Mcafee Echtzeitscanner deaktiviert sich von selbst

juli94 · 17.01.2013, 21:55

Hallo liebes Trojaner-Board-Team,
seit einigen Tagen deaktiviert sich der Echtzeitscan bei Mcafee (Total Protection) von selbst. Zudem kann kein Scan gestartet werden, es kommt eine fehlermeldung. ich habe dann avira downgeloadet, avira fand jedoch keine Bedrohung/kein Virus. Deshalb habe ich im Internet weitergesucht und habe den IObit Malware fighter ausprobiert. Zufällig sah ich dort beim Scan Namen wie Backdoor Frauder, Trojan.Win32/Agent, Trojan.Win32/Vundo, Worm.autorun und Trojan.Spy. Ob noch mehr waren weiß ich nicht. Dieses Programm hat jedoch nichts gefunden, habe es dann deinstalliert.
Könnt ihr mir bitte helfen?

Lg Julia

aharonov · 17.01.2013, 22:07

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld.

juli94 · 17.01.2013, 22:59

Vielen Danke für die schnelle Antwort. Habe inzwischen den Scan mit dem Programm OTL durchgeführt. Hoffe dass du dies brauchst.

Code:

ATTFilter

OTL logfile created on: 1/17/2013 9:59:03 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Julia\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.75 Gb Total Physical Memory | 0.79 Gb Available Physical Memory | 45.24% Memory free
3.50 Gb Paging File | 2.03 Gb Available in Paging File | 58.15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 132.11 Gb Free Space | 56.73% Space Free | Partition Type: NTFS
 
