem erneuten frst64.exe-Fix, Windows im abgesicherten Modus: läuft! Es wird das Fenster angezeigt: "Win wird nach unerwartetem Herunterfahren wieder ausgeführt. ... kan online nach Lösung Suchen ..." Ich habe "später suchen" angeklickt, da keine Internetverbindung zustandekam.

Neustart ausgewählt...

Starten von Windows regulär: läuft!!!

WLAN habe ich deaktiviert. Festplatte arbeitet kräftig und dauerhaft. Programme lassen sich öffnen (z.B. Outlook)

Damit wäre schon mal viel geschaft. Erneut ein großes Danke!!!

Wie ist es vernünftig weiter zu machen? Erst sichern mit der Gefahr den Trojaner/Virus mit zu ziehen? Oder erst den Schädling bekämpfen - vor allem wie.

Auch hier bin ich wieder auf deine Hiilfe angewiesen. Ich hoffe du kannst mich weiter unterstützen.

Grüße
Maggus

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (FRST written by farbar) Version: 27-02-2012
Ran by SYSTEM at 2012-02-28 22:54:07 R:2
Running from F:\

==============================================

HKEY_USERS\wilogs\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
lvtuner service deleted successfully.
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs lvtuner Deleted successfully.
C:\Users\wilogs\AppData\Local\f1be3786 not found.
C:\Windows\System32\msftpsvc.dll moved successfully.
C:\Windows\System32\%APPDATA% moved successfully.

==== End of Fixlog ====

Psychotic · 29.02.2012, 10:17

Hallo maggus2012,

du hast dir eine sehr hartnäckige Variante des ZeroAccess-Rootkits eingefangen. Arbeite weiter mit, um den Rechner vollständig sauber zu bekommen.

Combofix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

starte den Rechner einfach neu. Dies sollte das Problem beheben.

maggus2012 · 29.02.2012, 15:01

Hallo Marius!

Nächster Schritt geschaft.

Nachfolgend die log von ComboFix. Warte auf deine nächsten Instruktionen.

Erneut Danke und Gruß Maggus2012

Code:

