GVU Trojaner (abgesicherter modus nicht möglich)

devil94 · 30.03.2013, 19:41

Hey leute
hab gestern mir beim streamen nen gvu trojaner eingefangen und nun mit otlpe versucht das problem zu lösen.
OTL.txt

Code:

ATTFilter

OTL logfile created on: 3/30/2013 9:22:01 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): c:\pagefile.sys 4096 4096 [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 100.00 Mb Total Space | 75.52 Mb Free Space | 75.53% Space Free | Partition Type: NTFS
Drive D: | 14.44 Gb Total Space | 14.44 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive E: | 465.66 Gb Total Space | 62.41 Gb Free Space | 13.40% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (KMService)
SRV - [2013/01/29 09:29:00 | 000,188,760 | ---- | M] () [Auto] -- E:\Program Files\IB Updater\ExtensionUpdaterService.exe -- (IB Updater)
SRV - [2013/01/08 07:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto] -- E:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/11/13 09:07:24 | 000,168,384 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe -- (SDWSCService)
SRV - [2012/11/13 09:07:20 | 001,369,624 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe -- (SDUpdateService)
SRV - [2012/11/13 09:07:16 | 001,103,392 | ---- | M] (Safer-Networking Ltd.) [Auto] -- E:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe -- (SDScannerService)
SRV - [2012/10/02 11:20:26 | 001,008,496 | ---- | M] () [Auto] -- E:\Windows\System32\dmwu.exe -- (IBUpdaterService)
SRV - [2012/09/20 08:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2012/09/14 10:24:40 | 000,384,888 | ---- | M] (BlueStack Systems, Inc.) [Auto] -- E:\Program Files\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc)
SRV - [2012/09/14 10:24:16 | 000,393,080 | ---- | M] (BlueStack Systems, Inc.) [Auto] -- E:\Program Files\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc)
SRV - [2012/09/12 11:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012/09/12 11:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/08/29 17:57:12 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- E:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/06/28 18:33:50 | 001,564,368 | ---- | M] () [Auto] -- E:\Program Files\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru)
SRV - [2012/02/14 23:12:48 | 000,163,328 | ---- | M] (AMD) [Auto] -- E:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012/02/14 17:15:30 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto] -- E:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2009/08/06 01:51:20 | 000,065,536 | R--- | M] () [Auto] -- E:\Windows\System32\XSrvSetup.exe -- (JMB36X)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (VGPU)
DRV - File not found [Kernel | On_Demand] --  -- (gdrv)
DRV - [2013/03/30 13:04:25 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys -- (MpKsl9a732883)
DRV - [2013/03/30 11:10:08 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys -- (MpKsl07894b93)
DRV - [2013/03/30 00:05:01 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys -- (MpKsl3d312dd0)
DRV - [2013/03/29 23:53:14 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys -- (MpKsle2a982e2)
DRV - [2013/03/29 23:38:06 | 000,029,904 | ---- | M] () [Kernel | System] -- E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys -- (MpKsld861874d)
DRV - [2012/11/27 16:25:33 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System] -- E:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012/09/14 10:24:24 | 000,063,864 | ---- | M] (BlueStack Systems) [Kernel | Auto] -- E:\Program Files\BlueStacks\HD-Hypervisor-x86.sys -- (BstHdDrv)
DRV - [2012/08/30 16:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- E:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012/02/14 23:47:12 | 009,182,208 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2012/02/14 23:47:12 | 009,182,208 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012/02/14 22:12:48 | 000,264,704 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012/02/01 09:18:10 | 000,046,720 | ---- | M] (Advanced Micro Devices) [Kernel | Auto] -- E:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys -- (AODDriver4.1)
DRV - [2011/03/18 12:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot] -- E:\Windows\System32\speedfan.sys -- (speedfan)
DRV - [2011/02/08 06:03:54 | 001,882,624 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010/11/20 17:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010/11/20 17:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 17:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 17:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - [2010/11/20 17:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV - [2010/11/20 17:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010/11/20 17:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- E:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 17:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 17:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010/11/20 17:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\terminpt.sys -- (terminpt)
DRV - [2010/11/20 17:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 17:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/02/18 04:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- E:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2009/12/02 03:01:06 | 000,168,480 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2009/11/20 07:15:18 | 000,137,728 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV - [2009/11/20 07:15:16 | 000,058,880 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)
DRV - [2009/10/29 04:14:32 | 000,099,440 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- E:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2007/01/25 20:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- E:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2007/01/25 20:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- E:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [1996/04/03 15:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot] -- E:\Windows\System32\giveio.sys -- (giveio)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Administrator_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 5E 1C 2C 75 F2 CD 01  [binary data]
IE - HKU\Administrator_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Robert_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4C AF 4B 45 37 01 CD 01  [binary data]
IE - HKU\Robert_ON_E\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\Robert_ON_E\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
IE - HKU\Robert_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredibar.com/mb128?a=6PQRxFiXXD&i=26"
FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb128/?loc=IB_DS&a=6PQRxFiXXD&&i=26&search="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\System32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: E:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: E:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: E:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: E:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox [2013/02/28 10:57:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}: C:\Program Files\IB Updater\Firefox [2013/02/28 10:57:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/29 22:20:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012/03/13 13:00:09 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Robert\AppData\Roaming\Mozilla\Extensions
[2012/12/02 20:55:46 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions
[2012/07/25 09:56:32 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012/12/02 20:55:46 | 000,000,000 | ---D | M] (incredibar.com) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\ffxtlbr@incredibar.com
[2012/12/02 20:51:04 | 000,000,000 | ---D | M] (Yontoo) -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\extensions\plugin@yontoo.com
[2012/08/23 09:27:37 | 000,000,950 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin-1.xml
[2012/07/25 14:20:43 | 000,000,950 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin-2.xml
[2012/07/24 08:48:30 | 000,000,168 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.gif
[2012/07/24 08:48:30 | 000,000,618 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.src
[2012/07/13 05:03:49 | 000,001,056 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\icqplugin.xml
[2012/12/02 20:53:12 | 000,002,203 | ---- | M] () -- E:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\dm36sp2j.default\searchplugins\MyStart Search.xml
[2012/08/29 22:20:54 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files\Mozilla Firefox\extensions
File not found (No name found) -- 
[2012/08/24 22:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- E:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/08/24 22:49:52 | 000,001,392 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/08/24 22:49:52 | 000,001,153 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/08/24 22:49:52 | 000,006,805 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/08/24 22:49:52 | 000,001,178 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/08/24 22:49:52 | 000,001,105 | ---- | M] () -- E:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ICQ Sparberater) - {0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD} - E:\Program Files\icq\Internet Explorer\icq.dll (solute gmbh)
O2 - BHO: (IB Updater) - {336D0C35-8A85-403a-B9D2-65C292C39087} - E:\Program Files\IB Updater\Extension32.dll ()
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - E:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -  File not found
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - E:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -  File not found
O3 - HKLM\..\Toolbar: (FileConverter 1.3 Toolbar) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} -  File not found
O3 - HKU\Robert_ON_E\..\Toolbar\WebBrowser: (FileConverter 1.3 Toolbar) - {78E516EF-11DE-47A1-8364-A99B917EC5EE} - E:\Program Files\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AVMWlanClient] E:\Program Files\avmwlanstick\FRITZWLANMini.exe (AVM Berlin)
O4 - HKLM..\Run: [BCSSync] E:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [BlueStacks Agent] E:\Program Files\BlueStacks\HD-Agent.exe (BlueStack Systems, Inc.)
O4 - HKLM..\Run: [JMB36X IDE Setup] E:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [MSC]  File not found
O4 - HKLM..\Run: [NUSB3MON] E:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [SDTray] E:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\Administrator_ON_E..\Run: [pkgndjozfpgpfzz]  File not found
O4 - HKU\Robert_ON_E..\Run: [DAEMON Tools Lite] E:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: E:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()
F3 - HKU\Administrator_ON_E WinNT: Run - (C:\Users\ADMINI~1\DOCUME~1\DAEMON~1\DAEMON~1.EXE) -  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\Administrator_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Robert_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Robert_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8 - Extra context menu item: An OneNote s&enden - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - E:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - E:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - E:\Program Files\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - E:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.6.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - E:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - E:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe ()
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Administrator_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe ()
O20 - HKU\Administrator_ON_E Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\skype.dat) - E:\Users\Administrator\AppData\Roaming\skype.dat ()
O20 - HKU\Robert_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe ()
O20 - Winlogon\Notify\SDWinLogon: DllName - SDWinLogon.dll -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{72ccbb9c-6d29-11e1-9e53-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{72ccbb9c-6d29-11e1-9e53-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell - "" = AutoRun
O33 - MountPoints2\{85b57e7c-38cc-11e2-9911-bc05430293a4}\Shell\AutoRun\command - "" = F:\launcher.exe
O33 - MountPoints2\{ed260521-6d29-11e1-af58-6cf049b829f3}\Shell - "" = AutoRun
O33 - MountPoints2\{ed260521-6d29-11e1-af58-6cf049b829f3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: Sharedaccess -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/03/25 13:05:39 | 000,000,000 | ---D | C] -- E:\Users\Administrator\Desktop\World of Warcraft
[2013/03/15 13:20:34 | 000,000,000 | -HSD | C] -- E:\Users\Administrator\AppData\Local\ST6UNST #2
[2013/03/15 13:20:27 | 000,000,000 | -HSD | C] -- E:\Users\Administrator\Documents\DAEMON Tools Lite
[2013/03/10 19:34:14 | 000,000,000 | ---D | C] -- E:\ProgramData\szcvlmmrfopiwja
[2012/11/18 06:17:28 | 000,929,844 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MFC42D.DLL
[2012/11/18 06:17:28 | 000,798,773 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MFCO42D.DLL
[2012/11/18 06:17:28 | 000,434,252 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MSVCRTD.DLL
[2012/11/18 06:17:28 | 000,421,888 | ---- | C] (Microsoft Corporation) -- E:\Program Files\MSVCRT.DLL
[2012/11/18 06:17:27 | 000,069,632 | ---- | C] (MAX - DESIGN) -- E:\Program Files\Max_Sound.dll
[2012/11/18 06:16:58 | 000,430,080 | ---- | C] (MAX - DESIGN) -- E:\Program Files\CompLogic.dll
[2012/11/18 06:16:55 | 000,593,920 | ---- | C] (MAX DESIGN) -- E:\Program Files\AnnoFrame.dll
[2012/11/18 06:16:12 | 000,933,331 | ---- | C] (MAX DESIGN) -- E:\Program Files\1503Startup.exe
[2011/05/12 07:53:30 | 000,147,456 | ---- | C] ( ) -- E:\Windows\System32\lagarith.dll
[2010/10/16 13:00:54 | 007,970,816 | ---- | C] (home) -- E:\Program Files\Hero Editor.exe
[2010/02/03 19:00:00 | 000,139,264 | ---- | C] ( ) -- E:\Windows\sipr3260.dll
 