Computer Name: JULIA-PC | User Name: Julia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013/01/07 18:08:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe
PRC - [2012/12/29 11:26:54 | 001,260,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/12/29 09:26:22 | 001,822,136 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012/12/29 09:26:22 | 000,873,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012/12/29 02:53:20 | 000,383,416 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012/12/04 15:36:48 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012/12/04 12:13:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2012/12/04 12:04:24 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2012/11/21 19:00:02 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012/11/09 06:53:22 | 000,167,344 | ---- | M] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe
PRC - [2012/11/09 06:50:10 | 000,168,880 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
PRC - [2012/10/07 04:02:38 | 000,140,016 | ---- | M] (McAfee, Inc.) -- C:\PROGRA~1\McAfee\MSC\McAPExe.exe
PRC - [2012/10/07 03:13:42 | 000,184,288 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe
PRC - [2012/10/07 03:12:36 | 000,252,792 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe
PRC - [2012/10/06 07:28:42 | 000,632,344 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
PRC - [2012/08/31 12:20:06 | 000,167,784 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
PRC - [2012/04/25 19:53:38 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
PRC - [2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/04/13 19:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe
PRC - [2009/11/19 17:50:58 | 000,208,896 | ---- | M] (IdeaCom Technology Inc.) -- C:\Program Files\IdeaCom\TSC\ETSCSERVICE.exe
PRC - [2009/10/07 09:12:24 | 001,180,976 | ---- | M] (SRS Labs, Inc.) -- C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel.exe
PRC - [2009/09/01 14:10:32 | 000,233,472 | ---- | M] (AlcorMicro Co., Ltd.) -- C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
PRC - [2009/08/12 22:55:52 | 000,352,256 | ---- | M] (ASUSTeK) -- C:\Program Files\ASUS\Eee Manager\EMMessageParser.exe
PRC - [2009/08/12 07:02:42 | 001,278,464 | ---- | M] (ASUSTeK) -- C:\Program Files\ASUS\Eee Manager\EeeManager.exe
PRC - [2009/08/06 21:03:38 | 000,225,280 | ---- | M] (ASUSTeK) -- C:\Program Files\ASUS\Eee Manager\AsShellApplication.exe
PRC - [2009/07/14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/04/29 23:03:44 | 000,225,280 | ---- | M] () -- C:\Program Files\IdeaCom\TSC\IDC_PDisplay.exe
PRC - [2009/02/11 19:18:20 | 000,053,248 | ---- | M] (Chicony) -- C:\Program Files\ASUS\Eee WKB\ModLEDKey.EXE
PRC - [2008/08/26 05:22:12 | 000,319,488 | ---- | M] (ASUSTeK) -- C:\Program Files\ASUS\Message Controller\AsMessageController.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/05/30 19:06:48 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/05/30 19:06:30 | 001,242,512 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012/04/25 19:52:28 | 001,270,160 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\QtScript4.dll
MOD - [2012/04/25 19:52:26 | 007,422,352 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\QtGui4.dll
MOD - [2012/04/25 19:52:24 | 000,795,024 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\QtNetwork4.dll
MOD - [2012/04/25 19:52:24 | 000,192,912 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\QtSql4.dll
MOD - [2012/04/25 19:52:22 | 002,453,904 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\QtDeclarative4.dll
MOD - [2012/04/25 19:52:22 | 002,126,224 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\QtCore4.dll
MOD - [2011/03/16 23:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2009/05/22 07:56:18 | 000,053,248 | ---- | M] () -- C:\Program Files\ASUS\Message Controller\AsACPINotify.dll
MOD - [2009/04/29 23:03:44 | 000,225,280 | ---- | M] () -- C:\Program Files\IdeaCom\TSC\IDC_PDisplay.exe
MOD - [2008/11/04 12:23:04 | 000,077,824 | ---- | M] () -- C:\Program Files\ASUS\Message Controller\AsRemoteControlHooker.dll
MOD - [2008/10/29 04:52:58 | 000,176,128 | ---- | M] () -- C:\Program Files\ASUS\Eee Manager\ImageMgr.dll
MOD - [2008/09/11 04:33:34 | 000,098,304 | ---- | M] () -- C:\Program Files\ASUS\Message Controller\AsKeyboardHooker.dll
MOD - [2007/11/01 01:51:00 | 000,061,440 | ---- | M] () -- C:\Program Files\ASUS\Eee Manager\MessageParser\AsMultiLang.dll
MOD - [2007/11/01 01:51:00 | 000,061,440 | ---- | M] () -- C:\Program Files\ASUS\Eee Manager\AsMultiLang.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012/12/29 11:26:54 | 001,260,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/12/29 02:53:20 | 000,383,416 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/12/04 12:13:51 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/12/04 12:04:24 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/11/16 21:07:20 | 000,279,048 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2012/11/09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/11/09 06:53:22 | 000,167,344 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\System32\mfevtps.exe -- (mfevtp)
SRV - [2012/11/09 06:50:10 | 000,168,880 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV - [2012/10/07 03:13:42 | 000,184,288 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2012/10/07 03:13:42 | 000,184,288 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe -- (mcpltsvc)
SRV - [2012/10/07 03:13:42 | 000,184,288 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2012/10/07 03:13:42 | 000,184,288 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe -- (HomeNetSvc)
SRV - [2012/10/06 07:28:42 | 000,632,344 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe -- (mfecore)
SRV - [2012/09/20 13:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2012/08/31 12:20:06 | 000,167,784 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2012/08/31 12:20:06 | 000,167,784 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2012/08/31 12:20:06 | 000,167,784 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2012/08/13 12:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/07/15 19:44:44 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012/04/25 19:53:38 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe -- (KSS)
SRV - [2010/04/13 19:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)
SRV - [2009/11/19 17:50:58 | 000,208,896 | ---- | M] (IdeaCom Technology Inc.) [Auto | Running] -- C:\Program Files\IdeaCom\TSC\ETSCSERVICE.exe -- (ETSCSERVICE)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (mfeavfk01)
DRV - [2012/12/29 11:26:54 | 008,904,632 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012/11/27 10:01:26 | 000,083,944 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012/11/22 15:51:13 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012/11/22 15:50:51 | 000,134,336 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/11/09 06:56:16 | 000,060,480 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cfwids.sys -- (cfwids)
DRV - [2012/11/09 06:53:32 | 000,210,136 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfewfpk.sys -- (mfewfpk)
DRV - [2012/11/09 06:51:12 | 000,565,352 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2012/11/09 06:50:20 | 000,362,640 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2012/11/09 06:50:00 | 000,065,488 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2012/11/09 06:49:40 | 000,234,824 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2012/11/09 06:49:10 | 000,132,912 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2012/11/02 01:46:50 | 000,252,200 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfencbdc.sys -- (mfencbdc)
DRV - [2012/11/02 01:46:50 | 000,081,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfencrk.sys -- (mfencrk)
DRV - [2012/08/27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012/07/17 19:52:41 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012/05/28 10:28:04 | 000,147,472 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\HipShieldK.sys -- (HipShieldK)
DRV - [2011/06/27 00:37:12 | 002,191,872 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010/04/13 19:10:22 | 000,054,776 | ---- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\Windows\System32\drivers\MOBK.sys -- (MOBKFilter)
DRV - [2009/10/07 15:10:10 | 000,020,736 | ---- | M] (IdeaCom Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\idcfltr.sys -- (IdcFltr)
DRV - [2009/08/21 13:48:12 | 000,027,136 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmUStor.sys -- (AmUStor)
DRV - [2009/08/04 03:28:18 | 000,011,296 | R--- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\AsIO.sys -- (AsIO)
DRV - [2009/07/16 04:36:30 | 000,013,216 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2009/07/14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/06/04 18:47:48 | 000,024,608 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvamacpi.sys -- (nvamacpi)
DRV - [2009/06/02 09:04:46 | 000,017,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008/01/04 21:34:42 | 000,010,216 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\AsInsHelp32.sys -- (ASInsHelp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110824&tt=071012_ikanctrl_4112_5&babsrc=SP_ss&mntrId=84424c8b000000000000485b394602d9
IE - HKCU\..\SearchScopes\{18C34034-8C4C-4900-85E7-898F037E8DB0}: "URL" = hxxp://de.search.yahoo.com/search?fr=mcafee&p={SearchTerms}
IE - HKCU\..\SearchScopes\{6B0267E6-8EE4-42C1-8DD6-091CFE441145}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10267&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGY&apn_dtid=^YYYYYY^YY^IT&apn_uid=16a1d19f-4e41-42b9-b009-6328993cbb7c&apn_sauid=153B71E5-0454-49FE-9848-F819C4B48EE3
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Julia\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Julia\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/12/16 12:01:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\msktbird@mcafee.com: C:\Program Files\McAfee\MSK [2013/01/04 12:40:21 | 000,000,000 | ---D | M]
 