ATTFilter

ComboFix 12-02-29.01 - wilogs 29.02.2012  14:31:50.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3764.2407 [GMT 1:00]
ausgeführt von:: c:\users\wilogs\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\wilogs\AppData\Local\assembly\tmp
c:\users\wilogs\AppData\Local\Temp\b3ac04aa-9413-4ecb-ac45-ed44495e62a6\CliSecureRT.dll
c:\users\wilogs\AppData\Roaming\Local
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\.ddr
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\3.ddi
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\Folge_13_-_Traum_und_Wirklichkeit.avi.ddr
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\How_I_Met_Your_Mother_-_S02E09_-_Schlag_auf_Schlag.avi.ddr
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\isd-himym-s02e20rp.avi.ddr
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Folge_13_-_Traum_und_Wirklichkeit.avi
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\How_I_Met_Your_Mother_-_S02E09_-_Schlag_auf_Schlag.avi
c:\users\wilogs\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\isd-himym-s02e20rp.avi
c:\users\wilogs\g2mdlhlpx.exe
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\assembly\tmp\U
c:\windows\mstray.exe
c:\windows\Mstray1.exe
c:\windows\system32\dds_log_trash.cmd
c:\windows\SysWow64\muzapp.exe
c:\windows\SysWow64\system32
c:\windows\SysWow64\system32\3DAudio.ax
c:\windows\SysWow64\system32\avrt.dll
c:\windows\SysWow64\system32\cis-2.4.dll
c:\windows\SysWow64\system32\issacapi_bs-2.3.dll
c:\windows\SysWow64\system32\issacapi_pe-2.3.dll
c:\windows\SysWow64\system32\issacapi_se-2.3.dll
c:\windows\SysWow64\system32\MACXMLProto.dll
c:\windows\SysWow64\system32\MaDRM.dll
c:\windows\SysWow64\system32\MaJGUILib.dll
c:\windows\SysWow64\system32\MAMACExtract.dll
c:\windows\SysWow64\system32\MASetupCleaner.exe
c:\windows\SysWow64\system32\MaXMLProto.dll
c:\windows\SysWow64\system32\mfplat.dll
c:\windows\SysWow64\system32\MK_Lyric.dll
c:\windows\SysWow64\system32\MSCLib.dll
c:\windows\SysWow64\system32\MSFLib.dll
c:\windows\SysWow64\system32\MSLUR71.dll
c:\windows\SysWow64\system32\msvcp60.dll
c:\windows\SysWow64\system32\MTTELECHIP.dll
c:\windows\SysWow64\system32\MTXSYNCICON.dll
c:\windows\SysWow64\system32\muzaf1.dll
c:\windows\SysWow64\system32\muzapp.dll
c:\windows\SysWow64\system32\muzapp.exe
c:\windows\SysWow64\system32\muzdecode.ax
c:\windows\SysWow64\system32\muzeffect.ax
c:\windows\SysWow64\system32\muzmp4sp.ax
c:\windows\SysWow64\system32\muzmpgsp.ax
c:\windows\SysWow64\system32\muzoggsp.ax
c:\windows\SysWow64\system32\muzwmts.dll
c:\windows\SysWow64\system32\psapi.dll
c:\windows\Temp\_ex-68.exe
c:\windows\Temp\log.txt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-01-28 bis 2012-02-29  ))))))))))))))))))))))))))))))
.
.
2012-02-29 13:41 . 2012-02-29 13:41	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-02-28 03:45 . 2012-02-28 14:41	--------	d-----w-	C:\FRST
2012-02-27 12:46 . 2012-01-16 15:28	767952	----a-w-	c:\windows\BDTSupport.dll
2012-02-27 12:44 . 2012-01-11 15:19	230952	----a-w-	c:\windows\system32\drivers\PCTSD64.sys
2012-02-27 12:43 . 2012-02-27 12:46	--------	d-----w-	c:\programdata\PC Tools
2012-02-27 12:43 . 2012-02-27 12:43	--------	d-----w-	c:\users\wilogs\AppData\Roaming\TestApp
2012-02-21 19:13 . 2012-01-04 09:58	509952	----a-w-	c:\windows\system32\ntshrui.dll
2012-02-21 19:13 . 2012-01-04 09:03	442880	----a-w-	c:\windows\SysWow64\ntshrui.dll
2012-02-21 19:13 . 2012-01-03 06:24	515584	----a-w-	c:\windows\system32\timedate.cpl
2012-02-21 19:13 . 2012-01-03 05:44	478208	----a-w-	c:\windows\SysWow64\timedate.cpl
2012-02-21 19:01 . 2011-12-16 08:42	634368	----a-w-	c:\windows\system32\msvcrt.dll
2012-02-21 19:01 . 2011-12-16 07:59	690688	----a-w-	c:\windows\SysWow64\msvcrt.dll
2012-02-21 19:01 . 2011-10-15 06:25	723456	----a-w-	c:\windows\system32\EncDec.dll
2012-02-21 19:01 . 2011-10-15 05:48	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2012-02-21 18:58 . 2011-11-19 15:07	77312	----a-w-	c:\windows\system32\packager.dll
2012-02-21 18:58 . 2011-11-19 14:06	67072	----a-w-	c:\windows\SysWow64\packager.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-27 07:57 . 2011-07-01 14:13	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-20 00:05 . 2012-02-25 11:15	8643640	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{291F034F-141E-4BB6-8FCB-A99B491D1879}\mpengine.dll
2012-01-29 04:10 . 2010-12-07 15:17	279656	------w-	c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2011-11-08 929168]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2011-11-08 3508624]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-11-08 21392]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2011-11-11 59240]
"Copernic Desktop Search - Home"="c:\program files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" [2011-11-22 1648600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-03-08 260608]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-25 201512]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-25 401192]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-21 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-05-26 960080]
"MDS_Menu"="c:\program files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"ArcadeMovieService"="c:\program files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe" [2010-04-23 124136]
"Google Desktop Search"="c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2010-12-07 30192]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"DivX Download Manager"="c:\program files (x86)\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2011-12-16 220744]
.
c:\users\wilogs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\wilogs\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2010-9-16 704032]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
R3 CYDTV_SRV;cydtv Driver;c:\windows\system32\drivers\cydtv.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2010-12-07 30192]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [2012-01-11 402336]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [x]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [x]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA64.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-05-25 47776]
S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [2012-01-16 546768]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-05-26 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-02-02 820768]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-03-03 2320920]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\Drivers\PCTBD64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-22 323584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-21 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-21 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-21 413720]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-01-20 9996320]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-01-20 877600]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2010-05-25 585376]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2010-05-25 354464]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2010-03-09 345648]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2010-02-02 496160]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2010-07-21 2306448]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-06-12 134416]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
smbusp
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.searchqu.com//406
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_3820&r=27361210h416l0498z135t6711k583
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: ihk-online-akademie.de\www
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\wilogs\AppData\Roaming\Mozilla\Firefox\Profiles\jsg11fbx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.wisedock.de/m.php?id=17717ada58c472ea9641bcffa2cff5809f8cb
FF - prefs.js: keyword.URL - hxxp://www.searchqu.com/web?src=ffb&appid=175&systemid=406&sr=0&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{37483b40-c254-4a72-bda4-22ee90182c1e} - (no file)
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - c:\users\wilogs\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
Wow6432Node-HKCU-Run-Remote Control Editor - c:\program files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
Wow6432Node-HKLM-Run-Win7PDF - c:\program files\PDF Printer for Windows 7\PDF.exe
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
WebBrowser-{37483B40-C254-4A72-BDA4-22EE90182C1E} - (no file)
HKLM-Run-mwlDaemon - c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f7,08,c9,62,44,41,56,47,b8,a5,8e,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f7,08,c9,62,44,41,56,47,b8,a5,8e,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Cyberlink\Shared files\RichVideo.exe
c:\program files (x86)\Launch Manager\LMworker.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-02-29  14:53:41 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-02-29 13:53
.
Vor Suchlauf: 17 Verzeichnis(se), 357.738.213.376 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 359.209.226.240 Bytes frei
.
- - End Of File - - 110CD0DEABCD6FD893C7DF115A22F09E

