BKA/GVU Trojaner Win7 32bit

cayinda2 · 16.06.2013, 10:46

Hallo, habe mir den BKA/GVU trojaner eingefangen. Habe Win7 32bit und der abgesicherte Modus klappt nicht. Malwarebytes findet nichts. Hier das FRST-Log:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-06-2013
Ran by SYSTEM on 16-06-2013 11:35:18
Running from C:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [CTHelper] CTHELPER.EXE [x]
HKLM\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml [10752 2012-01-31] ()
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SSDMonitor] C:\Program Files\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe [104480 2012-09-29] (Symantec)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [2238704 2013-02-21] (Logitech, Inc.)
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [262656 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKU\Administrator\...\Run: [fli4l] "C:\Program Files\Imonc3_0_4\Imonc.exe" /S:192.168.178.1 [ 2010-06-25] ()
HKU\Administrator\...\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [x]
HKU\Administrator\...\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 [x]
HKU\Administrator\...\RunOnce: [CTAutoUpdate] "C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe" /RunFromInstaller [ 2009-01-15] (Creative Technology Ltd)
HKU\Administrator\...\RunOnce: [InetReg] "C:\Program Files\Creative\Produktregistrierung\German\InetReg.exe" /PreProcess=RegFlash.exe /Delay=6 [x]
HKU\volker\...\Run: [iDevice Manager Launcher] "C:\Program Files\Software4u\iDevice Manager\Software4u.IDMLauncher.exe" /run [ 2013-04-28] (Marx Softwareentwicklung - www.software4u.de)
HKU\volker\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Temp\KNVH7Wf.exe [x]
HKU\volker\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\volker\...\Command Processor: "D:\Temp\KNVH7Wf.exe" <===== ATTENTION!
Startup: C:\Users\volker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files\FRITZ!DSL\FritzDsl.exe (AVM Berlin)

========================== Services (Whitelisted) =================

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-07-17] (Creative Labs)
S3 DiskDoctorService; C:\Program Files\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe [1147424 2012-09-29] (Symantec Corporation)
S3 GSService; C:\Windows\system32\GSService.exe [403832 2012-12-30] ()
S2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
S2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 NAV; C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
S2 NCO; C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
S2 NU16StartManagerSvc; C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe [792608 2012-09-29] (Symantec)
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2012-01-21] ()
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\RpcAgentSrv.exe [93848 2008-11-06] (SiSoftware)
S3 SpeedDiskService; C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe [1160224 2012-09-29] (Symantec Corporation)
S2 WMPNetworkSvc;

==================== Drivers (Whitelisted) ====================

S3 atidgllk; C:\Program Files\GPU-Z\atidgllk.sys [12048 2006-07-19] (ATI Technologies Inc.)
S1 atitray; C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [20384 2011-03-27] ()
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
S1 ccSet_NAV; C:\Windows\system32\drivers\NAV\1403010.016\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S1 ccSet_NST; C:\Windows\system32\drivers\NST\7DD03030.013\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S3 COMMONFX; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 COMMONFX.SYS; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [164608 2007-04-12] (Creative Technology Ltd.)
S3 CTAUDFX; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 CTAUDFX.SYS; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 ctdvda2k; C:\Windows\System32\drivers\ctdvda2k.sys [347144 2010-03-18] (Creative Technology Ltd)
S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [168192 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [280320 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [128768 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [323328 2007-04-12] (Creative Technology Ltd)
S3 CTERFXFX; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTERFXFX.SYS; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1317632 2007-04-12] (Creative Technology Ltd.)
S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [66816 2007-04-12] (Creative Technology Ltd.)
S3 CTSBLFX; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 CTSBLFX.SYS; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 drhard; C:\Windows\system32\DRIVERS\DRHARD.SYS [23600 2005-12-01] (Licensed for Gebhard Software)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-12-15] (Symantec Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
S0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
S3 ha10kx2k; C:\Windows\System32\drivers\ha10kx2k.sys [798808 2010-03-18] (Creative Technology Ltd)
S3 hap16v2k; C:\Windows\System32\drivers\hap16v2k.sys [162904 2010-03-18] (Creative Technology Ltd)
S3 hap17v2k; C:\Windows\System32\drivers\hap17v2k.sys [189528 2010-03-18] (Creative Technology Ltd)
S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1255168 2010-07-30] (Creative Technology Ltd.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [28160 2009-07-08] (hxxp://libusb-win32.sourceforge.net)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [40200 2013-01-03] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30984 2013-01-03] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S3 MP4ConverterAudio; C:\Windows\System32\drivers\MP4ConverterAudio.sys [23608 2012-12-30] (Windows (R) Win 7 DDK provider)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [6504 2009-05-13] ()
S0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2013-06-16] (secr9tos)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2010-07-28] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61312 2011-10-14] (Silicon Laboratories)
S0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
S3 SRTSP; C:\Windows\System32\Drivers\NAV\1403010.016\SRTSP.SYS [602712 2013-01-29] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NAV\1403010.016\SRTSPX.SYS [32344 2013-01-29] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NAV\1403010.016\SYMDS.SYS [367704 2013-01-22] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NAV\1403010.016\SYMEFA.SYS [934488 2013-01-31] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2012-12-16] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NAV\1403010.016\Ironx86.SYS [175264 2012-11-16] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NAV\1403010.016\SYMNETS.SYS [338592 2013-01-31] (Symantec Corporation)
S1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [24680 2011-01-26] (CaptainFlint Software)
S3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [117760 2011-02-25] (VIA Technologies, Inc.)
S3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [164864 2011-02-25] (VIA Technologies, Inc.)
S1 BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\BASHDefs\20130515.001\BHDrvx86.sys [x]
S3 COMMONFX.DLL; system32\COMMONFX.DLL [x]
S3 CTAUDFX.DLL; system32\CTAUDFX.DLL [x]
S3 CTERFXFX.DLL; system32\CTERFXFX.DLL [x]
S3 CTSBLFX.DLL; system32\CTSBLFX.DLL [x]
S1 EIO; system32\DRIVERS\EIO.sys [x]
S3 EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S1 IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\IPSDefs\20130531.001\IDSvix86.sys [x]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130603.003\NAVENG.SYS [x]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130603.003\NAVEX15.SYS [x]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-14 23:27 - 2013-06-14 23:27 - 00000000 ____D C:\FRST
2013-06-14 22:20 - 2013-06-14 20:46 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 22:18 - 2013-06-14 22:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 22:18 - 2013-06-14 22:18 - 00000000 __SHD C:\found.000
2013-06-14 20:16 - 2013-06-14 18:05 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 20:16 - 2013-06-03 10:32 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-14 13:38 - 2013-06-14 13:38 - 00163058 ____A C:\ProgramData\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163038 ____A C:\Users\volker\AppData\Roaming\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163008 ____A C:\Users\volker\AppData\Local\2433f433
2013-06-12 21:40 - 2013-05-16 23:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 21:40 - 2013-05-16 23:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 21:40 - 2013-05-16 23:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 21:40 - 2013-05-16 23:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-12 21:40 - 2013-05-16 23:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 21:40 - 2013-05-16 23:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 21:40 - 2013-05-16 23:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-12 21:40 - 2013-05-16 23:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-12 21:40 - 2013-05-16 23:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 21:40 - 2013-05-16 23:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 21:40 - 2013-05-16 23:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-12 21:40 - 2013-05-16 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 21:40 - 2013-05-16 23:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 21:39 - 2013-05-17 00:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 21:39 - 2013-05-16 23:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 21:39 - 2013-05-16 23:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-12 18:38 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 18:38 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 18:38 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 18:38 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 18:38 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 18:38 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 18:38 - 2013-05-08 06:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 18:38 - 2013-05-06 06:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 18:38 - 2013-05-06 06:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 18:38 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 18:38 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 18:38 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-09 16:18 - 2013-06-09 16:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iPod
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 13:10 - 2013-06-01 13:13 - 00000032 ____A C:\Windows\CD_Start.INI
2013-05-30 13:17 - 2013-04-10 06:18 - 00728424 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-30 13:17 - 2013-04-10 06:18 - 00218984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-30 13:17 - 2013-04-10 04:14 - 02347520 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-30 13:17 - 2013-03-19 05:53 - 00186368 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-30 13:17 - 2013-03-19 04:33 - 00040960 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-30 13:17 - 2013-02-27 06:05 - 00101720 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-30 13:17 - 2013-02-27 05:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-30 13:17 - 2013-02-27 05:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-30 13:17 - 2013-02-27 05:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-30 13:17 - 2013-02-27 05:49 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll

==================== One Month Modified Files and Folders ========

2013-06-16 10:32 - 2012-12-16 20:22 - 00000278 ____A C:\Windows\Tasks\NUAutoUpdate.job
2013-06-16 10:32 - 2011-11-27 16:42 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-16 10:32 - 2011-05-12 12:53 - 00178240 ____A C:\Windows\setupact.log
2013-06-16 10:32 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-16 10:31 - 2011-07-15 18:58 - 00028160 ____A (secr9tos) C:\Windows\System32\Drivers\oem-drv86.sys
2013-06-14 23:29 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-06-14 23:27 - 2013-06-14 23:27 - 00000000 ____D C:\FRST
2013-06-14 22:18 - 2013-06-14 22:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 22:18 - 2013-06-14 22:18 - 00000000 __SHD C:\found.000
2013-06-14 22:11 - 2011-07-17 20:35 - 00000000 ____D C:\ProgramData\Norton
2013-06-14 22:11 - 2011-07-17 14:26 - 00000000 ____D C:\Users\volker\AppData\Roaming\SlimBrowser
2013-06-14 22:11 - 2011-07-15 20:41 - 00000000 ____D C:\Users\volker\AppData\Roaming\GHISLER
2013-06-14 22:11 - 2011-07-15 19:00 - 00000000 ____D C:\users\volker
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-14 20:46 - 2013-06-14 22:20 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 18:05 - 2013-06-14 20:16 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 13:38 - 2013-06-14 13:38 - 00163058 ____A C:\ProgramData\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163038 ____A C:\Users\volker\AppData\Roaming\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163008 ____A C:\Users\volker\AppData\Local\2433f433
2013-06-14 13:37 - 2012-10-30 16:20 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.BAK
2013-06-14 13:37 - 2012-10-30 16:17 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.CDF
2013-06-14 13:37 - 2011-07-15 18:58 - 02006644 ____A C:\Windows\WindowsUpdate.log
2013-06-14 13:35 - 2011-07-21 20:39 - 00000000 ____D C:\Program Files\Zoom Player
2013-06-14 13:21 - 2011-11-27 16:42 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-14 13:20 - 2012-03-30 15:24 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-14 13:20 - 2010-11-20 22:01 - 00006630 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-13 18:06 - 2012-12-17 19:00 - 00000396 ____A C:\Windows\System32\AppLog.log
2013-06-13 18:06 - 2012-12-16 20:22 - 00000270 ____A C:\Windows\Tasks\NUSchedule.job
2013-06-13 14:46 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-13 14:46 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-13 14:39 - 2013-03-23 13:08 - 00032019 ____A C:\Users\volker\DesktopStCenter.txt
2013-06-12 21:42 - 2011-07-17 14:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 21:40 - 2011-05-12 12:26 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 19:23 - 2012-03-30 15:24 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 19:23 - 2011-07-17 14:27 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-12 18:55 - 2012-12-16 19:57 - 00000000 ____D C:\Windows\System32\Drivers\NAV
2013-06-09 16:18 - 2013-06-09 16:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iPod
2013-06-09 16:18 - 2011-07-24 19:50 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-03 10:32 - 2013-06-14 20:16 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 13:13 - 2013-06-01 13:10 - 00000032 ____A C:\Windows\CD_Start.INI
2013-06-01 13:07 - 2012-07-03 21:43 - 00000000 ____D C:\Program Files\WATT32
2013-05-31 08:10 - 2010-11-20 22:48 - 00463602 ____A C:\Windows\PFRO.log
2013-05-30 21:37 - 2011-07-17 15:58 - 00000000 ____D C:\Program Files\JDownloader
2013-05-30 20:50 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-05-30 15:22 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-30 13:23 - 2009-07-14 05:33 - 00420072 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-17 00:08 - 2013-06-12 21:39 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

==================== Known DLLs (Whitelisted) ============

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-06-07 18:00:31
Restore point made on: 2013-06-09 18:00:35
Restore point made on: 2013-06-10 18:00:35
Restore point made on: 2013-06-11 18:00:33
Restore point made on: 2013-06-12 21:39:56
Restore point made on: 2013-06-13 18:00:46

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 3262.08 MB
Available physical RAM: 2741.15 MB
Total Pagefile: 3258.31 MB
Available Pagefile: 2749.02 MB
Total Virtual: 2047.88 MB
Available Virtual: 1922.29 MB

==================== Drives ================================

Drive c: (C) (Fixed) (Total:111.79 GB) (Free:36.22 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:146.48 GB) (Free:78.49 GB) NTFS
Drive e: (G

(Fixed) (Total:931.51 GB) (Free:736.87 GB) NTFS
Drive f: (D) (Fixed) (Total:155.19 GB) (Free:81.17 GB) NTFS
Drive g: (E) (Fixed) (Total:629.84 GB) (Free:264.43 GB) NTFS
Drive h: (madmax786511) (CDROM) (Total:2.53 GB) (Free:0 GB) UDF
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 750A4590)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 525FE842)
Partition 1: (Not Active) - (Size=932 GB) - (Type=OF Extended)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E9D1147C)
Partition 1: (Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=785 GB) - (Type=OF Extended)

LastRegBack: 2013-06-14 15:37

==================== End Of Log ============================

schrauber · 16.06.2013, 10:54

Hi,

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\volker\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Temp\KNVH7Wf.exe [x]
HKU\volker\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\volker\...\Command Processor: "D:\Temp\KNVH7Wf.exe" <===== ATTENTION!
2013-06-14 13:38 - 2013-06-14 13:38 - 00163058 ____A C:\ProgramData\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163038 ____A C:\Users\volker\AppData\Roaming\2433f433
2013-06-14 13:38 - 2013-06-14 13:38 - 00163008 ____A C:\Users\volker\AppData\Local\2433f433
testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!
D:\Temp

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

cayinda2 · 16.06.2013, 11:14

Hallo Schrauber, habe es gemacht. Klappte aber nicht. komme noch nicht auf den Rechner.
Hier das Log:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 13-06-2013
Ran by SYSTEM at 2013-06-16 12:06:30 Run:1
Running from C:\
Boot Mode: Recovery

==============================================

HKU\volker\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.
HKU\volker\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\volker\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\ProgramData\2433f433 => Moved successfully.
C:\Users\volker\AppData\Roaming\2433f433 => Moved successfully.
C:\Users\volker\AppData\Local\2433f433 => Moved successfully.

Fehler beim L”schen des angegebenen Datenelements.
Element nicht gefunden.
D:\Temp => File/Directory not found.

==== End of Fixlog ====

schrauber · 16.06.2013, 11:16

Was? Ich faile nie

Neues Scanlog FRST aus der Recovery bitte.

cayinda2 · 16.06.2013, 11:27

Hallo schrauber, die gewünschtr Logdatei:
FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-06-2013
Ran by SYSTEM on 16-06-2013 12:22:48
Running from C:\
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [CTHelper] CTHELPER.EXE [x]
HKLM\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml [10752 2012-01-31] ()
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SSDMonitor] C:\Program Files\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe [104480 2012-09-29] (Symantec)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [2238704 2013-02-21] (Logitech, Inc.)
HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [262656 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKU\Administrator\...\Run: [fli4l] "C:\Program Files\Imonc3_0_4\Imonc.exe" /S:192.168.178.1 [ 2010-06-25] ()
HKU\Administrator\...\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [x]
HKU\Administrator\...\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 [x]
HKU\Administrator\...\RunOnce: [CTAutoUpdate] "C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe" /RunFromInstaller [ 2009-01-15] (Creative Technology Ltd)
HKU\Administrator\...\RunOnce: [InetReg] "C:\Program Files\Creative\Produktregistrierung\German\InetReg.exe" /PreProcess=RegFlash.exe /Delay=6 [x]
HKU\volker\...\Run: [iDevice Manager Launcher] "C:\Program Files\Software4u\iDevice Manager\Software4u.IDMLauncher.exe" /run [ 2013-04-28] (Marx Softwareentwicklung - www.software4u.de)
Startup: C:\Users\volker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files\FRITZ!DSL\FritzDsl.exe (AVM Berlin)

========================== Services (Whitelisted) =================

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-07-17] (Creative Labs)
S3 DiskDoctorService; C:\Program Files\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe [1147424 2012-09-29] (Symantec Corporation)
S3 GSService; C:\Windows\system32\GSService.exe [403832 2012-12-30] ()
S2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] ()
S2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 NAV; C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
S2 NCO; C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
S2 NU16StartManagerSvc; C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe [792608 2012-09-29] (Symantec)
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2012-01-21] ()
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\RpcAgentSrv.exe [93848 2008-11-06] (SiSoftware)
S3 SpeedDiskService; C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe [1160224 2012-09-29] (Symantec Corporation)
S2 WMPNetworkSvc; 