 
========== Chrome  ==========
 
CHR - homepage: hxxp://search.babylon.com/?affID=110824&tt=071012_ikanctrl_4112_5&babsrc=HP_ss&mntrId=84424c8b000000000000485b394602d9
CHR - default_search_provider: Ask (Enabled)
CHR - default_search_provider: search_url = hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=AVR-4&o=APN10267&locale=de_IT&apn_uid=16a1d19f-4e41-42b9-b009-6328993cbb7c&apn_ptnrs=%5EAGY&apn_sauid=153B71E5-0454-49FE-9848-F819C4B48EE3&apn_dtid=%5EYYYYYY%5EYY%5EIT&q={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}
CHR - homepage: hxxp://search.babylon.com/?affID=110824&tt=071012_ikanctrl_4112_5&babsrc=HP_ss&mntrId=84424c8b000000000000485b394602d9
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Julia\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Julia\AppData\Local\Google\Chrome\Application\23.0.1271.97\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Julia\AppData\Local\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Julia\AppData\Local\Google\Chrome\Application\23.0.1271.97\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Julia\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: McAfee SecurityCenter (Enabled) = c:\progra~1\mcafee\msc\npmcsn~1.dll
CHR - Extension: Adblock Plus = C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.3.4_0\
CHR - Extension: SiteAdvisor = C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.2_0\
CHR - Extension: Torrent Turbo Search = C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcdgomceilgkonhjheaijcmgfhabmpio\3.5.5.9_0\
CHR - Extension: Keep My Opt-Outs = C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhnjdplhmcnkiecampfdgfjilccfpfoe\1.0.14_0\
CHR - Extension: Skype Click to Call = C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\
CHR - Extension: DVDVideoSoft Browser Extension = C:\Users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\
 
O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AsShellApplication] C:\Program Files\ASUS\Eee Manager\AsShellApplication.exe (ASUSTeK)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [IDC_PDisplay] C:\Program Files\IdeaCom\TSC\IDC_PDisplay.exe ()
O4 - HKLM..\Run: [mcpltui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [StartCal.exe] C:\Program Files\IdeaCom\TSC\StartCal.exe (IdeaCom Technology Inc.)
O4 - HKCU..\Run: [KSS] C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Kaspersky Lab ZAO)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\Julia\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Julia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9DFC9B32-0111-4F35-8766-14A9D4047163}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~1\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - Winlogon\Notify\IdcNotify: DllName - (idcnotify.dll) - C:\Windows\System32\idcnotify.dll ()
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{ac455ca7-16c3-11e2-bc86-485b394602d9}\Shell - "" = AutoRun
O33 - MountPoints2\{ac455ca7-16c3-11e2-bc86-485b394602d9}\Shell\AutoRun\command - "" = E:\iStudio.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/17 20:52:38 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
[2013/01/17 20:51:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2013/01/17 20:51:38 | 000,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab
[2013/01/17 20:14:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2013/01/16 22:07:21 | 004,285,248 | ---- | C] (McAfee, Inc.) -- C:\Users\Julia\Desktop\McAfeeSetup.exe
[2013/01/16 22:07:21 | 000,526,800 | ---- | C] (McAfee, Inc.) -- C:\Users\Julia\Desktop\MVTInstaller.exe
[2013/01/16 20:15:48 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2013/01/08 23:23:02 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Avira
[2013/01/08 23:16:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013/01/08 23:15:57 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\APN
[2013/01/08 23:15:40 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2013/01/08 23:15:35 | 000,134,336 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2013/01/08 23:15:35 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2013/01/08 23:15:34 | 000,083,944 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2013/01/08 23:15:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013/01/08 23:15:28 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2013/01/07 19:35:29 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\PC Tools
[2013/01/07 18:30:49 | 002,280,568 | ---- | C] (Threat Expert Ltd.) -- C:\Windows\PCTBDCore.dll0128.old
[2013/01/07 18:30:49 | 000,150,648 | ---- | C] (PC Tools) -- C:\Windows\SGDetectionTool.dll0128.old
[2013/01/07 18:26:38 | 000,019,464 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctBTFix.sys
[2013/01/07 18:25:44 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2013/01/07 18:20:50 | 000,202,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2013/01/07 18:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2013/01/07 18:15:19 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2013/01/07 18:15:13 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\TestApp
[2013/01/07 18:08:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe
[2013/01/07 17:25:36 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\Malwarebytes
[2013/01/07 17:25:30 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit
[2013/01/07 17:25:29 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Roaming\IObit
[2013/01/07 17:25:21 | 000,000,000 | ---D | C] -- C:\Program Files\IObit
[2013/01/07 17:25:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/01/07 17:25:06 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/01/07 17:24:51 | 000,000,000 | ---D | C] -- C:\Users\Julia\AppData\Local\Programs
[2013/01/07 17:03:17 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2013/01/04 13:56:13 | 000,147,472 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\HipShieldK.sys
[2013/01/04 13:52:04 | 000,167,344 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe
[2013/01/04 13:50:24 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft
[2013/01/04 13:50:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft
[2012/12/31 16:06:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/12/31 16:04:58 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012/12/31 16:04:50 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012/12/31 16:04:50 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/12/31 15:52:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/12/31 15:51:03 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/17 21:54:56 | 000,000,156 | ---- | M] () -- C:\Users\Julia\defogger_reenable
[2013/01/17 21:04:39 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013/01/17 20:52:23 | 000,001,051 | ---- | M] () -- C:\Users\Julia\Desktop\Kaspersky Security Scan.lnk
[2013/01/17 20:44:35 | 000,001,988 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2013/01/17 20:14:57 | 000,001,848 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Total Protection.lnk
[2013/01/17 20:12:34 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/17 20:12:34 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/17 20:03:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/01/16 22:37:39 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013/01/16 22:37:39 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/01/16 22:37:39 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013/01/16 22:37:39 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/01/16 21:44:04 | 000,002,150 | ---- | M] () -- C:\Windows\MOBK.blk
[2013/01/16 21:44:03 | 000,000,362 | ---- | M] () -- C:\Windows\MOBK.flt
[2013/01/11 22:10:00 | 000,410,152 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/01/08 23:16:58 | 000,002,016 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013/01/07 18:49:43 | 001,442,623 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2013/01/07 18:08:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Julia\Desktop\OTL.exe
[2013/01/04 13:50:56 | 000,001,360 | ---- | M] () -- C:\Users\Julia\Desktop\Free YouTube to MP3 Converter.lnk
[2013/01/04 13:50:56 | 000,001,201 | ---- | M] () -- C:\Users\Julia\Desktop\DVDVideoSoft Free Studio.lnk
[2012/12/31 16:06:38 | 000,001,757 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/12/31 15:52:09 | 000,001,819 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/12/29 11:26:54 | 000,013,153 | ---- | M] () -- C:\Windows\System32\nvinfo.pb
[2012/12/22 11:00:13 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
 