Psychotic · 01.03.2012, 00:09

Schritt 1: MBAM

Downloade Dir bitte Malwarebytes

Installiere das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2: aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung) Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen ) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Schritt 3: DDS

Downloade dir bitte dds ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop. dds.com dds.scr dds.pif

Schließe alle laufenden Programme.
Starte DDS mit Doppelklick.
Es wird 2 Logfiles erstellen.
- dds.txt
- attach.txt
Speichere beide Logfiles auf deinem Desktop
Poste beide Logfiles hier.

Schritt 4: Farbar´s Service Scanner

Downloade dir bitte Farbar's Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

maggus2012 · 01.03.2012, 11:29

Hallo Marius!

anbei sende ich dir die Log-Files. Vor den Logfiles ggf. noch Anmerkungen.

MBAM
Nach dem Quick Scan kam direkt das Logfile. "markieren" und anzeigen "aller Ergebnise" konnte ich nirgends auswählen. Hängt vermutlich damit zusammen, dass keine Treffer vorhanden waren.

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.01.01

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
wilogs :: WILOGS13ZOLL [Administrator]

Schutz: Aktiviert

01.03.2012 08:01:30
mbam-log-2012-03-01 (08-01-30).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 190313
Laufzeit: 5 Minute(n), 9 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

aswMBR

Code:

ATTFilter

aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-03-01 08:10:17
-----------------------------
08:10:17.472    OS Version: Windows x64 6.1.7600 
08:10:17.472    Number of processors: 4 586 0x2505
08:10:17.472    ComputerName: WILOGS13ZOLL  UserName: wilogs
08:10:19.906    Initialize success
08:11:37.048    AVAST engine defs: 12022901
08:12:03.491    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
08:12:03.491    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
08:12:03.506    Disk 0 MBR read successfully
08:12:03.522    Disk 0 MBR scan
08:12:03.522    Disk 0 Windows VISTA default MBR code
08:12:03.522    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        13000 MB offset 2048
08:12:03.553    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 26626048
08:12:03.569    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       463838 MB offset 26830848
08:12:03.584    Disk 0 scanning C:\Windows\system32\drivers
08:12:13.085    Service scanning
08:12:42.335    Modules scanning
08:12:42.350    Disk 0 trace - called modules:
08:12:42.397    ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore64.sys iaStor.sys hal.dll 
08:12:42.912    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800525e060]
08:12:42.912    3 CLASSPNP.SYS[fffff88001d0143f] -> nt!IofCallDriver -> [0xfffffa80050f1970]
08:12:42.927    5 PCTCore64.sys[fffff88001216f38] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0xfffffa8004fcf050]
08:12:45.798    AVAST engine scan C:\Windows
08:12:52.553    AVAST engine scan C:\Windows\system32
08:12:52.693    File: C:\Windows\system32\a016mgmt.dll  **INFECTED** Win64:Sirefef-E [Trj]
08:13:02.552    File: C:\Windows\system32\consrv.dll  **INFECTED** Win32:Sirefef-JQ [Trj]
08:13:25.047    File: C:\Windows\system32\knobserv.dll  **INFECTED** Win64:Sirefef-E [Trj]
08:13:49.805    File: C:\Windows\system32\rdsessmgr.dll  **INFECTED** Win64:Sirefef-E [Trj]
08:16:34.572    File: C:\Windows\assembly\tmp\loader.tlb **SUSPICIOUS**
08:16:34.619    File: C:\Windows\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6} **SUSPICIOUS**
08:16:36.803    AVAST engine scan C:\Windows\system32\drivers
08:16:50.609    AVAST engine scan C:\Users\wilogs
09:12:40.671    AVAST engine scan C:\ProgramData
09:19:47.473    Scan finished successfully
11:16:43.595    Disk 0 MBR has been saved successfully to "C:\Users\wilogs\Desktop\MBR.dat"

DDS.txt

Code:

ATTFilter

.
DDS (Ver_2011-08-26.01) - NTFSAMD64 
Internet Explorer: 8.0.7600.16385  BrowserJavaVersion: 1.6.0_29
Run by wilogs at 11:18:04 on 2012-03-01
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3764.1959 [GMT 1:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
C:\Program Files (x86)\Launch Manager\dsiwmis.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Logitech\SetPointP\LBTWiz.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
C:\Program Files (x86)\Launch Manager\LManager.exe
C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
C:\Program Files (x86)\Launch Manager\LMworker.exe
C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\PDF24\pdf24.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.searchqu.com//406
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_3820&r=27361210h416l0498z135t6711k583
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: PC Tools Browser Defender: {472734ea-242a-422b-adf8-83d1e48cc825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: PC Tools Browser Defender BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File
TB: PC Tools Browser Defender: {472734ea-242a-422b-adf8-83d1e48cc825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll
uRun: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s
uRun: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
uRun: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
uRun: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
uRun: [Copernic Desktop Search - Home] "C:\Program Files (x86)\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray
mRun: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
mRun: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
mRun: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun: [MDS_Menu] "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso" UpdateWithCreateOnce "Software\CyberLink\MediaShow Espresso\5.6"
mRun: [ArcadeMovieService] "C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe"
mRun: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
StartupFolder: C:\Users\wilogs\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\wilogs\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ACERVC~1.LNK - C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Nach Microsoft E&xel exportieren - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
LSP: C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: ihk-online-akademie.de\www
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{16C59028-1230-4ECE-87EC-3E99B8FEE6EA} : DhcpNameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{431D05C6-4021-4DC1-BFD2-54FB85DC83A2} : DhcpNameServer = 192.168.5.8
TCP: Interfaces\{4E5B4DA6-18C7-4BF4-A7FD-E0CA1DD6B0D5} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{4E5B4DA6-18C7-4BF4-A7FD-E0CA1DD6B0D5}\7796C6F676372E08993702960586F6E656 : DhcpNameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{4E5B4DA6-18C7-4BF4-A7FD-E0CA1DD6B0D5}\830323E21387 : DhcpNameServer = 10.50.1.2 10.50.1.1
TCP: Interfaces\{4E5B4DA6-18C7-4BF4-A7FD-E0CA1DD6B0D5}\84169637C60275D2C414E4 : DhcpNameServer = 192.168.1.2
TCP: Interfaces\{4E5B4DA6-18C7-4BF4-A7FD-E0CA1DD6B0D5}\F4C495D405941413E405 : DhcpNameServer = 192.168.1.1 217.196.209.2
TCP: Interfaces\{4E5B4DA6-18C7-4BF4-A7FD-E0CA1DD6B0D5}\F4C697D6079616050523 : DhcpNameServer = 192.168.1.1 217.196.209.2
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs: c:\PROGRA~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}
{326E768D-4182-46FD-9C16-1449A49795F4}
{593DDEC6-7468-4cdd-90E1-42DADAA222E9}
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
TB-X64: {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No File
{472734EA-242A-422B-ADF8-83D1E48CC825}
mRun-x64: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
mRun-x64: [EgisUpdate] "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
mRun-x64: [EgisTecPMMUpdate] "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe
mRun-x64: [MDS_Menu] "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso" UpdateWithCreateOnce "Software\CyberLink\MediaShow Espresso\5.6"
mRun-x64: [ArcadeMovieService] "C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe"
mRun-x64: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun-x64: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce-x64: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
AppInit_DLLs-X64: c:\PROGRA~2\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