========== Files - Modified Within 30 Days ==========
 
[2013/03/30 13:12:53 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/03/30 13:10:35 | 2616,057,856 | -HS- | M] () -- E:\hiberfil.sys
[2013/03/30 10:40:57 | 000,026,544 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/03/30 10:40:57 | 000,026,544 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/03/29 22:48:27 | 000,000,004 | ---- | M] () -- E:\Users\Administrator\AppData\Roaming\skype.ini
[2013/03/23 16:51:03 | 000,195,718 | ---- | M] () -- E:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg
[2013/03/23 09:10:41 | 000,700,168 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/03/23 09:10:41 | 000,654,880 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/03/23 09:10:41 | 000,148,964 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/03/23 09:10:41 | 000,121,752 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/03/17 11:47:18 | 000,540,468 | ---- | M] () -- E:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg
[2013/03/10 19:34:14 | 000,076,318 | ---- | M] () -- E:\ProgramData\ttiqexkmjhsphik
[2013/03/10 19:33:53 | 000,121,856 | ---- | M] () -- E:\ProgramData\pkgndjoz.exe
[2013/03/09 06:17:13 | 302,044,857 | ---- | M] () -- E:\Windows\MEMORY.DMP
 
========== Files Created - No Company Name ==========
 
[2013/03/29 22:40:03 | 000,000,004 | ---- | C] () -- E:\Users\Administrator\AppData\Roaming\skype.ini
[2013/03/23 16:49:00 | 000,195,718 | ---- | C] () -- E:\Users\Administrator\Documents\614860_274164932689356_1623987283_o.jpg
[2013/03/17 11:46:59 | 000,540,468 | ---- | C] () -- E:\Users\Administrator\Documents\WoWScrnShot_031713_164614.jpg
[2013/03/10 19:34:11 | 000,121,856 | ---- | C] () -- E:\ProgramData\pkgndjoz.exe
[2013/03/10 19:33:53 | 000,076,318 | ---- | C] () -- E:\ProgramData\ttiqexkmjhsphik
[2013/01/16 01:10:53 | 000,007,168 | ---- | C] () -- E:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/20 12:40:13 | 000,021,840 | ---- | C] () -- E:\Windows\System32\SIntfNT.dll
[2012/12/20 12:40:13 | 000,017,212 | ---- | C] () -- E:\Windows\System32\SIntf32.dll
[2012/12/20 12:40:13 | 000,012,067 | ---- | C] () -- E:\Windows\System32\SIntf16.dll
[2012/12/13 17:57:45 | 000,000,004 | ---- | C] () -- E:\Users\Robert\AppData\Roaming\skype.ini
[2012/12/02 20:55:06 | 001,008,496 | ---- | C] () -- E:\Windows\System32\dmwu.exe
[2012/12/02 20:55:06 | 000,028,160 | ---- | C] () -- E:\Windows\System32\ImHttpComm.dll
[2012/11/18 06:17:28 | 000,708,608 | ---- | C] () -- E:\Program Files\View.dll
[2012/11/18 06:17:28 | 000,233,472 | ---- | C] () -- E:\Program Files\SAVRepair.exe
[2012/11/18 06:17:28 | 000,043,279 | ---- | C] () -- E:\Program Files\Texte.dat
[2012/11/18 06:17:27 | 002,519,642 | ---- | C] () -- E:\Program Files\Handbuch.pdf
[2012/11/18 06:17:26 | 025,305,841 | ---- | C] () -- E:\Program Files\FigurenHeader.dat
[2012/11/18 06:17:25 | 014,289,592 | ---- | C] () -- E:\Program Files\Figuren200.dat
[2012/11/18 06:17:23 | 016,039,347 | ---- | C] () -- E:\Program Files\Figuren102.dat
[2012/11/18 06:17:21 | 016,777,177 | ---- | C] () -- E:\Program Files\Figuren101.dat
[2012/11/18 06:17:19 | 016,777,198 | ---- | C] () -- E:\Program Files\Figuren100.dat
[2012/11/18 06:17:18 | 011,190,229 | ---- | C] () -- E:\Program Files\Figuren009.dat
[2012/11/18 06:17:16 | 016,785,902 | ---- | C] () -- E:\Program Files\Figuren008.dat
[2012/11/18 06:17:14 | 016,769,888 | ---- | C] () -- E:\Program Files\Figuren007.dat
[2012/11/18 06:17:11 | 016,776,353 | ---- | C] () -- E:\Program Files\Figuren006.dat
[2012/11/18 06:17:09 | 016,776,964 | ---- | C] () -- E:\Program Files\Figuren005.dat
[2012/11/18 06:17:06 | 016,777,905 | ---- | C] () -- E:\Program Files\Figuren004.dat
[2012/11/18 06:17:04 | 016,776,259 | ---- | C] () -- E:\Program Files\Figuren003.dat
[2012/11/18 06:17:02 | 016,777,308 | ---- | C] () -- E:\Program Files\Figuren002.dat
[2012/11/18 06:17:00 | 016,778,359 | ---- | C] () -- E:\Program Files\Figuren001.dat
[2012/11/18 06:16:58 | 016,775,920 | ---- | C] () -- E:\Program Files\Figuren000.dat
[2012/11/18 06:16:58 | 000,358,963 | ---- | C] () -- E:\Program Files\binkw32.dll
[2012/11/18 06:16:57 | 002,187,264 | ---- | C] () -- E:\Program Files\AnnoSplash.exe
[2012/11/18 06:16:57 | 000,909,312 | ---- | C] () -- E:\Program Files\AnnoWelt.dll
[2012/11/18 06:16:57 | 000,221,184 | ---- | C] () -- E:\Program Files\AnnoScene.dll
[2012/11/18 06:16:57 | 000,184,320 | ---- | C] () -- E:\Program Files\AnnoGame.dll
[2012/11/18 06:16:55 | 000,385,024 | ---- | C] () -- E:\Program Files\AnnoDisplay.dll
[2012/11/18 06:16:13 | 192,149,051 | ---- | C] () -- E:\Program Files\Anlagen.dat
[2012/08/30 10:39:18 | 000,139,228 | -H-- | C] () -- E:\Windows\System32\mlfcache.dat
[2012/04/13 07:59:57 | 000,139,128 | ---- | C] () -- E:\Windows\System32\drivers\PnkBstrK.sys
[2012/04/13 07:59:48 | 000,189,248 | ---- | C] () -- E:\Windows\System32\PnkBstrB.exe
[2012/04/13 07:59:28 | 000,075,136 | ---- | C] () -- E:\Windows\System32\PnkBstrA.exe
[2012/03/13 15:41:58 | 000,010,240 | ---- | C] () -- E:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/03/13 14:11:34 | 000,084,480 | ---- | C] () -- E:\Users\Administrator\AppData\Roaming\skype.dat
[2012/03/13 12:43:51 | 000,065,536 | R--- | C] () -- E:\Windows\System32\XSrvSetup.exe
[2012/03/13 12:43:03 | 000,073,728 | ---- | C] () -- E:\Windows\System32\RtNicProp32.dll
[2012/03/13 12:39:10 | 000,000,010 | ---- | C] () -- E:\Windows\GSetup.ini
[2012/03/13 12:33:54 | 000,097,360 | ---- | C] () -- E:\Windows\System32\drivers\Fwusb1b.bin
[2012/03/13 12:29:22 | 000,000,000 | ---- | C] () -- E:\Windows\ativpsrm.bin