==================== Drivers (Whitelisted) ====================

S3 atidgllk; C:\Program Files\GPU-Z\atidgllk.sys [12048 2006-07-19] (ATI Technologies Inc.)
S1 atitray; C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [20384 2011-03-27] ()
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
S1 ccSet_NAV; C:\Windows\system32\drivers\NAV\1403010.016\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S1 ccSet_NST; C:\Windows\system32\drivers\NST\7DD03030.013\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S3 COMMONFX; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 COMMONFX.SYS; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [164608 2007-04-12] (Creative Technology Ltd.)
S3 CTAUDFX; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 CTAUDFX.SYS; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 ctdvda2k; C:\Windows\System32\drivers\ctdvda2k.sys [347144 2010-03-18] (Creative Technology Ltd)
S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [168192 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [280320 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [128768 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [323328 2007-04-12] (Creative Technology Ltd)
S3 CTERFXFX; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTERFXFX.SYS; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1317632 2007-04-12] (Creative Technology Ltd.)
S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [66816 2007-04-12] (Creative Technology Ltd.)
S3 CTSBLFX; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 CTSBLFX.SYS; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 drhard; C:\Windows\system32\DRIVERS\DRHARD.SYS [23600 2005-12-01] (Licensed for Gebhard Software)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-12-15] (Symantec Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
S0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
S3 ha10kx2k; C:\Windows\System32\drivers\ha10kx2k.sys [798808 2010-03-18] (Creative Technology Ltd)
S3 hap16v2k; C:\Windows\System32\drivers\hap16v2k.sys [162904 2010-03-18] (Creative Technology Ltd)
S3 hap17v2k; C:\Windows\System32\drivers\hap17v2k.sys [189528 2010-03-18] (Creative Technology Ltd)
S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1255168 2010-07-30] (Creative Technology Ltd.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [28160 2009-07-08] (hxxp://libusb-win32.sourceforge.net)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [40200 2013-01-03] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30984 2013-01-03] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S3 MP4ConverterAudio; C:\Windows\System32\drivers\MP4ConverterAudio.sys [23608 2012-12-30] (Windows (R) Win 7 DDK provider)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [6504 2009-05-13] ()
S0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2013-06-16] (secr9tos)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2010-07-28] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61312 2011-10-14] (Silicon Laboratories)
S0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
S3 SRTSP; C:\Windows\System32\Drivers\NAV\1403010.016\SRTSP.SYS [602712 2013-01-29] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NAV\1403010.016\SRTSPX.SYS [32344 2013-01-29] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NAV\1403010.016\SYMDS.SYS [367704 2013-01-22] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NAV\1403010.016\SYMEFA.SYS [934488 2013-01-31] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2012-12-16] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NAV\1403010.016\Ironx86.SYS [175264 2012-11-16] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NAV\1403010.016\SYMNETS.SYS [338592 2013-01-31] (Symantec Corporation)
S1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [24680 2011-01-26] (CaptainFlint Software)
S3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [117760 2011-02-25] (VIA Technologies, Inc.)
S3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [164864 2011-02-25] (VIA Technologies, Inc.)
S1 BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\BASHDefs\20130515.001\BHDrvx86.sys [x]
S3 COMMONFX.DLL; system32\COMMONFX.DLL [x]
S3 CTAUDFX.DLL; system32\CTAUDFX.DLL [x]
S3 CTERFXFX.DLL; system32\CTERFXFX.DLL [x]
S3 CTSBLFX.DLL; system32\CTSBLFX.DLL [x]
S1 EIO; system32\DRIVERS\EIO.sys [x]
S3 EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S1 IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\IPSDefs\20130531.001\IDSvix86.sys [x]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130603.003\NAVENG.SYS [x]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130603.003\NAVEX15.SYS [x]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-14 23:27 - 2013-06-14 23:27 - 00000000 ____D C:\FRST
2013-06-14 22:20 - 2013-06-14 20:46 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 22:18 - 2013-06-14 22:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 22:18 - 2013-06-14 22:18 - 00000000 __SHD C:\found.000
2013-06-14 20:16 - 2013-06-14 18:05 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 20:16 - 2013-06-03 10:32 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-12 21:40 - 2013-05-16 23:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 21:40 - 2013-05-16 23:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 21:40 - 2013-05-16 23:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 21:40 - 2013-05-16 23:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-12 21:40 - 2013-05-16 23:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 21:40 - 2013-05-16 23:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 21:40 - 2013-05-16 23:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-12 21:40 - 2013-05-16 23:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-12 21:40 - 2013-05-16 23:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 21:40 - 2013-05-16 23:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 21:40 - 2013-05-16 23:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-12 21:40 - 2013-05-16 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 21:40 - 2013-05-16 23:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 21:39 - 2013-05-17 00:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 21:39 - 2013-05-16 23:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 21:39 - 2013-05-16 23:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-12 18:38 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 18:38 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 18:38 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 18:38 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 18:38 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 18:38 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 18:38 - 2013-05-08 06:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 18:38 - 2013-05-06 06:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 18:38 - 2013-05-06 06:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 18:38 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 18:38 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 18:38 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-09 16:18 - 2013-06-09 16:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iPod
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 13:10 - 2013-06-01 13:13 - 00000032 ____A C:\Windows\CD_Start.INI
2013-05-30 13:17 - 2013-04-10 06:18 - 00728424 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-30 13:17 - 2013-04-10 06:18 - 00218984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-30 13:17 - 2013-04-10 04:14 - 02347520 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-30 13:17 - 2013-03-19 05:53 - 00186368 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-30 13:17 - 2013-03-19 04:33 - 00040960 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-30 13:17 - 2013-02-27 06:05 - 00101720 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-30 13:17 - 2013-02-27 05:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-30 13:17 - 2013-02-27 05:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-30 13:17 - 2013-02-27 05:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-30 13:17 - 2013-02-27 05:49 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll

==================== One Month Modified Files and Folders ========

2013-06-16 11:08 - 2012-12-16 20:22 - 00000278 ____A C:\Windows\Tasks\NUAutoUpdate.job
2013-06-16 11:08 - 2011-11-27 16:42 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-16 11:08 - 2011-07-15 18:58 - 00028160 ____A (secr9tos) C:\Windows\System32\Drivers\oem-drv86.sys
2013-06-16 11:08 - 2011-05-12 12:53 - 00178296 ____A C:\Windows\setupact.log
2013-06-16 11:08 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-14 23:29 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-06-14 23:27 - 2013-06-14 23:27 - 00000000 ____D C:\FRST
2013-06-14 22:18 - 2013-06-14 22:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 22:18 - 2013-06-14 22:18 - 00000000 __SHD C:\found.000
2013-06-14 22:11 - 2011-07-17 20:35 - 00000000 ____D C:\ProgramData\Norton
2013-06-14 22:11 - 2011-07-17 14:26 - 00000000 ____D C:\Users\volker\AppData\Roaming\SlimBrowser
2013-06-14 22:11 - 2011-07-15 20:41 - 00000000 ____D C:\Users\volker\AppData\Roaming\GHISLER
2013-06-14 22:11 - 2011-07-15 19:00 - 00000000 ____D C:\users\volker
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 22:11 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-14 20:46 - 2013-06-14 22:20 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 18:05 - 2013-06-14 20:16 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 13:37 - 2012-10-30 16:20 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.BAK
2013-06-14 13:37 - 2012-10-30 16:17 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.CDF
2013-06-14 13:37 - 2011-07-15 18:58 - 02006644 ____A C:\Windows\WindowsUpdate.log
2013-06-14 13:35 - 2011-07-21 20:39 - 00000000 ____D C:\Program Files\Zoom Player
2013-06-14 13:21 - 2011-11-27 16:42 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-14 13:20 - 2012-03-30 15:24 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-14 13:20 - 2010-11-20 22:01 - 00006630 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-13 18:06 - 2012-12-17 19:00 - 00000396 ____A C:\Windows\System32\AppLog.log
2013-06-13 18:06 - 2012-12-16 20:22 - 00000270 ____A C:\Windows\Tasks\NUSchedule.job
2013-06-13 14:46 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-13 14:46 - 2009-07-14 05:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-13 14:39 - 2013-03-23 13:08 - 00032019 ____A C:\Users\volker\DesktopStCenter.txt
2013-06-12 21:42 - 2011-07-17 14:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 21:40 - 2011-05-12 12:26 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 19:23 - 2012-03-30 15:24 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 19:23 - 2011-07-17 14:27 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-12 18:55 - 2012-12-16 19:57 - 00000000 ____D C:\Windows\System32\Drivers\NAV
2013-06-09 16:18 - 2013-06-09 16:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 16:18 - 2013-06-09 16:18 - 00000000 ____D C:\Program Files\iPod
2013-06-09 16:18 - 2011-07-24 19:50 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-03 10:32 - 2013-06-14 20:16 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 13:14 - 2013-06-01 13:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 13:13 - 2013-06-01 13:10 - 00000032 ____A C:\Windows\CD_Start.INI
2013-06-01 13:07 - 2012-07-03 21:43 - 00000000 ____D C:\Program Files\WATT32
2013-05-31 08:10 - 2010-11-20 22:48 - 00463602 ____A C:\Windows\PFRO.log
2013-05-30 21:37 - 2011-07-17 15:58 - 00000000 ____D C:\Program Files\JDownloader
2013-05-30 20:50 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-05-30 15:22 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-30 13:23 - 2009-07-14 05:33 - 00420072 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-17 00:08 - 2013-06-12 21:39 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-07 18:00:31
Restore point made on: 2013-06-09 18:00:35
Restore point made on: 2013-06-10 18:00:35
Restore point made on: 2013-06-11 18:00:33
Restore point made on: 2013-06-12 21:39:56
Restore point made on: 2013-06-13 18:00:46