SEH-X64: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}: Groove GFS Stub Execution Hook
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\wilogs\AppData\Roaming\Mozilla\Firefox\Profiles\jsg11fbx.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.wisedock.de/m.php?id=17717ada58c472ea9641bcffa2cff5809f8cb
FF - prefs.js: keyword.URL - hxxp://www.searchqu.com/web?src=ffb&appid=175&systemid=406&sr=0&q=
.
============= SERVICES / DRIVERS ===============
.
R0 PCTCore;PCTools KDS;C:\Windows\system32\drivers\PCTCore64.sys --> C:\Windows\system32\drivers\PCTCore64.sys [?]
R0 pctDS;PC Tools Data Store;C:\Windows\system32\drivers\pctDS64.sys --> C:\Windows\system32\drivers\pctDS64.sys [?]
R0 pctEFA;PC Tools Extended File Attributes;C:\Windows\system32\drivers\pctEFA64.sys --> C:\Windows\system32\drivers\pctEFA64.sys [?]
R1 mwlPSDFilter;mwlPSDFilter;C:\Windows\system32\DRIVERS\mwlPSDFilter.sys --> C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [?]
R1 mwlPSDNServ;mwlPSDNServ;C:\Windows\system32\DRIVERS\mwlPSDNServ.sys --> C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [?]
R1 mwlPSDVDisk;mwlPSDVDisk;C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys --> C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [?]
R1 PCTSD;PC Tools Spyware Doctor Driver;C:\Windows\system32\Drivers\PCTSD64.sys --> C:\Windows\system32\Drivers\PCTSD64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2010-5-25 47776]
R2 Browser Defender Update Service;Browser Defender Update Service;C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [2012-2-27 546768]
R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2010-9-17 325200]
R2 ePowerSvc;Acer ePower Service;C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-9-16 820768]
R2 GREGService;GREGService;C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2010-1-8 23584]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-3-1 652360]
R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-3-9 250368]
R2 RS_Service;Raw Socket Service;C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [2010-9-16 260640]
R2 TeamViewer6;TeamViewer 6;C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-7 2228008]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-9-16 2320920]
R2 Updater Service;Updater Service;C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2010-5-11 243232]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atipmdag.sys --> C:\Windows\system32\DRIVERS\atipmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\system32\DRIVERS\btath_bus.sys --> C:\Windows\system32\DRIVERS\btath_bus.sys [?]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 intelkmd;intelkmd;C:\Windows\system32\DRIVERS\igdpmd64.sys --> C:\Windows\system32\DRIVERS\igdpmd64.sys [?]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 PCTBD;PC Tools Browser Defender Driver;C:\Windows\system32\Drivers\PCTBD64.sys --> C:\Windows\system32\Drivers\PCTBD64.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS --> C:\Windows\system32\drivers\AmUStor.SYS [?]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\system32\Drivers\ssadadb.sys --> C:\Windows\system32\Drivers\ssadadb.sys [?]
S3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\system32\DRIVERS\btath_flt.sys --> C:\Windows\system32\DRIVERS\btath_flt.sys [?]
S3 ATHDFU;Atheros Valkyrie USB BootROM;C:\Windows\system32\Drivers\AthDfu.sys --> C:\Windows\system32\Drivers\AthDfu.sys [?]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\system32\drivers\btath_a2dp.sys --> C:\Windows\system32\drivers\btath_a2dp.sys [?]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\system32\DRIVERS\btath_hcrp.sys --> C:\Windows\system32\DRIVERS\btath_hcrp.sys [?]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\system32\DRIVERS\btath_lwflt.sys --> C:\Windows\system32\DRIVERS\btath_lwflt.sys [?]
S3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\system32\DRIVERS\btath_rcp.sys --> C:\Windows\system32\DRIVERS\btath_rcp.sys [?]
S3 BtFilter;BtFilter;C:\Windows\system32\DRIVERS\btfilter.sys --> C:\Windows\system32\DRIVERS\btfilter.sys [?]
S3 CYDTV_SRV;cydtv Driver;C:\Windows\system32\drivers\cydtv.sys --> C:\Windows\system32\drivers\cydtv.sys [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2010-12-7 30192]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\system32\DRIVERS\netaapl64.sys --> C:\Windows\system32\DRIVERS\netaapl64.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;C:\Program Files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [2012-2-27 402336]