========== Files Created - No Company Name ==========
 
[2013/01/17 21:54:54 | 000,000,156 | ---- | C] () -- C:\Users\Julia\defogger_reenable
[2013/01/17 20:52:39 | 000,001,051 | ---- | C] () -- C:\Users\Julia\Desktop\Kaspersky Security Scan.lnk
[2013/01/08 23:16:58 | 000,002,016 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013/01/07 18:30:50 | 000,769,144 | ---- | C] () -- C:\Windows\BDTSupport.dll0128.old
[2013/01/07 18:21:48 | 001,442,623 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2013/01/04 13:50:56 | 000,001,360 | ---- | C] () -- C:\Users\Julia\Desktop\Free YouTube to MP3 Converter.lnk
[2013/01/04 09:17:23 | 000,002,641 | ---- | C] () -- C:\Windows\System32\drivers\mfencrk.inf
[2013/01/04 09:17:20 | 000,002,946 | ---- | C] () -- C:\Windows\System32\drivers\mfencbdc.inf
[2012/12/31 16:06:38 | 000,001,757 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/12/31 15:52:09 | 000,001,819 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/07/31 21:58:44 | 000,529,558 | ---- | C] () -- C:\Users\Julia\Bild 5.png
[2012/07/31 21:58:44 | 000,511,084 | ---- | C] () -- C:\Users\Julia\Bild 4.png
[2012/07/31 21:53:08 | 001,367,938 | ---- | C] () -- C:\Users\Julia\Bild 1.png
[2012/07/31 21:53:08 | 001,362,815 | ---- | C] () -- C:\Users\Julia\Bild 2.png
[2012/07/15 03:25:42 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2012/07/15 03:22:16 | 000,000,360 | R--- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat
[2012/07/15 03:15:55 | 000,027,046 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2012/07/15 03:15:37 | 000,001,746 | ---- | C] () -- C:\Windows\Language_trs.ini
[2012/07/15 03:15:34 | 000,020,365 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2012/07/14 18:31:05 | 000,011,832 | ---- | C] () -- C:\Windows\System32\drivers\AsInsHelp64.sys
[2012/07/14 18:31:05 | 000,010,216 | ---- | C] () -- C:\Windows\System32\drivers\AsInsHelp32.sys
[2012/07/14 18:29:45 | 000,024,576 | R--- | C] () -- C:\Windows\System32\AsIO.dll
[2012/07/14 18:29:45 | 000,011,296 | R--- | C] () -- C:\Windows\System32\drivers\AsIO.sys
[2012/07/14 18:27:40 | 000,217,088 | ---- | C] () -- C:\Windows\System32\idcnotify.dll
 
========== ZeroAccess Check ==========
 
[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012/10/08 23:11:43 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Babylon
[2012/12/26 18:48:56 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\BitTorrent
[2013/01/13 19:13:35 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DAEMON Tools Lite
[2013/01/04 13:50:24 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DVDVideoSoft
[2013/01/04 13:51:08 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\DVDVideoSoftIEHelpers
[2013/01/07 17:25:29 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\IObit
[2012/07/19 19:12:12 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\MP3toiPodAudioBookConverter
[2012/10/16 19:54:55 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\Pixlromatic
[2013/01/07 18:15:13 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TestApp
[2012/10/08 23:08:08 | 000,000,000 | ---D | M] -- C:\Users\Julia\AppData\Roaming\TuneUp Software
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:E8BE05FA
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:DFC5A2B2