==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 3262.08 MB
Available physical RAM: 2745 MB
Total Pagefile: 3258.31 MB
Available Pagefile: 2749.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1922.29 MB

==================== Drives ================================

Drive c: (C) (Fixed) (Total:111.79 GB) (Free:36.21 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:146.48 GB) (Free:78.28 GB) NTFS
Drive e: (G:) (Fixed) (Total:931.51 GB) (Free:736.87 GB) NTFS
Drive f: (D) (Fixed) (Total:155.19 GB) (Free:81.17 GB) NTFS
Drive g: (E) (Fixed) (Total:629.84 GB) (Free:264.43 GB) NTFS
Drive h: (madmax786511) (CDROM) (Total:2.53 GB) (Free:0 GB) UDF
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 750A4590)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 525FE842)
Partition 1: (Not Active) - (Size=932 GB) - (Type=OF Extended)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E9D1147C)
Partition 1: (Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=785 GB) - (Type=OF Extended)


LastRegBack: 2013-06-14 15:37

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 16.06.2013, 11:48

Zitat:

Running from C:\

wie genau lässt Du FRST laufen?

cayinda2 · 16.06.2013, 11:51

Hallo schrauber, ich bin wieder in Win7 drin. War mein Fehler. Da ich auf dem Rechner noch
Win7 64 laufen habe, waren die platten etwas anders. Die D-Platte war dann die F-Platte. Habe das Temp-verzeichniss per Hand gelöscht und es klappt. Danke für die schnelle Hilfe.
Wir können weitermachen.

Gruß
Volker

schrauber · 16.06.2013, 11:53

Lol, ich dacht schon ich wär blöd

Dann ab jetzt alles im normalen Modus:

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

cayinda2 · 16.06.2013, 12:14

Hallo schrauber, hier alle Logs.

AdwCleanerAdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.303 - Datei am 16/06/2013 um 12:58:05 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : volker - WIN7
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\volker\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : IB Updater

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\user.js
Datei Gelöscht : C:\Users\volker\AppData\Roaming\Mozilla\Firefox\Profiles\pf34vh1r.default\searchplugins\MyStart Search.xml
Datei Gelöscht : C:\Windows\system32\ImhxxpComm.dll
Ordner Gelöscht : C:\Program Files\BabylonToolbar
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\IB Updater
Ordner Gelöscht : C:\Program Files\incredibar.com
Ordner Gelöscht : C:\Program Files\software4u
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\volker\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\volker\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\volker\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\volker\AppData\LocalLow\facemoods.com
Ordner Gelöscht : C:\Users\volker\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\volker\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\volker\AppData\Roaming\Mozilla\Firefox\Profiles\pf34vh1r.default\extensions\ffxtlbr@babylon.com
Ordner Gelöscht : C:\Users\volker\AppData\Roaming\Mozilla\Firefox\Profiles\pf34vh1r.default\extensions\ffxtlbr@incredibar.com
Ordner Gelöscht : C:\Users\volker\AppData\Roaming\software4u
Ordner Gelöscht : C:\Windows\system32\WNLT

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gelöscht : HKCU\Software\WNLT
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\b
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C01315C7-B4E2-4864-B43D-5FAFC414D179}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DDE2C74F-58CC-4D71-8CE1-09DEBB8CFB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EF7FEC6D-451B-4452-9D26-7E10C6B5DB6E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.IncredibarESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\I
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Incredibar.IncredibarHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IncredibarApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{48C9C8B0-A546-46C1-A81F-47A31E623E9D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CFE8AAFD-A0F3-4329-84E9-6B679EC93EC2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai
Schlüssel Gelöscht : HKLM\Software\IB Updater
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\incredibar.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{74C36554-31F0-49DD-8857-ED6A64DF45BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\incredibar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Schlüssel Gelöscht : HKLM\Software\WNLT
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F9639E4A-801B-4843-AEE3-03D9DA199E77}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16490

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://mystart.incredibar.com/mb201?a=6Oz08REzE9&i=26 --> hxxp://www.google.com

-\\ Mozilla Firefox v11.0 (de)

Datei : C:\Users\volker\AppData\Roaming\Mozilla\Firefox\Profiles\pf34vh1r.default\prefs.js

C:\Users\volker\AppData\Roaming\Mozilla\Firefox\Profiles\pf34vh1r.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Gelöscht : user_pref("browser.search.defaultenginename", "MyStart Search");
Gelöscht : user_pref("browser.search.order.1", "Search the web (Babylon)");
Gelöscht : user_pref("browser.search.selectedEngine", "MyStart Search");
Gelöscht : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=111015");
Gelöscht : user_pref("extensions.BabylonToolbar_i.hardId", "68e75392000000000000002522cb76a1");
Gelöscht : user_pref("extensions.BabylonToolbar_i.id", "68e75392000000000000002522cb76a1");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlDay", "15420");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", false);
Gelöscht : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1720:22:34");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Gelöscht : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb201/?loc=IB_DS&a=6Oz08REzE9&&i=26&search="[...]
Gelöscht : user_pref("browser.startup.homepage", "hxxp://mystart.incredibar.com/mb201?a=6Oz08REzE9&i=26");
Gelöscht : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb201?a=6Oz08REzE9&i=26");

*************************

AdwCleaner[S1].txt - [21992 octets] - [16/06/2013 12:58:05]

########## EOF - C:\AdwCleaner[S1].txt - [22053 octets] ##########

--- --- ---

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Ultimate x86
Ran by volker on 16.06.2013 at 13:06:32,47
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

Successfully deleted: [File] "C:\chromehplog.txt"

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 16.06.2013 at 13:07:56,07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-06-2013
Ran by volker (administrator) on 16-06-2013 13:10:07
Running from C:\Users\volker\Desktop
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe
(Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Symantec) C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe
(Symantec Corporation) C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe
(Software 2000 Limited) C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
() C:\Windows\system32\PnkBstrA.exe
(Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe
(Creative Technology Ltd) C:\Windows\System32\CtHelper.exe
(Symantec) C:\Program Files\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(AVM Berlin) C:\Program Files\FRITZ!DSL\StCenter.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [CTHelper] CTHELPER.EXE [x]
HKLM\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml [10752 2012-01-31] ()
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SSDMonitor] C:\Program Files\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe [104480 2012-09-29] (Symantec)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [2238704 2013-02-21] (Logitech, Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKCU\...\Run: [iDevice Manager Launcher] "C:\Program Files\Software4u\iDevice Manager\Software4u.IDMLauncher.exe" /run [x]
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKCU\...\Policies\system: [DisableRegistryTools] 0
MountPoints2: {898ca9d7-bd61-11e1-a893-806e6f6e6963} - H:\sources\sperr32.exe x64
HKU\Administrator\...\Run: [fli4l] "C:\Program Files\Imonc3_0_4\Imonc.exe" /S:192.168.178.1 [ 2010-06-25] ()
HKU\Administrator\...\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [x]
HKU\Administrator\...\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 [x]
HKU\Administrator\...\RunOnce: [CTAutoUpdate] "C:\Program Files\Creative\Shared Files\Software Update\AutoUpdate.exe" /RunFromInstaller [ 2009-01-15] (Creative Technology Ltd)
HKU\Administrator\...\RunOnce: [InetReg] "C:\Program Files\Creative\Produktregistrierung\German\InetReg.exe" /PreProcess=RegFlash.exe /Delay=6 [x]
Startup: C:\Users\volker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files\FRITZ!DSL\FritzDsl.exe (AVM Berlin)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: (No Name) - {ebd898f8-fcf6-4694-bc3b-eabc7271eeb1} -  No File
SearchScopes: HKCU - {A0699754-D9A8-416C-8E9D-3CD75F5E087E} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
SearchScopes: HKCU - {EEF82575-0BE9-4BFF-BDA4-35FD40173704} URL = hxxp://suche.t-online.de/cgi-bin/swl?br=ie7&q={searchTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Norton Identity Protection - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\coIEPlg.dll (Symantec Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: FRITZ!Box Addon BHO - {C0C86BBE-9509-4296-8459-FDBFDAF4B673} - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU -No Name - {EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab
DPF: {FC7DCECC-8042-42D0-B080-B68A2C18B095} file:///E:/CTROM08DVD/asearch/asearch.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\..\Interfaces\{89376290-EB85-413E-A0BF-63C5FE694A20}: [NameServer]192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\volker\AppData\Roaming\Mozilla\Firefox\Profiles\pf34vh1r.default
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=1.104.0 - C:\Program Files\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========================== Services (Whitelisted) =================