[2012/02/14 22:28:34 | 000,157,144 | ---- | C] () -- E:\Windows\System32\ativvsva.dat
[2012/02/14 22:28:32 | 000,204,952 | ---- | C] () -- E:\Windows\System32\ativvsvl.dat
[2012/02/14 17:05:16 | 000,054,784 | ---- | C] () -- E:\Windows\System32\OVDecode.dll
[2012/01/31 01:00:24 | 000,016,896 | ---- | C] () -- E:\Windows\System32\kdbsdk32.dll
[2012/01/10 17:10:08 | 000,601,728 | ---- | C] () -- E:\Windows\System32\atiicdxx.dat
[2011/09/12 18:06:16 | 000,003,917 | ---- | C] () -- E:\Windows\System32\atipblag.dat
[2011/07/15 11:02:32 | 002,616,320 | ---- | C] () -- E:\Windows\explorer.exe
[2011/05/13 04:58:12 | 002,785,280 | ---- | C] () -- E:\Windows\System32\x264vfw.dll
[2011/04/11 21:30:05 | 000,700,168 | ---- | C] () -- E:\Windows\System32\perfh007.dat
[2011/04/11 21:30:05 | 000,295,922 | ---- | C] () -- E:\Windows\System32\perfi007.dat
[2011/04/11 21:30:05 | 000,148,964 | ---- | C] () -- E:\Windows\System32\perfc007.dat
[2011/04/11 21:30:05 | 000,038,104 | ---- | C] () -- E:\Windows\System32\perfd007.dat
[2011/04/11 14:09:18 | 000,073,216 | ---- | C] () -- E:\Windows\System32\ff_vfw.dll
[2011/03/19 06:06:02 | 000,240,640 | ---- | C] () -- E:\Windows\System32\xvidvfw.dll
[2011/03/19 06:04:28 | 000,650,752 | ---- | C] () -- E:\Windows\System32\xvidcore.dll
[2010/11/20 17:29:34 | 000,080,896 | ---- | C] () -- E:\Windows\System32\RDVGHelper.exe
[2010/11/20 17:29:26 | 000,066,048 | ---- | C] () -- E:\Windows\System32\PrintBrmUi.exe
[2010/11/20 17:29:24 | 000,252,928 | ---- | C] () -- E:\Windows\System32\DShowRdpFilter.dll
[2010/03/15 00:31:48 | 000,165,376 | ---- | C] () -- E:\Windows\System32\unrar.dll
[2009/08/27 03:04:12 | 000,207,400 | R--- | C] () -- E:\Windows\GSetup.exe
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,408,696 | ---- | C] () -- E:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,654,880 | ---- | C] () -- E:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- E:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,121,752 | ---- | C] () -- E:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- E:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- E:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- E:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- E:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\System32\BWContextHandler.dll
[2009/07/13 18:09:19 | 000,982,196 | ---- | C] () -- E:\Windows\System32\igkrng500.bin
[2009/07/13 18:09:19 | 000,417,344 | ---- | C] () -- E:\Windows\System32\igcompkrng500.bin
[2009/07/13 18:09:19 | 000,139,824 | ---- | C] () -- E:\Windows\System32\igfcg500.bin
[2009/07/13 18:09:19 | 000,097,448 | ---- | C] () -- E:\Windows\System32\igfcg500m.bin
[2009/06/19 15:06:22 | 000,197,912 | ---- | C] () -- E:\Windows\System32\physxcudart_20.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelTraditionalChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSwedish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSpanish.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelPortugese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelKorean.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelJapanese.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelGerman.dll
[2009/06/19 15:06:22 | 000,058,648 | ---- | C] () -- E:\Windows\System32\AgCPanelFrench.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\System32\mlang.dat
[2007/10/12 18:20:06 | 000,151,417 | ---- | C] () -- E:\Windows\System32\xlive.dll.cat
[2007/02/05 15:05:26 | 000,000,038 | ---- | C] () -- E:\Windows\AviSplitter.INI
[1996/04/03 15:33:26 | 000,005,248 | ---- | C] () -- E:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2012/03/13 12:48:36 | 000,000,000 | ---D | M] -- E:\ProgramData\AMD
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/03/13 13:07:06 | 000,000,000 | ---D | M] -- E:\ProgramData\ashampoo
[2012/09/23 18:04:43 | 000,000,000 | ---D | M] -- E:\ProgramData\BlueStacks
[2012/09/23 18:04:14 | 000,000,000 | ---D | M] -- E:\ProgramData\BlueStacksSetup
[2012/11/27 16:26:37 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2012/06/28 18:33:50 | 000,000,000 | ---D | M] -- E:\ProgramData\ICQ
[2012/12/10 08:41:51 | 000,000,000 | ---D | M] -- E:\ProgramData\Solidshield
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü
[2013/03/10 19:34:51 | 000,000,000 | ---D | M] -- E:\ProgramData\szcvlmmrfopiwja
[2012/12/02 20:51:03 | 000,000,000 | ---D | M] -- E:\ProgramData\Tarma Installer
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen
[2012/03/13 13:14:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Win7codecs
[2013/01/30 15:19:19 | 000,032,632 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2013/01/14 12:26:37 | 000,000,000 | -HSD | M] -- E:\$Recycle.Bin
[2012/03/13 12:46:28 | 000,000,000 | ---D | M] -- E:\AMD
[2013/01/24 05:49:03 | 000,000,000 | -HSD | M] -- E:\Config.Msi
[2012/10/07 08:35:12 | 000,000,000 | ---D | M] -- E:\DeusEx
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- E:\Documents and Settings
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Dokumente und Einstellungen
[2012/03/13 13:17:23 | 000,000,000 | RH-D | M] -- E:\MSOCache
[2009/07/13 22:37:05 | 000,000,000 | ---D | M] -- E:\PerfLogs
[2013/02/21 00:46:14 | 000,000,000 | ---D | M] -- E:\Program Files
[2013/03/10 19:34:14 | 000,000,000 | -H-D | M] -- E:\ProgramData
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Programme
[2012/03/13 12:32:17 | 000,000,000 | -HSD | M] -- E:\Recovery
[2013/03/23 04:05:15 | 000,000,000 | -HSD | M] -- E:\System Volume Information
[2012/03/13 14:28:46 | 000,000,000 | ---D | M] -- E:\Temp
[2013/01/14 12:26:30 | 000,000,000 | R--D | M] -- E:\Users
[2013/03/29 22:51:57 | 000,000,000 | ---D | M] -- E:\Windows
 