S3 sdCoreService;PC Tools Security Service;C:\Program Files (x86)\PC Tools\PC Tools Security\pctsSvc.exe [2012-2-27 1117624]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\system32\DRIVERS\ssadbus.sys --> C:\Windows\system32\DRIVERS\ssadbus.sys [?]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\system32\DRIVERS\ssadmdfl.sys --> C:\Windows\system32\DRIVERS\ssadmdfl.sys [?]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\system32\DRIVERS\ssadmdm.sys --> C:\Windows\system32\DRIVERS\ssadmdm.sys [?]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\system32\DRIVERS\ssadserd.sys --> C:\Windows\system32\DRIVERS\ssadserd.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-03-01 07:00:08	--------	d-----w-	C:\Users\wilogs\AppData\Roaming\Malwarebytes
2012-03-01 06:59:56	--------	d-----w-	C:\ProgramData\Malwarebytes
2012-03-01 06:59:55	23152	----a-w-	C:\Windows\System32\drivers\mbam.sys
2012-03-01 06:59:55	--------	d-----w-	C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-02-29 14:00:11	--------	d-sh--w-	C:\$RECYCLE.BIN
2012-02-29 13:29:04	98816	----a-w-	C:\Windows\sed.exe
2012-02-29 13:29:04	518144	----a-w-	C:\Windows\SWREG.exe
2012-02-29 13:29:04	256000	----a-w-	C:\Windows\PEV.exe
2012-02-29 13:29:04	208896	----a-w-	C:\Windows\MBR.exe
2012-02-28 03:45:13	--------	d-----w-	C:\FRST
2012-02-27 12:46:32	767952	----a-w-	C:\Windows\BDTSupport.dll
2012-02-27 12:46:32	70760	----a-w-	C:\Windows\System32\drivers\PCTBD64.sys
2012-02-27 12:46:31	2246608	----a-w-	C:\Windows\PCTBDCore.dll
2012-02-27 12:46:31	1681360	----a-w-	C:\Windows\PCTBDRes.dll
2012-02-27 12:46:31	149456	----a-w-	C:\Windows\SGDetectionTool.dll
2012-02-27 12:46:10	339608	----a-w-	C:\Windows\System32\drivers\pctgntdi64.sys
2012-02-27 12:46:10	145432	----a-w-	C:\Windows\System32\drivers\pctwfpfilter64.sys
2012-02-27 12:46:09	14776	----a-w-	C:\Windows\System32\drivers\pctBTFix64.sys
2012-02-27 12:46:07	92896	----a-w-	C:\Windows\System32\drivers\pctplsg64.sys
2012-02-27 12:46:01	--------	d-----w-	C:\Program Files (x86)\PC Tools
2012-02-27 12:44:21	453896	----a-w-	C:\Windows\System32\drivers\pctDS64.sys
2012-02-27 12:44:21	1096688	----a-w-	C:\Windows\System32\drivers\pctEFA64.sys
2012-02-27 12:44:20	367912	----a-w-	C:\Windows\System32\drivers\PCTCore64.sys
2012-02-27 12:44:18	230952	----a-w-	C:\Windows\System32\drivers\PCTSD64.sys
2012-02-27 12:44:18	--------	d-----w-	C:\Program Files (x86)\Common Files\PC Tools
2012-02-27 12:43:58	--------	d-----w-	C:\Users\wilogs\AppData\Roaming\TestApp
2012-02-27 12:43:58	--------	d-----w-	C:\ProgramData\PC Tools
2012-02-25 11:15:22	8643640	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{291F034F-141E-4BB6-8FCB-A99B491D1879}\mpengine.dll
2012-02-21 19:13:39	515584	----a-w-	C:\Windows\System32\timedate.cpl
2012-02-21 19:13:39	509952	----a-w-	C:\Windows\System32\ntshrui.dll
2012-02-21 19:13:39	478208	----a-w-	C:\Windows\SysWow64\timedate.cpl
2012-02-21 19:13:39	442880	----a-w-	C:\Windows\SysWow64\ntshrui.dll
2012-02-21 19:01:02	723456	----a-w-	C:\Windows\System32\EncDec.dll
2012-02-21 19:01:02	690688	----a-w-	C:\Windows\SysWow64\msvcrt.dll
2012-02-21 19:01:02	634368	----a-w-	C:\Windows\System32\msvcrt.dll
2012-02-21 19:01:01	534528	----a-w-	C:\Windows\SysWow64\EncDec.dll
2012-02-21 18:58:45	77312	----a-w-	C:\Windows\System32\packager.dll
2012-02-21 18:58:45	67072	----a-w-	C:\Windows\SysWow64\packager.dll
.
==================== Find3M  ====================
.
2012-02-27 07:57:17	414368	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-29 04:10:42	279656	------w-	C:\Windows\System32\MpSigStub.exe
2012-01-14 04:02:25	3143168	----a-w-	C:\Windows\System32\win32k.sys
2011-12-28 03:59:11	499200	----a-w-	C:\Windows\System32\drivers\afd.sys
2011-12-16 08:45:22	1197568	----a-w-	C:\Windows\System32\wininet.dll
2011-12-16 08:41:26	57856	----a-w-	C:\Windows\System32\licmgr10.dll
2011-12-16 08:02:26	981504	----a-w-	C:\Windows\SysWow64\wininet.dll
2011-12-16 07:58:33	44544	----a-w-	C:\Windows\SysWow64\licmgr10.dll
2011-12-16 07:26:35	482816	----a-w-	C:\Windows\System32\html.iec
2011-12-16 06:49:33	386048	----a-w-	C:\Windows\SysWow64\html.iec
2011-12-16 06:43:48	1638912	----a-w-	C:\Windows\System32\mshtml.tlb
2011-12-16 06:15:25	1638912	----a-w-	C:\Windows\SysWow64\mshtml.tlb
.
============= FINISH: 11:18:48,74 ===============