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-07-17] (Creative Labs)
S3 DiskDoctorService; C:\Program Files\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe [1147424 2012-09-29] (Symantec Corporation)
S3 GSService; C:\Windows\system32\GSService.exe [403832 2012-12-30] ()
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
R2 NAV; C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
R2 NCO; C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
R2 NU16StartManagerSvc; C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe [792608 2012-09-29] (Symantec)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2012-01-21] ()
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\RpcAgentSrv.exe [93848 2008-11-06] (SiSoftware)
S3 SpeedDiskService; C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe [1160224 2012-09-29] (Symantec Corporation)
S2 WMPNetworkSvc; 

==================== Drivers (Whitelisted) ====================

S3 atidgllk; C:\Program Files\GPU-Z\atidgllk.sys [12048 2006-07-19] (ATI Technologies Inc.)
R1 atitray; C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [20384 2011-03-27] ()
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_NAV; C:\Windows\system32\drivers\NAV\1403010.016\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
R1 ccSet_NST; C:\Windows\system32\drivers\NST\7DD03030.013\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S3 COMMONFX; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
R3 COMMONFX.SYS; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [164608 2007-04-12] (Creative Technology Ltd.)
S3 CTAUDFX; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
R3 CTAUDFX.SYS; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 ctdvda2k; C:\Windows\System32\drivers\ctdvda2k.sys [347144 2010-03-18] (Creative Technology Ltd)
S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [168192 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [280320 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [128768 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [323328 2007-04-12] (Creative Technology Ltd)
S3 CTERFXFX; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTERFXFX.SYS; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1317632 2007-04-12] (Creative Technology Ltd.)
S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [66816 2007-04-12] (Creative Technology Ltd.)
S3 CTSBLFX; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
R3 CTSBLFX.SYS; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 drhard; C:\Windows\system32\DRIVERS\DRHARD.SYS [23600 2005-12-01] (Licensed for Gebhard Software)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-12-15] (Symantec Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
R3 ha10kx2k; C:\Windows\System32\drivers\ha10kx2k.sys [798808 2010-03-18] (Creative Technology Ltd)
R3 hap16v2k; C:\Windows\System32\drivers\hap16v2k.sys [162904 2010-03-18] (Creative Technology Ltd)
S3 hap17v2k; C:\Windows\System32\drivers\hap17v2k.sys [189528 2010-03-18] (Creative Technology Ltd)
S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1255168 2010-07-30] (Creative Technology Ltd.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [28160 2009-07-08] (hxxp://libusb-win32.sourceforge.net)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [40200 2013-01-03] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30984 2013-01-03] (Logitech, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S3 MP4ConverterAudio; C:\Windows\System32\drivers\MP4ConverterAudio.sys [23608 2012-12-30] (Windows (R) Win 7 DDK provider)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [6504 2009-05-13] ()
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130613.032\NAVENG.SYS [93272 2013-05-30] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130613.032\NAVEX15.SYS [1611992 2013-05-30] (Symantec Corporation)
R0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2013-06-16] (secr9tos)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2010-07-28] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61312 2011-10-14] (Silicon Laboratories)
R0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
S3 SRTSP; C:\Windows\System32\Drivers\NAV\1403010.016\SRTSP.SYS [602712 2013-01-29] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NAV\1403010.016\SRTSPX.SYS [32344 2013-01-29] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NAV\1403010.016\SYMDS.SYS [367704 2013-01-22] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NAV\1403010.016\SYMEFA.SYS [934488 2013-01-31] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2012-12-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NAV\1403010.016\Ironx86.SYS [175264 2012-11-16] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NAV\1403010.016\SYMNETS.SYS [338592 2013-01-31] (Symantec Corporation)
R1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [24680 2011-01-26] (CaptainFlint Software)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [117760 2011-02-25] (VIA Technologies, Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [164864 2011-02-25] (VIA Technologies, Inc.)
S3 COMMONFX.DLL; system32\COMMONFX.DLL [x]
S3 CTAUDFX.DLL; system32\CTAUDFX.DLL [x]
S3 CTERFXFX.DLL; system32\CTERFXFX.DLL [x]
S3 CTSBLFX.DLL; system32\CTSBLFX.DLL [x]
S1 EIO; system32\DRIVERS\EIO.sys [x]
S3 EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S1 IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\IPSDefs\20130531.001\IDSvix86.sys [x]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-16 13:09 - 2013-06-16 13:09 - 01359389 ____A (Farbar) C:\Users\volker\Desktop\FRST.exe
2013-06-16 13:08 - 2013-06-16 13:08 - 00000675 ____A C:\JRT.txt
2013-06-16 13:07 - 2013-06-16 13:07 - 00000675 ____A C:\Users\volker\Desktop\JRT.txt
2013-06-16 13:06 - 2013-06-16 13:06 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\volker\Desktop\JRT.exe
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\Windows\ERUNT
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\JRT
2013-06-16 12:58 - 2013-06-16 12:59 - 00022123 ____A C:\AdwCleaner[S1].txt
2013-06-16 12:56 - 2013-06-16 12:56 - 00648201 ____A C:\Users\volker\Desktop\adwcleaner.exe
2013-06-15 00:27 - 2013-06-16 13:23 - 00023392 ____A C:\FRST.txt
2013-06-15 00:27 - 2013-06-15 00:27 - 00000000 ____D C:\FRST
2013-06-14 23:20 - 2013-06-14 21:46 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 23:18 - 2013-06-14 23:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 23:18 - 2013-06-14 23:18 - 00000000 __SHD C:\found.000
2013-06-14 21:16 - 2013-06-14 19:05 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 21:16 - 2013-06-03 11:32 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-12 22:40 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 22:40 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 22:40 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 22:40 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-12 22:40 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 22:40 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 22:40 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-12 22:40 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-12 22:40 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 22:40 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 22:40 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-12 22:40 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 22:40 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 22:39 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 22:39 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 22:39 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-12 19:38 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 19:38 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 19:38 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 19:38 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 19:38 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 19:38 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 19:38 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 19:38 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 19:38 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 19:38 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 19:38 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 19:38 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-09 17:18 - 2013-06-09 17:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iPod
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 14:10 - 2013-06-01 14:13 - 00000032 ____A C:\Windows\CD_Start.INI
2013-05-30 14:17 - 2013-04-10 07:18 - 00728424 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-30 14:17 - 2013-04-10 07:18 - 00218984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-30 14:17 - 2013-04-10 05:14 - 02347520 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-30 14:17 - 2013-03-19 06:53 - 00186368 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-30 14:17 - 2013-03-19 05:33 - 00040960 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-30 14:17 - 2013-02-27 07:05 - 00101720 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-30 14:17 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-30 14:17 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-30 14:17 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-30 14:17 - 2013-02-27 06:49 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll

==================== One Month Modified Files and Folders ========

2013-06-16 13:23 - 2013-06-15 00:27 - 00023392 ____A C:\FRST.txt
2013-06-16 13:10 - 2011-07-17 15:26 - 00000000 ____D C:\Users\volker\AppData\Roaming\SlimBrowser
2013-06-16 13:09 - 2013-06-16 13:09 - 01359389 ____A (Farbar) C:\Users\volker\Desktop\FRST.exe
2013-06-16 13:08 - 2013-06-16 13:08 - 00000675 ____A C:\JRT.txt
2013-06-16 13:07 - 2013-06-16 13:07 - 00000675 ____A C:\Users\volker\Desktop\JRT.txt
2013-06-16 13:06 - 2013-06-16 13:06 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\volker\Desktop\JRT.exe
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\Windows\ERUNT
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\JRT
2013-06-16 13:06 - 2010-11-20 23:01 - 00006630 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-16 13:06 - 2009-07-14 06:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-16 13:06 - 2009-07-14 06:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-16 12:59 - 2013-06-16 12:58 - 00022123 ____A C:\AdwCleaner[S1].txt
2013-06-16 12:59 - 2013-03-23 14:08 - 00032805 ____A C:\Users\volker\DesktopStCenter.txt
2013-06-16 12:59 - 2012-12-16 21:22 - 00000278 ____A C:\Windows\Tasks\NUAutoUpdate.job
2013-06-16 12:59 - 2011-11-27 17:42 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-16 12:59 - 2011-07-15 19:58 - 00028160 ____A (secr9tos) C:\Windows\System32\Drivers\oem-drv86.sys
2013-06-16 12:59 - 2011-05-12 13:53 - 00178408 ____A C:\Windows\setupact.log
2013-06-16 12:59 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-16 12:58 - 2011-07-15 19:58 - 01152557 ____A C:\Windows\WindowsUpdate.log
2013-06-16 12:56 - 2013-06-16 12:56 - 00648201 ____A C:\Users\volker\Desktop\adwcleaner.exe
2013-06-16 12:51 - 2011-07-17 15:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-16 12:47 - 2012-10-30 17:17 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.CDF
2013-06-15 00:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-06-15 00:27 - 2013-06-15 00:27 - 00000000 ____D C:\FRST
2013-06-14 23:18 - 2013-06-14 23:18 - 00003424 ____N C:\bootsqm.dat
2013-06-14 23:18 - 2013-06-14 23:18 - 00000000 __SHD C:\found.000
2013-06-14 23:11 - 2011-07-17 21:35 - 00000000 ____D C:\ProgramData\Norton
2013-06-14 23:11 - 2011-07-15 21:41 - 00000000 ____D C:\Users\volker\AppData\Roaming\GHISLER
2013-06-14 23:11 - 2011-07-15 20:00 - 00000000 ____D C:\users\volker
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-14 21:46 - 2013-06-14 23:20 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 19:05 - 2013-06-14 21:16 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 14:37 - 2012-10-30 17:20 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.BAK
2013-06-14 14:35 - 2011-07-21 21:39 - 00000000 ____D C:\Program Files\Zoom Player
2013-06-14 14:21 - 2011-11-27 17:42 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-14 14:20 - 2012-03-30 16:24 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-13 19:06 - 2012-12-17 20:00 - 00000396 ____A C:\Windows\System32\AppLog.log
2013-06-13 19:06 - 2012-12-16 21:22 - 00000270 ____A C:\Windows\Tasks\NUSchedule.job
2013-06-12 22:40 - 2011-05-12 13:26 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 20:23 - 2012-03-30 16:24 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 20:23 - 2011-07-17 15:27 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-12 19:55 - 2012-12-16 20:57 - 00000000 ____D C:\Windows\System32\Drivers\NAV
2013-06-09 17:18 - 2013-06-09 17:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iPod
2013-06-09 17:18 - 2011-07-24 20:50 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-03 11:32 - 2013-06-14 21:16 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 14:13 - 2013-06-01 14:10 - 00000032 ____A C:\Windows\CD_Start.INI
2013-06-01 14:07 - 2012-07-03 22:43 - 00000000 ____D C:\Program Files\WATT32
2013-05-31 09:10 - 2010-11-20 23:48 - 00463602 ____A C:\Windows\PFRO.log
2013-05-30 22:37 - 2011-07-17 16:58 - 00000000 ____D C:\Program Files\JDownloader
2013-05-30 21:50 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-05-30 16:22 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-30 14:23 - 2009-07-14 06:33 - 00420072 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-17 01:08 - 2013-06-12 22:39 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-17 00:49 - 2013-06-12 22:39 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-17 00:39 - 2013-06-12 22:40 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-17 00:28 - 2013-06-12 22:40 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-17 00:28 - 2013-06-12 22:40 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-17 00:27 - 2013-06-12 22:39 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-17 00:26 - 2013-06-12 22:40 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-17 00:23 - 2013-06-12 22:40 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-17 00:21 - 2013-06-12 22:40 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-17 00:21 - 2013-06-12 22:40 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-17 00:20 - 2013-06-12 22:40 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-17 00:19 - 2013-06-12 22:40 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-17 00:17 - 2013-06-12 22:40 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-17 00:17 - 2013-06-12 22:40 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-17 00:16 - 2013-06-12 22:40 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-17 00:12 - 2013-06-12 22:40 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-06-14 16:37

==================== End Of Log ============================

--- --- ---

--- --- ---
FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-06-2013
Ran by volker at 2013-06-16 13:10:20 Run:
Running from C:\Users\volker\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 Update for Microsoft Office 2007 (KB2508958)
7-Zip 4.65
Adobe AIR (Version: 2.7.0.19530)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.202)
Adobe Reader XI (11.0.02) - Deutsch (Version: 11.0.02)
AIDA64 Extreme Edition v2.70 (Version: 2.70)
AMD Accelerated Video Transcoding (Version: 2.00.0002)
AMD APP SDK Runtime (Version: 10.0.923.1)
AMD Catalyst Install Manager (Version: 8.0.873.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.70405.2224)
Any Video Converter Ultimate 4.5.9
AppCAD (Version: 3.00.0002)
Apple Application Support (Version: 2.3.3)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ARCP-590 (Version: 1.02.000)
ARUA-10 (Version: 1.00.000)
AVM FRITZ!Box AddOn (IE) (Version: 1.7.0)
AVM FRITZ!DSL (Version: 2.04.03)
BASCOM-AVR (Version: 2.0.7.3)
Bass Audio Decoder (remove only)
Battlelog Web Plugins (Version: 1.104.0)
Bonjour (Version: 3.0.0.10)
calibre (Version: 0.8.63)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center (Version: 2012.0405.2205.37728)
Catalyst Control Center Graphics Previews Common (Version: 2012.0405.2205.37728)
Catalyst Control Center InstallProxy (Version: 2012.0405.2205.37728)
Catalyst Control Center Localization All (Version: 2012.0405.2205.37728)
CCC Help Chinese Standard (Version: 2012.0405.2204.37728)
CCC Help Chinese Traditional (Version: 2012.0405.2204.37728)
CCC Help Czech (Version: 2012.0405.2204.37728)
CCC Help Danish (Version: 2012.0405.2204.37728)
CCC Help Dutch (Version: 2012.0405.2204.37728)
CCC Help English (Version: 2012.0405.2204.37728)
CCC Help Finnish (Version: 2012.0405.2204.37728)
CCC Help French (Version: 2012.0405.2204.37728)
CCC Help German (Version: 2012.0405.2204.37728)
CCC Help Greek (Version: 2012.0405.2204.37728)
CCC Help Hungarian (Version: 2012.0405.2204.37728)
CCC Help Italian (Version: 2012.0405.2204.37728)
CCC Help Japanese (Version: 2012.0405.2204.37728)
CCC Help Korean (Version: 2012.0405.2204.37728)
CCC Help Norwegian (Version: 2012.0405.2204.37728)
CCC Help Polish (Version: 2012.0405.2204.37728)
CCC Help Portuguese (Version: 2012.0405.2204.37728)
CCC Help Russian (Version: 2012.0405.2204.37728)
CCC Help Spanish (Version: 2012.0405.2204.37728)
CCC Help Swedish (Version: 2012.0405.2204.37728)
CCC Help Thai (Version: 2012.0405.2204.37728)
CCC Help Turkish (Version: 2012.0405.2204.37728)
ccc-utility (Version: 2012.0405.2205.37728)
CD Audio Reader Filter (remove only)
CFGSR (Version: 2.3.6)
ContainerEx Decrypter (Version: 1.0.1.57)
Creative ALchemy (Version: 1.41)
Creative MediaSource 5 (Version: 5.26)
Creative Software AutoUpdate (Version: 1.40)
Creative Systeminformationen (Version: 1.10)
Creative WaveStudio 7 (Version: 7.12)
Creative-Audiokonsole (Version: 1.33)
CrystalDiskInfo 5.0.0 (Version: 5.0.0)
DCoder Image Source (remove only)
DOSShell 1.9 (Version: 1.9)
Dr. Hardware 2012 12.5d
DScaler 5 Mpeg Decoders
DVDFab 8.1.5.3 (07/01/2012) Qt Beta
EasyBCD 2.1.2 (Version: 2.1.2)
ELECTRA 2.8
EME System V7.0
EMECalc Version 7:21 15th February 2012
EMEPlanner 22nd March 2012 (Ver 1.65)
EPSON Scan
eReg (Version: 1.20.138.34)
ESN Sonar (Version: 0.70.4)
Extended Asian Language font pack for Adobe Reader XI (Version: 11.0.0)
FFMPEG Core Files (remove only)
FlashPeak SlimBrowser (Version: 7.00.024)
Foxit PDF Editor (Version: 2.2.0.0205)
FreeOCR v4.2
Gabest MPEG Splitter (remove only)
Garmin BaseCamp (Version: 4.1.2)
Garmin MapInstall (Version: 4.0.3)
Garmin USB Drivers (Version: 2.3.1.0)
Garmin WebUpdater (Version: 2.4)
Garmin WebUpdater (Version: 2.5.4)
GmapTool 0.6.1
Google Earth (Version: 7.0.3.8542)
Google Update Helper (Version: 1.3.21.145)
GPL Ghostscript (Version: 9.06)
GSview 5.0 (Version: 5.0)
HP Product Detection (Version: 10.7.9.0)
IDA Pro Advanced v5.2 with WinCE v5.0 debugger
iDevice Manager (Version: 2.0.3.0)
ImgBurn (Version: 2.5.6.0)
IrfanView (remove only) (Version: 4.32)
IsoBuster 3.1 (Version: 3.1)
iTunes (Version: 11.0.2.26)
Java Auto Updater (Version: 2.0.5.1)
Java(TM) 6 Update 26 (Version: 6.0.260)
JDownloader 0.9 (Version: 0.9)
jv16 PowerTools 2012 (Version: )
KiCad 2012.01.19 (Version: 2012.01.19)
K-Lite Codec Pack 9.2.0 (Full) (Version: 9.2.0)
Logitech SetPoint 6.52 (Version: 6.52.74)
Malwarebytes Anti-Malware Version 1.70.0.1100 (Version: 1.70.0.1100)
MapTk (MapToolKit)
Medal of Honor (TM) (Version: 1.0.0.0)
Medal of Honor Allied Assault
Medal of Honor Allied Assault(tm) Spearhead Patch 2.15
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mobipocket Reader 6.2 (Version: 6.2.608)
MONOGRAM AMR Splitter/Decoder (remove only)
Mozilla Firefox 11.0 (x86 de) (Version: 11.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Norton AntiVirus (Version: 20.3.1.22)
Norton Identity Safe (Version: 2013.3.3.19)
Norton Utilities 16 (Version: 16.0)
NVIDIA PhysX (Version: 9.09.0203)
OFM_DBNLv29-03-2013
OpenAL
OpenSource AVI Splitter (remove only)
OpenSource DTS/AC3/DD+ Source Filter (remove only)
Origin (Version: 9.0.15.65)
Pazera Free MP4 to AVI Converter 1.6 (Version: 1.6)
PDF-Viewer (Version: 2.5.208.0)
Platform (Version: 1.38)
PunkBuster Services (Version: 0.991)
QuickTime (Version: 7.71.80.42)
Ray Adams ATI Tray Tools
Razer Imperator (Version: 2.01.06)
RealMedia (remove only)
Realtek Ethernet Controller Driver For Windows Vista and Later (Version: 1.00.0009)
Realtek High Definition Audio Driver (Version: 6.0.1.5919)
Rocky 3.7
SanDisk SSD Toolkit 1.0.0.1 (Version: 1.0.0.1)
Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (Version: 6.5)
SiSoftware Sandra Technische Unterstützung (Engineer) 2012 (Version: 18.10.2012.1)
SolidWorks eDrawings 2012 (Version: 12.3.113)
Sound Blaster X-Fi Surround 5.1 Pro (Version: 1.0)
SpeedFan (remove only)
SPlayer
System Requirements Lab for Intel (Version: 4.4.24.0)
System.Data.SQLite v1.0.81.0 (Version: 1.0.81.0)
Target 3001! V15 special (Version: )
Tera Term 4.75
Total Commander (Remove or Repair) (Version: 8.0)
Total Commander Ultima Prime 5.5.0.0 (Version: 5.5.0.0)
TreeSize Free V2.7 (Version: 2.7)
TweakUAC (Version: 1.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
VIA Plattform-Geräte-Manager (Version: 1.38)
WATT32 (Version: 4.5.5.1)
Winamp (Version: 5.621 )
Winamp Erkennungs-Plug-in (Version: 1.0.0.1)
WinDjView 1.0.3 (Version: 1.0.3)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0)
WinNWT4 Version 4.11
WinRAR 4.00 (32-Bit) (Version: 4.00.0)
WSJT Version 7.07 r2031
Yagi Calculator Version 2.6.6
ZOC Terminal 6.3 (Version: 6.35)
Zoom Player (remove only)
Zoom Player deutsche Sprachdateien (entfernen)