< %PROGRAMFILES%\*.exe >
[2004/01/06 21:04:00 | 000,933,331 | ---- | M] (MAX DESIGN) -- E:\Program Files\1503Startup.exe
[2005/10/05 07:00:16 | 002,187,264 | ---- | M] () -- E:\Program Files\AnnoSplash.exe
[2010/10/16 13:00:54 | 007,970,816 | ---- | M] (home) -- E:\Program Files\Hero Editor.exe
[2004/01/06 21:04:00 | 000,233,472 | ---- | M] () -- E:\Program Files\SAVRepair.exe
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
< C:\Windows\system32\*.tsp >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009/07/13 21:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- E:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009/07/13 21:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- E:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\System32\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- E:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2010/11/20 17:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2012/11/13 09:07:52 | 003,906,584 | ---- | M] (Safer-Networking Ltd.) MD5=E4A0900CF535888DDD85B10040CA3E34 -- E:\Program Files\Spybot - Search & Destroy 2\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] () Unable to obtain MD5 -- E:\Windows\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] () Unable to obtain MD5 -- E:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 01:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 01:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2010/11/20 17:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 17:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 17:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\System32\netlogon.dll
[2010/11/20 17:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- E:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\System32\drivers\nvstor.sys
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 01:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 01:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2010/11/20 17:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 17:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010/11/20 17:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\System32\scecli.dll
[2010/11/20 17:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- E:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 17:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- E:\Windows\System32\user32.dll
[2010/11/20 17:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- E:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 17:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\System32\userinit.exe
[2010/11/20 17:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- E:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 17:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- E:\Windows\System32\winlogon.exe
[2010/11/20 17:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- E:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- E:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 19:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- E:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2010/11/20 17:29:08 | 000,828,928 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- E:\Windows\system32\fontext.dll
[2012/06/09 00:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- E:\Windows\system32\shell32.dll
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
< CREATERESTOREPOINT >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 763 bytes -> E:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six: Vegas.LNK
< End of report >

einen extra.txt hab ich nicht gefunden in dem ordner.
kann mir jemand erklären was ich als nächstes zu tun hab?
mfg devil94

DerJazzer · 30.03.2013, 19:51

Hallo und

Ich bin Christoph und möchte dir bei deinem Problem helfen.
Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scans durchführen zu denen Du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting (Posten in mehreren Foren).
Installiere oder Deinstalliere während der Bereinigung keine Software außer Du wurdest dazu aufgefordert.
Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
Poste die Logfiles direkt in deinen Thread. Nicht anhängen außer ich fordere Dich dazu auf. Erschwert mir nämlich das Auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass dein PC clean ist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einem USB Stick:
Farbar Recovery Scan Tool 32-Bit-Version
Farbar Recovery Scan Tool 64-Bit-Version

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Über den Boot Manager
Starte den Rechner neu auf.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD
Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu auf und starte von der CD

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !!

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung
Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

devil94 · 30.03.2013, 20:11

Hallo und danke für die schnelle Antwort!
habe alles durchgeführt.

oh mist sorry! :S

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 17 days old)
Ran by SYSTEM at 30-03-2013 22:09:07
Running from F:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2009-12-08] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM\...\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe [577400 2012-09-14] (BlueStack Systems, Inc.)
HKLM\...\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Administrator\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Administrator\...\Run: [pkgndjozfpgpfzz] C:\Windows\pkgndjoz.exe [x]
HKU\Administrator\...\Winlogon: [Shell] explorer.exe,C:\Users\Administrator\AppData\Roaming\skype.dat [84480 2011-11-17] ()
HKU\Robert\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [3673728 2012-11-06] (DT Soft Ltd)
HKU\Robert\...\Winlogon: [Shell] explorer.exe [x]
HKLM\...\Winlogon: [Shell] explorer.exe [2616320 2011-02-25] ()
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()

==================== Services (Whitelisted) ===================

2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [291840 2012-02-14] (Advanced Micro Devices, Inc.)
2 BstHdAndroidSvc; "C:\Program Files\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [393080 2012-09-14] (BlueStack Systems, Inc.)
2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384888 2012-09-14] (BlueStack Systems, Inc.)
2 Guard.Mail.ru; "C:\Program Files\Guard-ICQ\GuardICQ.exe" [1564368 2012-06-28] ()
2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
2 IBUpdaterService; C:\Windows\System32\dmwu.exe [1008496 2012-10-02] ()
2 JMB36X; C:\Windows\System32\XSrvSetup.exe [65536 2009-08-06] ()
2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75136 2012-12-10] ()
2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
4 KMService; C:\Windows\system32\srvany.exe [x]
2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

==================== Drivers (Whitelisted) ====================

2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [46720 2012-02-01] (Advanced Micro Devices)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin)
2 BstHdDrv; \??\C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63864 2012-09-14] (BlueStack Systems)
1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [99440 2009-10-29] (JMicron Technology Corp.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
1 MpKsl07894b93; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys [29904 2013-03-30] ()
1 MpKsl3d312dd0; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys [29904 2013-03-30] ()
1 MpKsl9a732883; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys [29904 2013-03-30] ()
1 MpKsld861874d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys [29904 2013-03-30] ()
1 MpKsle2a982e2; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys [29904 2013-03-30] ()
3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)
0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
3 gdrv; \??\C:\Windows\gdrv.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 00:50 - 2013-03-31 02:34 - 00100434 ____A C:\OTL.Txt
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 03:40 - 2013-03-30 03:48 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:05 - 2013-03-25 18:16 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-20 15:35 - 2013-03-23 03:40 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 23:49 - 2013-03-30 02:00 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-17 16:54 - 2013-03-17 16:55 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-15 18:20 - 2013-03-23 09:00 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-15 18:20 - 2013-03-17 16:34 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-11 00:33 - 2013-03-11 00:34 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip

==================== One Month Modified Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 02:34 - 2013-03-31 00:50 - 00100434 ____A C:\OTL.Txt
2013-03-31 00:45 - 2013-01-14 17:26 - 00000000 ____D C:\users\Administrator
2013-03-31 00:45 - 2012-03-13 17:32 - 00000000 ____D C:\users\Robert
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 18:12 - 2013-01-04 08:49 - 00043704 ____A C:\Windows\setupact.log
2013-03-30 18:10 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-30 03:48 - 2013-03-30 03:40 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-30 03:35 - 2013-01-14 17:28 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-03-30 02:00 - 2013-03-17 23:49 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-30 01:54 - 2013-02-06 15:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\TS3Client
2013-03-30 00:00 - 2012-03-13 21:11 - 00000000 ____D C:\Program Files\SpeedFan
2013-03-29 16:50 - 2013-01-14 22:47 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2013-03-29 14:58 - 2012-03-13 17:32 - 01513695 ____A C:\Windows\WindowsUpdate.log
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-26 18:23 - 2012-06-12 14:57 - 00000000 ____D C:\Users\Administrator\Desktop\Bewerbungen Robert
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:16 - 2013-03-25 18:05 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-23 14:10 - 2010-11-20 22:01 - 01621244 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-23 09:00 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-23 03:40 - 2013-03-20 15:35 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 23:00 - 2012-03-13 23:04 - 00000000 ____D C:\Users\Administrator\Desktop\Eigene Filme
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 16:55 - 2013-03-17 16:54 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-17 16:34 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-11 00:33 - 2013-03-11 00:34 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-10 20:55 - 2012-03-14 23:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-09 11:17 - 2012-04-08 23:42 - 302044857 ____A C:\Windows\MEMORY.DMP
2013-03-09 11:17 - 2012-04-08 23:42 - 00000000 ____D C:\Windows\Minidump
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip
2013-03-01 09:21 - 2012-12-03 01:55 - 00000000 ____D C:\Program Files\IB Updater

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-1000\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\explorer.exe IS INFECTED. <===== ATTENTION!