DDS-Attach.txt

Code:

ATTFilter

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 07.12.2010 15:27:45
System Uptime: 01.03.2012 08:12:50 (3 hours ago)
.
Motherboard: Acer            |  | Aspire 3820                    
Processor: Intel(R) Core(TM) i3 CPU       M 370  @ 2.40GHz | CPU 1 | 2399/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 453 GiB total, 332,234 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP243: 13.02.2012 14:01:54 - Geplanter Prüfpunkt
RP244: 21.02.2012 16:43:28 - Geplanter Prüfpunkt
RP245: 21.02.2012 19:47:10 - Windows Update
RP246: 21.02.2012 20:12:11 - Windows Update
RP247: 21.02.2012 20:13:48 - Windows Update
RP248: 21.02.2012 21:00:47 - Windows Update
RP249: 25.02.2012 12:15:04 - Windows Update
RP250: 29.02.2012 14:29:12 - ComboFix created restore point
.
==== Installed Programs ======================
.
 Update for Microsoft Office 2007 (KB2508958)
Accurate Monitor for Search Engines 2.8
Acer Arcade Deluxe
Acer Arcade Movie
Acer Backup Manager
Acer eRecovery Management
Acer PowerSmart Manager
Acer Registration
Acer Updater
Acer VCM
Acrobat.com
Adobe AIR
Adobe Reader X (10.1.2) - Deutsch
Alcor Micro USB Card Reader
Apple Application Support
Apple Software Update
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Audiograbber 1.83 SE 
Audiograbber MP3-Plugin
Backup Manager Basic
Browser Defender 4.0
Canon MP Navigator 2.0
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Cinergy S2 USB HD V1.32.0519.0
Copernic Desktop Search - Home
D3DX10
Debut Video Capture Software
DivX-Setup
Dropbox
EasyCash&Tax 1.52
Elster-Export 1.9
eReg
Free FLV Converter V 6.93.0
Free Monitor for Google 2.5
Google Desktop
Identity Card
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
Java Auto Updater
Java(TM) 6 Update 29
Junk Mail filter update
Launch Manager
Malwarebytes Anti-Malware Version 1.60.1.1000
MediaShow Espresso
Microsoft Office 2003 Web Components
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (German) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (German) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (German) 2007
Microsoft Office InfoPath MUI (German) 2007
Microsoft Office OneNote MUI (German) 2007
Microsoft Office Outlook-Minianwendungen für Windows SideShow
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (German) 2007
Microsoft Office PowerPoint MUI (German) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Italian) 2007
Microsoft Office Proofing (German) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (German) 2007
Microsoft Office Shared MUI (German) 2007
Microsoft Office Visio Viewer 2007
Microsoft Office Word MUI (German) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server Compact 3.5 SP2 ENU
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
MiKTeX 2.8
MozBackup 1.4.10
Mozilla Firefox 10.0.2 (x86 de)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyWinLocker
neroxml
PC Tools Spyware Doctor 9.0
PDF24 Creator 4.1.2
PX Profile Update
QuickTime
Realtek High Definition Audio Driver
Samsung Kies
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553074)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2553073)
Security Update for Microsoft Office Groove 2007 (KB2552997)
Security Update for Microsoft Office InfoPath 2007 (KB2510061)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skype Toolbars
Skype™ 5.3
SumatraPDF
TeamViewer 6
TeXnicCenter Version 1.0 Stable RC1
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office Outlook 2007 (KB2509470)
Update for Outlook 2007 Junk Email Filter (KB2596560)
VC80CRTRedist - 8.0.50727.6195
VideoPad Video Editor
Windows Live Communications Platform
Windows Live Essentials
Windows Live Fotogalerie
Windows Live Installer
Windows Live Mail
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
Winston Version 2010W
ZusammenfassendeMeldung 1.1
.
==== End Of File ===========================

Farbar´s Service Scanner

Code:

ATTFilter

Farbar Service Scanner Version: 22-02-2012
Ran by wilogs (administrator) on 01-03-2012 at 11:23:01
Running from "C:\Users\wilogs\Desktop"
Microsoft Windows 7 Home Premium   (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys
[2012-02-21 20:04] - [2011-12-28 04:59] - 0499200 ____A (Microsoft Corporation) DB9D6C6B2CD95A9CA414D045B627422E

C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll
[2009-07-14 01:09] - [2009-07-14 02:41] - 0824832 ____A (Microsoft Corporation) AECAB449567D1846DAD63ECE49E893E3

C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll
[2009-07-14 00:36] - [2009-07-14 02:41] - 0170496 ____A (Microsoft Corporation) 765A27C3279CE11D14CB9E4F5869FCA5

C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

28.02.2012, 11:00	#8
Psychotic /// Malwareteam	abnow.com, dauer Bluescreen, was kann ich noch machen Bekommst du immer noch bluescreens? __________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board!

abnow.com, dauer Bluescreen, was kann ich noch machen

Plagegeister aller Art und deren Bekämpfung: abnow.com, dauer Bluescreen, was kann ich noch machen