==================== Restore Points  =========================

07-06-2013 17:00:27 Erstellt von Norton Utilities                                   
09-06-2013 17:00:30 Erstellt von Norton Utilities                                   
10-06-2013 17:00:30 Erstellt von Norton Utilities                                   
11-06-2013 17:00:29 Erstellt von Norton Utilities                                   
12-06-2013 20:39:52 Windows Update
13-06-2013 17:00:42 Erstellt von Norton Utilities                                   
16-06-2013 10:50:52 Windows Update

==================== Faulty Device Manager Devices =============

Name: IDSVix86
Description: IDSVix86
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: IDSVix86
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================
Error: (06/08/2013 01:16:07 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 12 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (12/05/2012 10:49:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 114 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (03/05/2012 11:27:53 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 64 seconds with 60 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Percentage of memory in use: 30%
Total physical RAM: 3262.08 MB
Available physical RAM: 2252.5 MB
Total Pagefile: 7353.31 MB
Available Pagefile: 6150.89 MB
Total Virtual: 2047.88 MB
Available Virtual: 1892.42 MB

==================== Drives ================================

Drive c: (C) (Fixed) (Total:111.79 GB) (Free:35.96 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (D) (Fixed) (Total:155.19 GB) (Free:84.43 GB) NTFS
Drive e: (E) (Fixed) (Total:629.84 GB) (Free:264.43 GB) NTFS
Drive f: (madmax786511) (CDROM) (Total:2.53 GB) (Free:0 GB) UDF
Drive g: (G:) (Fixed) (Total:931.51 GB) (Free:738.59 GB) NTFS
Drive z: () (Fixed) (Total:146.48 GB) (Free:78.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 525FE842)
Partition 1: (Not Active) - (Size=932 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: E9D1147C)
Partition 1: (Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=785 GB) - (Type=OF Extended)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 750A4590)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

==================== End Of Log ============================

--- --- ---

schrauber · 16.06.2013, 18:08

Hi,

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

cayinda2 · 16.06.2013, 19:38

Hallo schrauber, hier das Log.

schrauber · 17.06.2013, 08:31

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST Log. Noch Probleme?

cayinda2 · 17.06.2013, 19:52

Hallo schrauber,

alles klar hier. System läuft.
Hier die Logs.

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1decdd25c127574e90b27da4d2faa489
# engine=14093
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-17 05:41:02
# local_time=2013-06-17 07:41:02 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=3590 16777213 100 90 5193952 190509048 0 0
# compatibility_mode=5893 16776574 66 94 60736935 123122053 0 0
# scanned=561030
# found=1
# cleaned=0
# scan_time=18849
sh=619746B9CE68ADB0A0DB344EDEACC4C8DE120525 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\volker\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\9d8adeb-10bc52ad"

Results of screen317's Security Check version 0.99.64
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Norton AntiVirus
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
Java 7 Update 21
Adobe Reader XI
Mozilla Firefox 11.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Norton AntiVirus Engine 20.3.1.22 ccSvcHst.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-06-2013
Ran by volker (administrator) on 17-06-2013 20:49:37
Running from C:\Users\volker\Desktop
Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
(Symantec Corporation) C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe
(Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe
(Software 2000 Limited) C:\Windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
(Symantec) C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe
(Symantec Corporation) C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe
(Symantec Corporation) C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe
() C:\Windows\system32\PnkBstrA.exe
(Creative Technology Ltd) C:\Windows\System32\CtHelper.exe
(Symantec) C:\Program Files\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\StCenter.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(FlashPeak Inc.) C:\Program Files\SlimBrowser\sbframe.exe
(FlashPeak Inc.) C:\Program Files\SlimBrowser\SBRender.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [CTHelper] CTHELPER.EXE [x]
HKLM\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files\AMD AVT\bin\kdbsync.exe" aml [10752 2012-01-31] ()
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SSDMonitor] C:\Program Files\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe [104480 2012-09-29] (Symantec)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [2238704 2013-02-21] (Logitech, Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKCU\...\Policies\system: [DisableRegistryTools] 0
MountPoints2: {898ca9d7-bd61-11e1-a893-806e6f6e6963} - H:\sources\sperr32.exe x64
Startup: C:\Users\volker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files\FRITZ!DSL\FritzDsl.exe (AVM Berlin)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: (No Name) - {ebd898f8-fcf6-4694-bc3b-eabc7271eeb1} -  No File
SearchScopes: HKCU - {A0699754-D9A8-416C-8E9D-3CD75F5E087E} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
SearchScopes: HKCU - {EEF82575-0BE9-4BFF-BDA4-35FD40173704} URL = hxxp://suche.t-online.de/cgi-bin/swl?br=ie7&q={searchTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Norton Identity Protection - {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\coIEPlg.dll (Symantec Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: FRITZ!Box Addon BHO - {C0C86BBE-9509-4296-8459-FDBFDAF4B673} - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
Toolbar: HKLM - Norton Identity Safe Toolbar - {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU -No Name - {EBD898F8-FCF6-4694-BC3B-EABC7271EEB1} -  No File
DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.24.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab
DPF: {FC7DCECC-8042-42D0-B080-B68A2C18B095} file:///E:/CTROM08DVD/asearch/asearch.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\..\Interfaces\{89376290-EB85-413E-A0BF-63C5FE694A20}: [NameServer]192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\volker\AppData\Roaming\Mozilla\Firefox\Profiles\pf34vh1r.default
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @esn.me/esnsonar,version=0.70.4 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin: @esn/esnlaunch,version=1.104.0 - C:\Program Files\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========================== Services (Whitelisted) =================