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-29 11:52:54
Restore point made on: 2013-01-06 04:20:55
Restore point made on: 2013-01-15 17:51:08
Restore point made on: 2013-01-22 19:08:56
Restore point made on: 2013-02-03 18:23:50
Restore point made on: 2013-02-15 02:20:50
Restore point made on: 2013-02-22 15:35:13
Restore point made on: 2013-03-02 17:55:05
Restore point made on: 2013-03-10 10:28:41
Restore point made on: 2013-03-23 09:05:11

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 4094.49 MB
Available physical RAM: 3566.2 MB
Total Pagefile: 4092.78 MB
Available Pagefile: 3566.35 MB
Total Virtual: 2047.88 MB
Available Virtual: 1960.68 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:465.66 GB) (Free:62.34 GB) NTFS
3 Drive f: () (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Datentr„ger-ID: 290F0B0B

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 100 MB 1024 KB
Partition 2 Prim„r 465 GB 101 MB

=========================================================

Disk: 0
Partition 1
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System-rese NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Datentr„ger-ID: 2D653D85

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1704 KB

=========================================================

Disk: 1
Partition 1
Typ : 0B
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Wechselmed 14 GB Fehlerfre

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 290F0B0B

Partition 1:
=========
Hex: 8020210007DF130C0008000000200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB

Partition 2:
=========
Hex: 00DF140C07FEFFFF002803000030353A
Active: NO
Type: 07 (NTFS)
Size: 466 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 2D653D85

Partition 1:
=========
Hex: 003607000BBBDD5E500D0000B072CE01
Active: NO
Type: 0B
Size: 14 GB

Last Boot: 2013-03-23 08:57

==================== End Of Log ============================

DerJazzer · 30.03.2013, 20:13

Du hast wieder das OTLPe-Log gepostet, ich würde aber gerne ein FRST-Log sehen

DerJazzer · 30.03.2013, 21:34

Hi

du hast dir da was nettes eingefangen - aber das kriegen wir hin:

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Über den Boot Manager
Starte den Rechner neu auf.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD
Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu auf und starte von der CD

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !!

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung
Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
Akzeptiere den Disclaimer mit Yes.

Jetzt gib in das Suchfeld Folgendes ein:
Code:
ATTFilter
explorer.exe
         
und klicke Search File(s)
Das Tool erstellt eine Search.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

devil94 · 30.03.2013, 21:57

Mist- schon gedacht das es was schlimmeres ist.
Farbar Recovery Scan Tool (x86) Version: 13-03-2013
Ran by SYSTEM at 2013-03-30 23:53:42
Running from F:\

================== Search: "explorer.exe" ===================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2011-07-15 16:02] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2010-11-20 22:29] - [2010-11-20 22:29] - 2616320 ____A (Microsoft Corporation) 40D777B7A95E00593EB1568C68514493

C:\Program Files\Spybot - Search & Destroy 2\explorer.exe
[2013-01-04 04:30] - [2012-11-13 14:07] - 3906584 ____A (Safer-Networking Ltd.) E4A0900CF535888DDD85B10040CA3E34

=== End Of Search ===

mfg devil94

DerJazzer · 30.03.2013, 23:18

So, das sollte ihm schwer zu schaffen machen:

Schritt 1

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\Administrator\...\Run: [pkgndjozfpgpfzz] C:\Windows\pkgndjoz.exe [x]
HKU\Administrator\...\Winlogon: [Shell] explorer.exe,C:\Users\Administrator\AppData\Roaming\skype.dat [84480 2011-11-17] ()
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
2013-03-30 03:40 - 2013-03-30 03:48 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-20 15:35 - 2013-03-23 03:40 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-11 00:33 - 2013-03-11 00:34 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-1000\$303fa670b122c7f9747c5881443d375b
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b
Replace: C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe  C:\Windows\explorer.exe

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Schritt 2

Erstelle nun bitte ein neues FRST-Scan-Log.

Bitte poste in deiner nächsten Antwort

Fixlog.txt
FRST.txt

devil94 · 30.03.2013, 23:33

Sooo:

Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 13-03-2013
Ran by SYSTEM at 2013-03-31 01:31:26 Run:1
Running from F:\

==============================================

HKEY_USERS\Administrator\Software\Microsoft\Windows\CurrentVersion\Run\\pkgndjozfpgpfzz Value deleted successfully.
HKEY_USERS\Administrator\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default value was restored successfully .
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}] should be deleted in normal mode (if present).
C:\Users\Administrator\AppData\Roaming\skype.ini moved successfully.
C:\Users\Administrator\AppData\Roaming\desktop.ini moved successfully.
C:\ProgramData\szcvlmmrfopiwja moved successfully.
C:\ProgramData\pkgndjoz.exe moved successfully.
C:\ProgramData\ttiqexkmjhsphik moved successfully.
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-1000\$303fa670b122c7f9747c5881443d375b moved successfully.
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b moved successfully.
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b deleted successfully.
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b not found.
C:\Windows\explorer.exe moved successfully.
C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe copied successfully to C:\Windows\explorer.exe

==== End of Fixlog ====

can result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 17 days old)
Ran by SYSTEM at 30-03-2013 22:09:07
Running from F:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2009-12-08] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM\...\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe [577400 2012-09-14] (BlueStack Systems, Inc.)
HKLM\...\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Administrator\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Administrator\...\Run: [pkgndjozfpgpfzz] C:\Windows\pkgndjoz.exe [x]
HKU\Administrator\...\Winlogon: [Shell] explorer.exe,C:\Users\Administrator\AppData\Roaming\skype.dat [84480 2011-11-17] ()
HKU\Robert\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [3673728 2012-11-06] (DT Soft Ltd)
HKU\Robert\...\Winlogon: [Shell] explorer.exe [x]
HKLM\...\Winlogon: [Shell] explorer.exe [2616320 2011-02-25] ()
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()

==================== Services (Whitelisted) ===================

2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [291840 2012-02-14] (Advanced Micro Devices, Inc.)
2 BstHdAndroidSvc; "C:\Program Files\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [393080 2012-09-14] (BlueStack Systems, Inc.)
2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384888 2012-09-14] (BlueStack Systems, Inc.)
2 Guard.Mail.ru; "C:\Program Files\Guard-ICQ\GuardICQ.exe" [1564368 2012-06-28] ()
2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
2 IBUpdaterService; C:\Windows\System32\dmwu.exe [1008496 2012-10-02] ()
2 JMB36X; C:\Windows\System32\XSrvSetup.exe [65536 2009-08-06] ()
2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75136 2012-12-10] ()
2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
4 KMService; C:\Windows\system32\srvany.exe [x]
2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

==================== Drivers (Whitelisted) ====================

2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [46720 2012-02-01] (Advanced Micro Devices)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin)
2 BstHdDrv; \??\C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63864 2012-09-14] (BlueStack Systems)
1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [99440 2009-10-29] (JMicron Technology Corp.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
1 MpKsl07894b93; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys [29904 2013-03-30] ()
1 MpKsl3d312dd0; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys [29904 2013-03-30] ()
1 MpKsl9a732883; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys [29904 2013-03-30] ()
1 MpKsld861874d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys [29904 2013-03-30] ()
1 MpKsle2a982e2; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys [29904 2013-03-30] ()
3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)
0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
3 gdrv; \??\C:\Windows\gdrv.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 00:50 - 2013-03-31 02:34 - 00100434 ____A C:\OTL.Txt
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 03:40 - 2013-03-30 03:48 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:05 - 2013-03-25 18:16 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-20 15:35 - 2013-03-23 03:40 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 23:49 - 2013-03-30 02:00 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-17 16:54 - 2013-03-17 16:55 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-15 18:20 - 2013-03-23 09:00 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-15 18:20 - 2013-03-17 16:34 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-11 00:33 - 2013-03-11 00:34 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip

==================== One Month Modified Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 02:34 - 2013-03-31 00:50 - 00100434 ____A C:\OTL.Txt
2013-03-31 00:45 - 2013-01-14 17:26 - 00000000 ____D C:\users\Administrator
2013-03-31 00:45 - 2012-03-13 17:32 - 00000000 ____D C:\users\Robert
2013-03-30 22:08 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-30 18:12 - 2013-01-04 08:49 - 00043704 ____A C:\Windows\setupact.log
2013-03-30 18:10 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-30 03:48 - 2013-03-30 03:40 - 00000004 ____A C:\Users\Administrator\AppData\Roaming\skype.ini
2013-03-30 03:35 - 2013-01-14 17:28 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-03-30 02:00 - 2013-03-17 23:49 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-30 01:54 - 2013-02-06 15:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\TS3Client
2013-03-30 00:00 - 2012-03-13 21:11 - 00000000 ____D C:\Program Files\SpeedFan
2013-03-29 16:50 - 2013-01-14 22:47 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2013-03-29 14:58 - 2012-03-13 17:32 - 01513695 ____A C:\Windows\WindowsUpdate.log
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-26 18:23 - 2012-06-12 14:57 - 00000000 ____D C:\Users\Administrator\Desktop\Bewerbungen Robert
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:16 - 2013-03-25 18:05 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-23 14:10 - 2010-11-20 22:01 - 01621244 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-23 09:00 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-23 03:40 - 2013-03-20 15:35 - 00009728 ____H C:\Users\Administrator\AppData\Roaming\desktop.ini
2013-03-18 23:00 - 2012-03-13 23:04 - 00000000 ____D C:\Users\Administrator\Desktop\Eigene Filme
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 16:55 - 2013-03-17 16:54 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-17 16:34 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-11 00:34 - 2013-03-11 00:34 - 00000000 ____D C:\ProgramData\szcvlmmrfopiwja
2013-03-11 00:34 - 2013-03-11 00:33 - 00076318 ____A C:\ProgramData\ttiqexkmjhsphik
2013-03-11 00:33 - 2013-03-11 00:34 - 00121856 ____A C:\ProgramData\pkgndjoz.exe
2013-03-10 20:55 - 2012-03-14 23:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-09 11:17 - 2012-04-08 23:42 - 302044857 ____A C:\Windows\MEMORY.DMP
2013-03-09 11:17 - 2012-04-08 23:42 - 00000000 ____D C:\Windows\Minidump
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip
2013-03-01 09:21 - 2012-12-03 01:55 - 00000000 ____D C:\Program Files\IB Updater

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-1000\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1811024326-1583312281-2864969909-500\$303fa670b122c7f9747c5881443d375b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$303fa670b122c7f9747c5881443d375b

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-25 06:30] - 2616320 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\explorer.exe IS INFECTED. <===== ATTENTION!

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-29 11:52:54
Restore point made on: 2013-01-06 04:20:55
Restore point made on: 2013-01-15 17:51:08
Restore point made on: 2013-01-22 19:08:56
Restore point made on: 2013-02-03 18:23:50
Restore point made on: 2013-02-15 02:20:50
Restore point made on: 2013-02-22 15:35:13
Restore point made on: 2013-03-02 17:55:05
Restore point made on: 2013-03-10 10:28:41
Restore point made on: 2013-03-23 09:05:11

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 4094.49 MB
Available physical RAM: 3566.2 MB
Total Pagefile: 4092.78 MB
Available Pagefile: 3566.35 MB
Total Virtual: 2047.88 MB
Available Virtual: 1960.68 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:465.66 GB) (Free:62.34 GB) NTFS
3 Drive f: () (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Datentr„ger-ID: 290F0B0B

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 100 MB 1024 KB
Partition 2 Prim„r 465 GB 101 MB

=========================================================

Disk: 0
Partition 1
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System-rese NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Datentr„ger-ID: 2D653D85

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1704 KB

=========================================================

Disk: 1
Partition 1
Typ : 0B
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Wechselmed 14 GB Fehlerfre

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 290F0B0B

Partition 1:
=========
Hex: 8020210007DF130C0008000000200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB

Partition 2:
=========
Hex: 00DF140C07FEFFFF002803000030353A
Active: NO
Type: 07 (NTFS)
Size: 466 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 2D653D85

Partition 1:
=========
Hex: 003607000BBBDD5E500D0000B072CE01
Active: NO
Type: 0B
Size: 14 GB

Last Boot: 2013-03-23 08:57

==================== End Of Log ============================

Hoffentlich wird mein rechner bis Dienstag wieder laufen.

mfg devil94

DerJazzer · 30.03.2013, 23:40

Du hast mir wieder die alte FRST.txt gepostet. Lösche die alte FRST.txt vom Stick und lasse bitte einen neuen Scan laufen. Poste mir danach die -neue- FRST.txt.

devil94 · 30.03.2013, 23:47

Zitat:

Zitat von DerJazzer

Du hast mir wieder die alte FRST.txt gepostet. Lösche die alte FRST.txt vom Stick und lasse bitte einen neuen Scan laufen. Poste mir danach die -neue- FRST.txt.

Es wurde keine frst.txt erstellt - habs eben nochmal gescannt
nur ne fixlog.txt wurde nochmal erstellt aufm USB stick

DerJazzer · 30.03.2013, 23:53

Bist du sicher, dass du auf Scan gedrückt hast?

Lösche mal alles vom USB-Stick, lade dir eine neue FRST.exe herunter und kopiere sie auf den Stick. Führe dann einen Scan aus und poste das Logfile (wie hier beschrieben).

devil94 · 31.03.2013, 00:02

Fehler war auf meiner Seite, habe auf Fix anstatt Scan gedrückt.
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2013 (ATTENTION: FRST version is 18 days old)
Ran by SYSTEM at 31-03-2013 01:59:31
Running from F:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2009-12-08] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM\...\Run: [NUSB3MON] "C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe [577400 2012-09-14] (BlueStack Systems, Inc.)
HKLM\...\Run: [SDTray] "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" [3825176 2012-11-13] (Safer-Networking Ltd.)
HKU\Administrator\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [18705664 2013-01-08] (Skype Technologies S.A.)
HKU\Robert\...\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [3673728 2012-11-06] (DT Soft Ltd)
HKU\Robert\...\Winlogon: [Shell] explorer.exe [x]
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Startup: C:\ProgramData\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six ()

==================== Services (Whitelisted) ===================

2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe /launchService [291840 2012-02-14] (Advanced Micro Devices, Inc.)
2 BstHdAndroidSvc; "C:\Program Files\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [393080 2012-09-14] (BlueStack Systems, Inc.)
2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384888 2012-09-14] (BlueStack Systems, Inc.)
2 Guard.Mail.ru; "C:\Program Files\Guard-ICQ\GuardICQ.exe" [1564368 2012-06-28] ()
2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
2 IBUpdaterService; C:\Windows\System32\dmwu.exe [1008496 2012-10-02] ()
2 JMB36X; C:\Windows\System32\XSrvSetup.exe [65536 2009-08-06] ()
2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75136 2012-12-10] ()
2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
4 KMService; C:\Windows\system32\srvany.exe [x]
2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

==================== Drivers (Whitelisted) ====================

2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [46720 2012-02-01] (Advanced Micro Devices)
3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-26] (AVM Berlin)
2 BstHdDrv; \??\C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63864 2012-09-14] (BlueStack Systems)
1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [99440 2009-10-29] (JMicron Technology Corp.)
0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [193552 2012-08-30] (Microsoft Corporation)
1 MpKsl07894b93; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl07894b93.sys [29904 2013-03-30] ()
1 MpKsl3d312dd0; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl3d312dd0.sys [29904 2013-03-30] ()
1 MpKsl9a732883; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsl9a732883.sys [29904 2013-03-30] ()
1 MpKsld861874d; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsld861874d.sys [29904 2013-03-30] ()
1 MpKsle2a982e2; \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{3D06E712-AF7E-443F-A800-EC3E2827E38B}\MpKsle2a982e2.sys [29904 2013-03-30] ()
3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [168480 2009-12-02] (Realtek Semiconductor Corp.)
0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
3 gdrv; \??\C:\Windows\gdrv.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 00:50 - 2013-03-31 02:34 - 00100434 ____A C:\OTL.Txt
2013-03-30 22:08 - 2013-03-31 01:31 - 00000000 ____D C:\FRST
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:05 - 2013-03-25 18:16 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 23:49 - 2013-03-30 02:00 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-17 16:54 - 2013-03-17 16:55 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-15 18:20 - 2013-03-23 09:00 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-15 18:20 - 2013-03-17 16:34 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip

==================== One Month Modified Files and Folders ========

2013-03-31 02:47 - 2013-03-31 02:47 - 00000000 ____D C:\_OTL
2013-03-31 02:34 - 2013-03-31 00:50 - 00100434 ____A C:\OTL.Txt
2013-03-31 01:31 - 2013-03-30 22:08 - 00000000 ____D C:\FRST
2013-03-31 01:29 - 2013-01-04 08:49 - 00044762 ____A C:\Windows\setupact.log
2013-03-31 01:29 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-03-31 00:45 - 2013-01-14 17:26 - 00000000 ____D C:\users\Administrator
2013-03-31 00:45 - 2012-03-13 17:32 - 00000000 ____D C:\users\Robert
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-03-30 15:40 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-03-30 03:35 - 2013-01-14 17:28 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Skype
2013-03-30 02:00 - 2013-03-17 23:49 - 00000080 ____A C:\Users\Administrator\Desktop\realms.txt
2013-03-30 01:54 - 2013-02-06 15:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\TS3Client
2013-03-30 00:00 - 2012-03-13 21:11 - 00000000 ____D C:\Program Files\SpeedFan
2013-03-29 16:50 - 2013-01-14 22:47 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2013-03-29 14:58 - 2012-03-13 17:32 - 01513695 ____A C:\Windows\WindowsUpdate.log
2013-03-27 03:49 - 2013-03-27 03:49 - 00000076 ____A C:\Users\Administrator\Desktop\1.txt
2013-03-26 18:23 - 2012-06-12 14:57 - 00000000 ____D C:\Users\Administrator\Desktop\Bewerbungen Robert
2013-03-25 23:33 - 2013-03-25 23:33 - 00400662 ____A C:\Users\Administrator\Downloads\RBGInterface.zip
2013-03-25 18:16 - 2013-03-25 18:05 - 00000000 ____D C:\Users\Administrator\Desktop\World of Warcraft
2013-03-23 14:10 - 2010-11-20 22:01 - 01621244 ____A C:\Windows\System32\PerfStringBackup.INI
2013-03-23 09:00 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\AppData\Local\ST6UNST #2
2013-03-18 23:00 - 2012-03-13 23:04 - 00000000 ____D C:\Users\Administrator\Desktop\Eigene Filme
2013-03-18 21:05 - 2013-03-18 21:05 - 00003306 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.20.zip
2013-03-17 16:55 - 2013-03-17 16:54 - 00003343 ____A C:\Users\Administrator\Downloads\InterruptBar-v1.3.zip
2013-03-17 16:34 - 2013-03-15 18:20 - 00000000 __SHD C:\Users\Administrator\Documents\DAEMON Tools Lite
2013-03-10 20:55 - 2012-03-14 23:43 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-03-09 11:17 - 2013-03-09 11:17 - 00920120 ____A C:\Windows\Minidump\030913-21450-01.dmp
2013-03-09 11:17 - 2012-04-08 23:42 - 302044857 ____A C:\Windows\MEMORY.DMP
2013-03-09 11:17 - 2012-04-08 23:42 - 00000000 ____D C:\Windows\Minidump
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl.zip
2013-03-01 13:29 - 2013-03-01 13:29 - 00013030 ____A C:\Users\Administrator\Downloads\LoseControl (1).zip
2013-03-01 09:21 - 2012-12-03 01:55 - 00000000 ____D C:\Program Files\IB Updater

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-07-15 16:02] - [2011-02-26 06:19] - 2616320 ____A (Microsoft Corporation) 0FB9C74046656D1579A64660AD67B746

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-29 11:52:54
Restore point made on: 2013-01-06 04:20:55
Restore point made on: 2013-01-15 17:51:08
Restore point made on: 2013-01-22 19:08:56
Restore point made on: 2013-02-03 18:23:50
Restore point made on: 2013-02-15 02:20:50
Restore point made on: 2013-02-22 15:35:13
Restore point made on: 2013-03-02 17:55:05
Restore point made on: 2013-03-10 10:28:41
Restore point made on: 2013-03-23 09:05:11

==================== Memory info ===========================

Percentage of memory in use: 12%
Total physical RAM: 4094.49 MB
Available physical RAM: 3575.69 MB
Total Pagefile: 4092.78 MB
Available Pagefile: 3575.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1961.6 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:465.66 GB) (Free:62.34 GB) NTFS
3 Drive f: () (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32
4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
5 Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Datentr„ger-ID: 290F0B0B

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 100 MB 1024 KB
Partition 2 Prim„r 465 GB 101 MB

=========================================================

Disk: 0
Partition 1
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System-rese NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Datentr„ger-ID: 2D653D85

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1704 KB

=========================================================

Disk: 1
Partition 1
Typ : 0B
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F FAT32 Wechselmed 14 GB Fehlerfre

=========================================================
============================== MBR Partition Table ==================

==============================
Partitions of Disk 0:
===============
Disk ID: 290F0B0B

Partition 1:
=========
Hex: 8020210007DF130C0008000000200300
Active: YES
Type: 07 (NTFS)
Size: 100 MB

Partition 2:
=========
Hex: 00DF140C07FEFFFF002803000030353A
Active: NO
Type: 07 (NTFS)
Size: 466 GB

==============================
Partitions of Disk 1:
===============
Disk ID: 2D653D85

Partition 1:
=========
Hex: 003607000BBBDD5E500D0000B072CE01
Active: NO
Type: 0B
Size: 14 GB

Last Boot: 2013-03-23 08:57

==================== End Of Log ============================

Tut mir leid
mfg devil

DerJazzer · 31.03.2013, 00:06

Kein Ding

Du solltest jetzt wieder in den normalen Modus booten können.

Mache dort bitte Folgendes:

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)

Doppelklick auf die OTL.exe
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