< End of report >

Extras

Code:

ATTFilter

OTL Extras logfile created on: 1/17/2013 9:59:03 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Julia\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.75 Gb Total Physical Memory | 0.79 Gb Available Physical Memory | 45.24% Memory free
3.50 Gb Paging File | 2.03 Gb Available in Paging File | 58.15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 132.11 Gb Free Space | 56.73% Space Free | Partition Type: NTFS
 
Computer Name: JULIA-PC | User Name: Julia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00907EC1-6CF9-4C98-A6B2-F938CECE300C}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{05345DD9-2BA5-407A-BCA3-D1C64CF21277}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{0EEAB534-4094-4E6D-8FD0-23F9AEE7FDAC}" = lport=139 | protocol=6 | dir=in | app=system | 
"{101D6C86-06A9-42B1-A27D-04223164F14F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{10A5CB28-4B3A-4124-82CE-8330FB130859}" = lport=137 | protocol=17 | dir=in | app=system | 
"{1C4EFA27-23E2-4E54-8B01-49DCD1A656AF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{2AF369E9-B7E3-472E-8977-898724C6502D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{37594C46-6F47-441E-B396-84023EF45335}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4C4472FE-20A4-4B57-99CC-36D3AF5B50CB}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe | 
"{517349B9-1BDB-4137-88B6-F1C2FD2052A3}" = rport=445 | protocol=6 | dir=out | app=system | 
"{5CF7F121-32AC-46A8-B3D7-7283E5FE2725}" = rport=137 | protocol=17 | dir=out | app=system | 
"{8281FFC0-5E4A-4B0A-B2C8-BB28BDCB5268}" = lport=445 | protocol=6 | dir=in | app=system | 
"{9BA4AAB9-5688-434A-985A-E85AE60EF7EB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9BA53A39-0333-44FB-A3DD-7879413CAD6F}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{A54FDDE9-8ED8-4410-BE3D-BB3A4E8086A2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{AC0F5A81-D62D-42BE-B216-CC1166650863}" = rport=139 | protocol=6 | dir=out | app=system | 
"{B8F74BC8-B00C-478C-8B11-95762B4E8CCD}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C13EA565-92D1-424D-B86F-F105AE9EC09D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{CDFFC691-4D6A-4D1D-A7BD-A88F0B267DF1}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{E0317E23-E5BA-40C1-B03B-59E664139AF6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EFA4EB88-990D-4F74-8F81-CE68CED96C19}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FFA9FA17-8233-43BF-BBF5-D6281249297D}" = rport=138 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{13072F7C-667B-462F-92D7-1AC442637912}" = protocol=6 | dir=out | app=system | 
"{19EB920E-67B6-4F53-A382-94F4EAF7E936}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{214F021F-7835-4CEC-A8B8-F89CA69F21F8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{2CDEAAD9-325D-4E0C-A1EC-7166E061B94A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{314B0193-1E6C-439C-A6DB-2E34E19D050E}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{367EFF06-54EB-46EF-9A62-05A645E79A7C}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 
"{372316E4-8665-471C-B559-269C4EF7CFB6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{374E2C79-AB86-476D-A80A-3BB6A808A3A0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{39EF4E42-469A-47DC-9B70-87EBBFD4371B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{51834E09-8E89-44A2-BE92-20771562022E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{53B494CA-8D55-4FEB-9098-BE137DA3B8F6}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"{606DFB2D-EB75-4B48-B641-0A80E676F84C}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\platform\mcsvchost\mcsvhost.exe | 
"{62A05CFC-53CD-474E-B2F9-852CD7D751CC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{6A7AC5B3-B039-47DB-B9CE-C8AE83BA0B2E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{76F641C8-E697-47DC-9BE4-357E5F0216E3}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{7DF2F9D3-A579-4481-AB42-09EDFDC49404}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe | 
"{870879F0-D97C-426E-BBCA-31F75FFE4717}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{874E68DE-B733-40F1-B921-9219111CCBE8}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe | 
"{89D7CEF7-0EC7-4D55-B8D2-53BC24811A5D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8A4E31B3-5C0D-4F7E-B22E-B8B854454A8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8B832D54-8EC3-4876-8A8D-FBEA3D4EDBCF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{9ACF8894-77C2-4A83-841B-F47F4E8AE050}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{9EC1B11D-4F09-42EE-88B9-F4E2BE445D65}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{A307BEA6-DDB4-44A9-8B63-DC275FEC773A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B4AD1EEA-165F-489B-964D-85EA2160B740}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{B6E53104-18FD-4DF8-BDAA-D13C1B3A4352}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B8EE28D0-7E09-481E-8B76-01E6A0BB3AEB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe | 
"{CF6B0AB0-5BF2-473A-A1B2-05680C6FCE90}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D4D0E58E-E99E-49B3-AA8E-F147F6DDDE38}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{E182CA58-CDBF-4B38-B4BD-567BC1C69D70}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{FAA2E3D2-B706-44B4-BB14-4BE96A18BEFF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = ASUS Eee Cam
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{1945A4B5-73B6-4DE9-99A3-05261B7FDED0}" = Shared C Run-time for x86
"{1C2F85C9-B32E-47B5-816E-8DA6B974A5F5}" = Eee WKB
"{27C467F8-F8EF-4f68-BD72-D63632B2096C}" = McAfee Online Backup
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{281C959A-2894-4251-8B02-A48186147282}" = Alcor Micro USB Card Reader
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{41A63ADA-088B-1C2D-43B3-E4087FE79881}" = Pixlr-o-matic
"{459699C3-9430-4381-964B-4248D87B49F9}" = Apple Mobile Device Support
"{56009CA3-423B-41F8-884A-E5B049534F15}" = Kaspersky Security Scan
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5A2BE254-88E2-4416-AF72-288BE35ED713}_is1" = IdeaCom TSC 3.2.1206.10
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{795274EF-3EDA-4427-9D4C-446C9137BB6D}" = Eee Manager
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9FEC4E-8696-43B4-8C19-5BE4D9038B55}" = ASUS Easy Update
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.5.3 MUI
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B0261E53-B6F1-474A-864B-E7C3CBF468E0}" = iTunes
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 310.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{CFF4500E-C5D6-695D-A027-B3D4DDED2CC3}" = McAfee Online Backup
"{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}" = SRS Premium Sound Control Panel
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Avira AntiVir Desktop" = Avira Free Antivirus
"BitTorrent" = BitTorrent
"CCleaner" = CCleaner
"DAEMON Tools Lite" = DAEMON Tools Lite
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.37.1212
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = ASUS Eee Cam
"InstallShield_{281C959A-2894-4251-8B02-A48186147282}" = Alcor Micro USB Card Reader
"InstallWIX_{56009CA3-423B-41F8-884A-E5B049534F15}" = Kaspersky Security Scan
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MSC" = McAfee Total Protection
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Pixlromatic" = Pixlr-o-matic
"VLC media player" = VLC media player 2.0.2
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 1/7/2013 12:53:44 PM | Computer Name = Julia-PC | Source = RasClient | ID = 20227
Description = 
 