devil94 · 31.03.2013, 00:19

Die eine .txt-dateiOTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 31.03.2013 03:12:01 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Administrator\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,37 Gb Available Physical Memory | 72,96% Memory free
7,25 Gb Paging File | 6,28 Gb Available in Paging File | 86,70% Paging File free
Paging file location(s): c:\pagefile.sys 4096 4096 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465,66 Gb Total Space | 62,33 Gb Free Space | 13,39% Space Free | Partition Type: NTFS
Drive E: | 14,44 Gb Total Space | 14,44 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: ROBERT-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallDisableNotify" = 1
"FirewallOverride" = 0
"UpdatesDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{030C0401-52A9-BE86-D8A7-52C0DA203275}" = CCC Help Swedish
"{0766C1B9-B2DC-46E5-8934-4F3D6B42B1BD}" = ICQ Sparberater
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217006FF}" = Java 7 Update 6
"{283153BB-CEE6-EE9C-81E8-4350D73354BA}" = CCC Help Turkish
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = IB Updater 2.0.0.574
"{39445575-7D3A-52AA-152B-7F9423D1AE69}" = CCC Help German
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Cinfigurer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C9A3282-9DAE-F492-13F4-6D4D664AC15F}" = CCC Help Spanish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{4F198874-3C7D-5983-02EB-9E234C43F174}" = AMD Steady Video Plug-In 
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{5236FA8C-4B70-E30E-93EF-F7D3A5E468C7}" = CCC Help Greek
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{5731C0A8-B266-451A-8D3F-8066AA21836F}" = Tom Clancy's Rainbow Six Vegas
"{586F0E27-0BC5-34DE-AA0B-96D14397910E}" = CCC Help Russian
"{5AF7EA0B-F009-CC00-E446-C2286AF80471}" = CCC Help Czech
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{5FC116F2-4508-A6FC-15FB-C64F05AB0F26}" = CCC Help Chinese Traditional
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{685ACA56-004C-4F80-2BC0-951BF278C03F}" = CCC Help Chinese Standard
"{6D1AFFC2-AC60-BC3B-2DC9-0D80A1E9CB16}" = CCC Help Thai
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}" = ICQ7M
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79CFDE3C-4602-85B2-ACF6-83D897B8B33A}" = CCC Help Korean
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows Vista and Later
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.03
"{8972B1C8-B899-0AA0-8596-BFC9AE3311F1}" = CCC Help Finnish
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.2.0.9
"{8C0CAA7A-3272-4991-A808-2C7559DE3409}" = Win7codecs
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92BE4E1B-AEFD-DA72-B805-948290A4BB13}" = CCC Help Hungarian
"{943B2619-0E00-E9F1-73E3-03090965484E}" = AMD Media Foundation Decoders
"{9526B61A-1C35-96D1-531B-C8DB1D36C336}" = CCC Help Danish
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A295F81-04C8-FB18-2D1C-A33AA8A442CA}" = CCC Help French
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DB7A055-0C66-C319-9613-CACDC50DDB38}" = ccc-utility
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A48B9CD8-C2BA-4EC9-0081-7260D238C7CF}" = Need for Speed™ Most Wanted
"{A994E9F7-A748-FFB1-01C2-9D64ADE870B4}" = AMD Accelerated Video Transcoding
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{B3C8C8EF-77E0-1C0D-1CFA-A39E2E898311}" = CCC Help Italian
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070
"{B5AD9952-F716-9862-7ED7-734E0328CF7C}" = AMD VISION Engine Control Center
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood
"{C0E69600-E8D1-784D-829C-788D91D65051}" = CCC Help Polish
"{C37B1C57-DD9B-D1E0-B933-8EA8D56E2222}" = CCC Help Norwegian
"{C4100721-2D71-CC80-8877-0A7855B6EEFB}" = AMD Catalyst Install Manager
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CA3A3F20-566B-ABB1-A541-3D93C0D09EE5}" = CCC Help Japanese
"{CBAE26C1-B3B1-66FC-81A0-FA1774CF2B20}" = AMD Fuel
"{D1B01DC9-CBAF-45F9-A387-7D00C11B630E}" = Microsoft Games for Windows - LIVE Redistributable
"{D4C4485B-16EB-31A8-C2DE-D778E8E4628B}" = Catalyst Control Center Localization All
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{DAF650C8-AFE5-3460-E1C4-B9716D2DA5D2}" = Catalyst Control Center InstallProxy
"{E0C6F271-FE15-B2D5-FF42-BCA40700DC51}" = CCC Help English
"{E1D0A4DC-97BD-CE37-3E89-87D3337E55CA}" = CCC Help Dutch
"{E6FA341F-8840-6B18-5BCE-C7CCEBDFE516}" = Catalyst Control Center Graphics Previews Common
"{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}" = ANNO 1503
"{ED15763E-A6ED-56D2-B0B5-C7D22D4CE248}" = CCC Help Portuguese
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F46AB543-90D1-86D7-99EE-4F94C1D206C8}" = AMD Drag and Drop Transcoding
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FC478285-6996-44A3-AB77-ECB34942A5E3}" = BlueStacks
"1ClickDownload" = Movie2KDownloader
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced
"DAEMON Tools Lite" = DAEMON Tools Lite
"Deus Ex" = Deus Ex
"FileConverter_1.3 Toolbar" = FileConverter 1.3 Toolbar
"Guard.Mail.ru" = Guard.ICQ
"incredibar" = Incredibar Toolbar  on IE
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"Just Cause 2_is1" = Just Cause 2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"PunkBusterSvc" = PunkBuster Services
"SpeedFan" = SpeedFan (remove only)
"ST6UNST #1" = Hero Editor V1.04
"ST6UNST #2" = Hero Editor V1.04 (C:\Program Files\Hero Editor\)
"Tactical Ops" = Tactical Ops
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VLC media player" = VLC media player 2.0.0
"WNLT" = IB Updater Service
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 25.03.2013 10:13:18 | Computer Name = Robert-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Name des fehlerhaften Moduls: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000175b5  ID des fehlerhaften
 Prozesses: 0x950  Startzeit der fehlerhaften Anwendung: 0x01ce2957a30e8d23  Pfad der
 fehlerhaften Anwendung: C:\Program Files\BlueStacks\HD-Network.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\BlueStacks\HD-Network.exe  Berichtskennung: 23e76a84-9556-11e2-8f2f-bc05430293a4
 
Error - 25.03.2013 12:44:11 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 25.03.2013 16:27:11 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 25.03.2013 17:52:49 | Computer Name = Robert-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Name des fehlerhaften Moduls: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000175b5  ID des fehlerhaften
 Prozesses: 0x978  Startzeit der fehlerhaften Anwendung: 0x01ce2997214a1b6a  Pfad der
 fehlerhaften Anwendung: C:\Program Files\BlueStacks\HD-Network.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\BlueStacks\HD-Network.exe  Berichtskennung: 55579bbe-9596-11e2-8382-bc05430293a4
 
Error - 26.03.2013 09:20:03 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 26.03.2013 15:35:39 | Computer Name = Robert-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Name des fehlerhaften Moduls: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000175b5  ID des fehlerhaften
 Prozesses: 0x960  Startzeit der fehlerhaften Anwendung: 0x01ce2a249fc454fc  Pfad der
 fehlerhaften Anwendung: C:\Program Files\BlueStacks\HD-Network.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\BlueStacks\HD-Network.exe  Berichtskennung: 566229e7-964c-11e2-8f24-bc05430293a4
 
Error - 27.03.2013 08:58:35 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 27.03.2013 17:37:37 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 27.03.2013 18:08:13 | Computer Name = Robert-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Name des fehlerhaften Moduls: HD-Network.exe, Version: 0.7.4.792,
 Zeitstempel: 0x50530cc8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000175b5  ID des fehlerhaften
 Prozesses: 0x990  Startzeit der fehlerhaften Anwendung: 0x01ce2b334c80e23b  Pfad der
 fehlerhaften Anwendung: C:\Program Files\BlueStacks\HD-Network.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\BlueStacks\HD-Network.exe  Berichtskennung: d121194a-972a-11e2-991d-bc05430293a4
 
Error - 28.03.2013 12:23:41 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 28.03.2013 14:24:34 | Computer Name = Robert-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 30.03.2013 21:08:19 | Computer Name = Robert-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt

	Feature:
 %%886     Fehlercode: 0x8007042c     Fehlerbeschreibung: Der Abhängigkeitsdienst oder die
 Abhängigkeitsgruppe konnte nicht gestartet werden.      Grund: %%892
 
Error - 30.03.2013 21:08:18 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist 
von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
 
Error - 30.03.2013 21:08:18 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Microsoft Network Inspection System" ist von folgendem
 Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
 
Error - 30.03.2013 21:08:18 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig:
 BFE. Dieser Dienst ist eventuell nicht installiert.
 
Error - 30.03.2013 21:08:18 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Spybot-S&D 2 Security Center Service" ist von folgendem
 Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.
 
Error - 30.03.2013 21:08:19 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler
 beendet:   %%1064
 
Error - 30.03.2013 21:08:19 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Microsoft Network Inspection System" ist von folgendem
 Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
 
Error - 30.03.2013 21:08:19 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Microsoft-Netzwerkinspektion" ist vom Dienst "Microsoft
 Network Inspection System" abhängig, der aufgrund folgenden Fehlers nicht gestartet
 wurde:   %%1075
 
Error - 30.03.2013 21:09:57 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem
 Fehler beendet:   %%-2147024891
 
Error - 30.03.2013 21:09:57 | Computer Name = Robert-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%-2147024891
 
 
< End of report >

--- --- ---

die andere habe ich nicht gefunden wie sollte die den heißen oder abgespeichert werden?
mfg devil

DerJazzer · 31.03.2013, 00:22

Sie sollte OTL.txt heißen...

30.03.2013, 20:13	#4
DerJazzer /// Malwareteam	GVU Trojaner (abgesicherter modus nicht möglich) Du hast wieder das OTLPe-Log gepostet, ich würde aber gerne ein FRST-Log sehen __________________ Keep Jazzing! DerJazzer Imperare sibi maximum imperium est. ©Seneca Wenn du uns unterstützen möchtest \| http://www.anaesthesist-werden.de/

30.03.2013, 23:40	#9
DerJazzer /// Malwareteam	GVU Trojaner (abgesicherter modus nicht möglich) Du hast mir wieder die alte FRST.txt gepostet. Lösche die alte FRST.txt vom Stick und lasse bitte einen neuen Scan laufen. Poste mir danach die -neue- FRST.txt. __________________ Keep Jazzing! DerJazzer Imperare sibi maximum imperium est. ©Seneca Wenn du uns unterstützen möchtest \| http://www.anaesthesist-werden.de/

31.03.2013, 00:22	#15
DerJazzer /// Malwareteam	GVU Trojaner (abgesicherter modus nicht möglich) Sie sollte OTL.txt heißen... __________________ Keep Jazzing! DerJazzer Imperare sibi maximum imperium est. ©Seneca Wenn du uns unterstützen möchtest \| http://www.anaesthesist-werden.de/

GVU Trojaner (abgesicherter modus nicht möglich)

Log-Analyse und Auswertung: GVU Trojaner (abgesicherter modus nicht möglich)