Error - 1/7/2013 1:42:04 PM | Computer Name = Julia-PC | Source = RasClient | ID = 20227
Description = 
 
Error - 1/7/2013 5:20:13 PM | Computer Name = Julia-PC | Source = VSS | ID = 8194
Description = 
 
Error - 1/7/2013 5:24:33 PM | Computer Name = Julia-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: pctsSvc.exe, Version: 9.1.0.2894,
 Zeitstempel: 0x509054e5  Name des fehlerhaften Moduls: rtl100.bpl, Version: 11.0.2902.10471,
 Zeitstempel: 0x475fc385  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000a264  ID des fehlerhaften
 Prozesses: 0xae0  Startzeit der fehlerhaften Anwendung: 0x01cded1bbe765b60  Pfad der
 fehlerhaften Anwendung: C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe
Pfad
 des fehlerhaften Moduls: C:\Program Files\PC Tools\PC Tools Security\rtl100.bpl
Berichtskennung:
 a0ada6e0-5910-11e2-a39c-485b394602d9
 
Error - 1/13/2013 12:41:34 PM | Computer Name = Julia-PC | Source = VSS | ID = 8194
Description = 
 
Error - 1/13/2013 12:48:09 PM | Computer Name = Julia-PC | Source = VSS | ID = 8194
Description = 
 
Error - 1/13/2013 3:11:01 PM | Computer Name = Julia-PC | Source = VSS | ID = 8194
Description = 
 
Error - 1/13/2013 3:14:36 PM | Computer Name = Julia-PC | Source = VSS | ID = 8194
Description = 
 
Error - 1/15/2013 2:52:40 PM | Computer Name = Julia-PC | Source = VSS | ID = 8194
Description = 
 
Error - 1/15/2013 2:55:54 PM | Computer Name = Julia-PC | Source = VSS | ID = 8194
Description = 
 
[ System Events ]
Error - 12/10/2012 12:29:25 PM | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst mcmscsvc erreicht.
 
Error - 12/10/2012 12:29:25 PM | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Services" wurde aufgrund folgenden Fehlers nicht
 gestartet:   %%1053
 
Error - 12/10/2012 12:29:55 PM | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst mcmscsvc erreicht.
 
Error - 12/10/2012 12:29:55 PM | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Services" wurde aufgrund folgenden Fehlers nicht
 gestartet:   %%1053
 
Error - 12/10/2012 12:30:17 PM | Computer Name = Julia-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "WIN7" den Befehl "chkdsk" aus.
 
Error - 12/10/2012 12:31:44 PM | Computer Name = Julia-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80246007 fehlgeschlagen: Windows 7 Service Pack 1 (KB976932)
 
Error - 12/10/2012 12:39:53 PM | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst McAfee SiteAdvisor Service erreicht.
 
Error - 12/10/2012 12:39:57 PM | Computer Name = Julia-PC | Source = Service Control Manager | ID = 7043
Description = Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements
 nicht richtig heruntergefahren werden.
 
Error - 12/14/2012 3:25:43 AM | Computer Name = Julia-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1000
Description = Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x8007045b
 
Error - 12/17/2012 5:08:24 PM | Computer Name = Julia-PC | Source = WMPNetworkSvc | ID = 866300
Description = 
 
 
< End of report >

aharonov · 18.01.2013, 16:19

Hallo Julia und

Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten.

Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schliessen von Sicherheitslücken und sollte gründlich durchgeführt werden. Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich.
Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist.
Arbeite daher in deinem eigenen Interesse solange mit, bis du das OK bekommst, dass alles erledigt ist.

Bevor wir loslegen - Hinweise zum Ablauf:

Du bekommst von mir jeweils eine individuell auf dich abgestimmte schrittweise Anleitung.
- Lese diese Anweisungen immer zuerst vollständig durch und frag bei Unklarheiten nach, bevor du beginnst.
- Arbeite die Anleitungen dann sorgfältig und in der angegebenen Reihenfolge ab und poste deine Rückmeldungen und Logfiles gesammelt in einer Antwort.
- Füge den Inhalt der Logfiles wenn immer möglich innerhalb von Code-Tags in deine Antwort ein.
- Sollten Probleme auftauchen, dann brich an dieser Stelle ab und schildere sie so gut wie möglich.

Es ist wichtig für mich, dass sich der Zustand deines Systems nicht plötzlich unvorhersehbar ändert. Deshalb: Bitte
- .. lasse keine Scanner oder Tools ohne Aufforderung laufen. Lösche nichts auf eigene Faust.
- .. installiere oder deinstalliere während der Bereinigung keine Software.
- .. frag nicht parallel in anderen Foren nach Hilfe (Crossposting).

Ich kann dir keine Garantien geben, dass die Bereinigung schlussendlich erfolgreich sein wird und wir alles finden werden.
- Ein Formatieren und Neuinstallieren ist meist der schnellere und immer der sicherere Weg.
- Sollte ich eine schwerwiegende Infektion bei dir finden, werde ich dich nochmals darauf hinweisen. Es bleibt aber deine Entscheidung.

Los geht's: Alle Tools immer auf den Desktop speichern und von dort starten.

Hast du denn neben den Störungen von McAfee sonst noch irgendwelche Auffälligkeiten oder Probleme mit dem Computer oder läuft sonst alles rund?

Schauen wir noch etwas genauer:

Schritt 1

Bitte gehe zu Virustotal, um eine Datei zu überprüfen:

Klicke auf Choose File.
Kopiere nun das Folgendes in die Suchleiste:
Code:
ATTFilter
```
C:\Windows\System32\idcnotify.dll
         
```
Drücke auf Öffnen.
Klicke dann auf Scan it!.

Warte bitte, bis die Datei vollständig hochgeladen wurde. Solltest du folgende Meldung bekommen

Zitat:

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:

dann klicke auf Reanalyse.
Warte, bis unter Current status: Finished steht.

Kopiere dann den Link aus deiner Adresszeile und poste ihn hier.

Schritt 2

Lade dir Gmer herunter (auf den Button Download EXE drücken) und speichere das Programm auf den Desktop.
Deaktiviere alle Antivirenprogramme und Malware/Spyware Scanner.
Trenne alle bestehenden Verbindungen zu einem Netzwerk/Internet (WLAN nicht vergessen).
Schliesse bitte alle anderen Programme.
Starte gmer.exe (die Datei hat einen zufälligen Dateinamen).
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Sollte sich ein Fenster mit folgender Warnung öffnen
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?
dann klicke unbedingt auf No.
Entferne rechts den Haken bei:
- IAT/EAT
- Allen Festplatten ausser der Systemplatte (nur die Systempartition, normalerweise C:\, sollte angehakt sein)
- Show all
Starte den Scan mit einem Klick auf Scan.
Mache gar nichts am Computer, während der Scan läuft!
Wenn der Scan fertig ist, klicke auf Save und speichere das Logfile unter Gmer.txt auf deinen Desktop.
Schliesse dann GMER und führe unmittelbar einen Neustart des Computers durch.
Füge bitte den Inhalt des Logfiles hier in deine Thread ein.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor du ins Netz gehst.

Bitte poste in deiner nächsten Antwort:

Link zu VT
Log von Gmer

juli94 · 18.01.2013, 23:10

Mir ist aufgefallen, dass bei der Installation des Updates vom Windows 7 Service Pack 1 (KB976932) immer ein Fehler auftretet. Sonst ist mir nichts aufgefallen. Mir ist noch eingefallen, dass ich einen Scan mit Kaspersky Security Scan durchgeführt habe. Habe dies total vergessen, sorry.

Lg Julia

Code:

ATTFilter

GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-18 22:59:12
Windows 6.1.7600  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9250315AS rev.0002SDM1 232,89GB
Running: gmer-2.0.18444.exe; Driver: C:\Users\Julia\AppData\Local\Temp\ugtoypod.sys


---- System - GMER 2.0 ----

SSDT   910C8FBE                                                                                                   ZwCreateSection
SSDT   910C8FC8                                                                                                   ZwRequestWaitReplyPort
SSDT   910C8FC3                                                                                                   ZwSetContextThread
SSDT   910C8FCD                                                                                                   ZwSetSecurityObject
SSDT   910C8FD2                                                                                                   ZwSystemDebugControl
SSDT   910C8F5F                                                                                                   ZwTerminateProcess

---- Kernel code sections - GMER 2.0 ----

.text  ntkrnlpa.exe!ZwRollbackTransaction + 13E9                                                                  83252839 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                     832773F2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text  ntkrnlpa.exe!RtlSidHashLookup + 340                                                                        8327ECD0 4 Bytes  [BE, 8F, 0C, 91]
.text  ntkrnlpa.exe!RtlSidHashLookup + 69C                                                                        8327F02C 4 Bytes  [C8, 8F, 0C, 91] {ENTER 0xc8f, 0x91}
.text  ntkrnlpa.exe!RtlSidHashLookup + 6E0                                                                        8327F070 4 Bytes  [C3, 8F, 0C, 91]
.text  ntkrnlpa.exe!RtlSidHashLookup + 75C                                                                        8327F0EC 4 Bytes  [CD, 8F, 0C, 91] {INT 0x8f; OR AL, 0x91}
.text  ntkrnlpa.exe!RtlSidHashLookup + 7B0                                                                        8327F140 4 Bytes  [D2, 8F, 0C, 91]
.text  ...                                                                                                        

---- User code sections - GMER 2.0 ----

?      C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[2292] C:\Windows\SYSTEM32\ntdll.dll     time/date stamp mismatch; 
.text  C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[2292] ntdll.dll!NtProtectVirtualMemory  77905000 5 Bytes  JMP 698B17E3 C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\ushata.dll (Ushata module/Kaspersky Lab ZAO)
?      C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[2292] C:\Windows\system32\kernel32.dll  time/date stamp mismatch; unknown module: KERNELBASE.dll
.text  C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[2292] user32.dll!NotifyWinEvent + 48B   7684F724 4 Bytes  [4D, 27, 8B, 69]
.text  C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe[2884] kernel32.dll!LoadLibraryA       76952844 5 Bytes  JMP 6B048590 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text  C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe[2884] kernel32.dll!LoadLibraryW       76952892 5 Bytes  JMP 6B048690 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
?      C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4008] C:\Windows\SYSTEM32\ntdll.dll     time/date stamp mismatch; 
.text  C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4008] ntdll.dll!NtProtectVirtualMemory  77905000 5 Bytes  JMP 698B17E3 C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\ushata.dll (Ushata module/Kaspersky Lab ZAO)
?      C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4008] C:\Windows\system32\kernel32.dll  time/date stamp mismatch; unknown module: KERNELBASE.dll
.text  C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[4008] user32.dll!NotifyWinEvent + 48B   7684F724 4 Bytes  [4D, 27, 8B, 69]

---- EOF - GMER 2.0 ----

Link:

https://www.virustotal.com/file/2d0603b72e191103a92a95602e3fd42f6ede78001d384de7be0e7b06a9b940ae/analysis/1358541927/

aharonov · 19.01.2013, 13:06

Hallo Julia,

Zitat:

Mir ist aufgefallen, dass bei der Installation des Updates vom Windows 7 Service Pack 1 (KB976932) immer ein Fehler auftretet.

Das hab ich in deinen Logs ebenfalls gesehen, ja.

Es sieht hier so aus, als wären deine Probleme mit dem Echtzeitschutz und dem Service Pack aber nicht durch Malware bedingt.

Erstelle also am besten ein neues Thema im Unterforum Alles rund um Windows und schildere dort deine Probleme bitte nochmals detailliert (zuerst diese Anleitungen lesen).

juli94 · 19.01.2013, 22:30

ok. Aber wie soll ich dann die "Viren" interpretiern, die mir das Programm IObit Malware fighter gescannt hat?

Jedenfalls vielen, vielen Dank für dein Bemühen und deine Hilfe!

lg Julia

aharonov · 20.01.2013, 13:26

Hallo Julia,

Zitat:

Aber wie soll ich dann die "Viren" interpretiern, die mir das Programm IObit Malware fighter gescannt hat?

Vielleicht, dass dieses Programm nicht wirlich seriös ist und dir Angst einjagen will mit dem Aufblitzen solcher Begriffe?
Ich hab keine Ahnung, was dieser IObit Fighter so alles anzeigt während des Scans. Aber wenn er am Schluss dann nicht mal Funde meldet, wie du im ersten Post geschrieben hast, dann ist es sowieso nicht mehr als ein wenig aufregende Pausenunterhaltung.

Generell raten wir von diesem IObit Malware Fighter ab, er hat gar keinen guten Ruf.

Falls du noch unsicher bist, kannst du ja zur Kontrolle und zur Beruhigung noch einen Scan mit einem empfehlenswerten Malwarescanner wie Malwarebytes Antimalware machen:

Downloade dir bitte Malwarebytes Antimalware.

Installiere das Programm in den vorgegebenen Pfad.
Starte nun Malwarebytes Antimalware.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke auf Aktualisierung --> Suche nach Aktualisierung.
Wenn das Update beendet wurde, aktiviere im Reiter Suchlauf die Option Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan fertig ist, klicke auf Ergebnisse anzeigen.
Versichere dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter dem Reiter Logdateien finden.

Mcafee Echtzeitscanner deaktiviert sich von selbst

Antiviren-, Firewall- und andere Schutzprogramme: Mcafee Echtzeitscanner deaktiviert sich von selbst