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2011-07-17] (Creative Labs)
S3 DiskDoctorService; C:\Program Files\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe [1147424 2012-09-29] (Symantec Corporation)
S3 GSService; C:\Windows\system32\GSService.exe [403832 2012-12-30] ()
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NAV; C:\Program Files\Norton AntiVirus\Engine\20.3.1.22\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
R2 NCO; C:\Program Files\Norton Identity Safe\Engine\2013.3.3.19\diMaster.dll [554288 2013-03-29] (Symantec Corporation)
R2 NU16StartManagerSvc; C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe [792608 2012-09-29] (Symantec)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2012-01-21] ()
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\RpcAgentSrv.exe [93848 2008-11-06] (SiSoftware)
S3 SpeedDiskService; C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe [1160224 2012-09-29] (Symantec Corporation)
S2 WMPNetworkSvc; 

==================== Drivers (Whitelisted) ====================

S3 atidgllk; C:\Program Files\GPU-Z\atidgllk.sys [12048 2006-07-19] (ATI Technologies Inc.)
R1 atitray; C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [20384 2011-03-27] ()
S3 AVMUNET; C:\Windows\System32\DRIVERS\avmunet.sys [14976 2006-11-07] (AVM GmbH)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_NAV; C:\Windows\system32\drivers\NAV\1403010.016\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
R1 ccSet_NST; C:\Windows\system32\drivers\NST\7DD03030.013\ccSetx86.sys [134304 2012-11-16] (Symantec Corporation)
S3 COMMONFX; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
R3 COMMONFX.SYS; C:\Windows\System32\drivers\COMMONFX.SYS [99416 2010-03-18] (Creative Technology Ltd)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2009-12-18] ()
S3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [164608 2007-04-12] (Creative Technology Ltd.)
S3 CTAUDFX; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
R3 CTAUDFX.SYS; C:\Windows\System32\drivers\CTAUDFX.SYS [555096 2010-03-18] (Creative Technology Ltd)
S3 ctdvda2k; C:\Windows\System32\drivers\ctdvda2k.sys [347144 2010-03-18] (Creative Technology Ltd)
S3 CTEAPSFX.DLL; C:\Windows\System32\CTEAPSFX.DLL [168192 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPFX.DLL; C:\Windows\System32\CTEDSPFX.DLL [280320 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPIO.DLL; C:\Windows\System32\CTEDSPIO.DLL [128768 2007-04-12] (Creative Technology Ltd)
S3 CTEDSPSY.DLL; C:\Windows\System32\CTEDSPSY.DLL [323328 2007-04-12] (Creative Technology Ltd)
S3 CTERFXFX; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTERFXFX.SYS; C:\Windows\System32\drivers\CTERFXFX.SYS [100952 2010-03-18] (Creative Technology Ltd)
S3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1317632 2007-04-12] (Creative Technology Ltd.)
S3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [66816 2007-04-12] (Creative Technology Ltd.)
S3 CTSBLFX; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
R3 CTSBLFX.SYS; C:\Windows\System32\drivers\CTSBLFX.SYS [566360 2010-03-18] (Creative Technology Ltd)
S3 drhard; C:\Windows\system32\DRIVERS\DRHARD.SYS [23600 2005-12-01] (Licensed for Gebhard Software)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-12-15] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-05-30] (Symantec Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [61704 2011-03-18] (FTDI Ltd.)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] ()
S3 grmnusb; C:\Windows\System32\drivers\grmnusb.sys [15720 2012-04-18] (GARMIN Corp.)
R3 ha10kx2k; C:\Windows\System32\drivers\ha10kx2k.sys [798808 2010-03-18] (Creative Technology Ltd)
R3 hap16v2k; C:\Windows\System32\drivers\hap16v2k.sys [162904 2010-03-18] (Creative Technology Ltd)
S3 hap17v2k; C:\Windows\System32\drivers\hap17v2k.sys [189528 2010-03-18] (Creative Technology Ltd)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\IPSDefs\20130614.001\IDSvix86.sys [386720 2013-05-29] (Symantec Corporation)
S3 ksaud; C:\Windows\System32\drivers\ksaud.sys [1255168 2010-07-30] (Creative Technology Ltd.)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [28160 2009-07-08] (hxxp://libusb-win32.sourceforge.net)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [40200 2013-01-03] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30984 2013-01-03] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 MP4ConverterAudio; C:\Windows\System32\drivers\MP4ConverterAudio.sys [23608 2012-12-30] (Windows (R) Win 7 DDK provider)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [6504 2009-05-13] ()
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130617.002\NAVENG.SYS [93272 2013-05-30] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.2.0.19\Definitions\VirusDefs\20130617.002\NAVEX15.SYS [1611992 2013-05-30] (Symantec Corporation)
R0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2013-06-17] (secr9tos)
S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Technische Unterstützung (Engineer) 2012\WNt500x86\Sandra.sys [23112 2009-08-07] (SiSoftware)
S3 silabenm; C:\Windows\System32\DRIVERS\silabenm.sys [47176 2010-07-28] (Silicon Laboratories)
S3 silabser; C:\Windows\System32\DRIVERS\silabser.sys [61312 2011-10-14] (Silicon Laboratories)
R0 speedfan; C:\Windows\System32\speedfan.sys [25240 2011-03-18] (Almico Software)
R3 SRTSP; C:\Windows\System32\Drivers\NAV\1403010.016\SRTSP.SYS [602712 2013-01-29] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NAV\1403010.016\SRTSPX.SYS [32344 2013-01-29] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NAV\1403010.016\SYMDS.SYS [367704 2013-01-22] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NAV\1403010.016\SYMEFA.SYS [934488 2013-01-31] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2012-12-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NAV\1403010.016\Ironx86.SYS [175264 2012-11-16] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NAV\1403010.016\SYMNETS.SYS [338592 2013-01-31] (Symantec Corporation)
R1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [24680 2011-01-26] (CaptainFlint Software)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [117760 2011-02-25] (VIA Technologies, Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [164864 2011-02-25] (VIA Technologies, Inc.)
S3 COMMONFX.DLL; system32\COMMONFX.DLL [x]
S3 CTAUDFX.DLL; system32\CTAUDFX.DLL [x]
S3 CTERFXFX.DLL; system32\CTERFXFX.DLL [x]
S3 CTSBLFX.DLL; system32\CTSBLFX.DLL [x]
S1 EIO; system32\DRIVERS\EIO.sys [x]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-17 20:48 - 2013-06-17 20:48 - 00001000 ____A C:\Users\volker\Desktop\checkup.txt
2013-06-17 20:47 - 2013-06-17 20:47 - 00890839 ____A C:\Users\volker\Desktop\SecurityCheck.exe
2013-06-17 14:25 - 2013-06-17 14:25 - 00000000 ____D C:\Program Files\ESET
2013-06-17 14:23 - 2013-06-17 14:23 - 02347384 ____A (ESET) C:\Users\volker\Desktop\esetsmartinstaller_enu.exe
2013-06-16 17:56 - 2013-06-16 17:56 - 00000000 ____D C:\Program Files\Common Files\Java
2013-06-16 17:55 - 2013-06-16 17:55 - 00866720 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-06-16 17:55 - 2013-06-16 17:55 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-06-16 13:51 - 2013-06-16 13:52 - 00000000 ____D C:\ProgramData\HitmanPro
2013-06-16 13:09 - 2013-06-16 13:09 - 01359389 ____A (Farbar) C:\Users\volker\Desktop\FRST.exe
2013-06-16 13:08 - 2013-06-16 13:08 - 00000675 ____A C:\JRT.txt
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\Windows\ERUNT
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\JRT
2013-06-16 12:58 - 2013-06-16 12:59 - 00022123 ____A C:\AdwCleaner[S1].txt
2013-06-15 00:27 - 2013-06-16 13:23 - 00023392 ____A C:\FRST.txt
2013-06-15 00:27 - 2013-06-15 00:27 - 00000000 ____D C:\FRST
2013-06-14 23:20 - 2013-06-14 21:46 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 23:18 - 2013-06-14 23:18 - 00000000 __SHD C:\found.000
2013-06-14 21:16 - 2013-06-14 19:05 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-14 21:16 - 2013-06-03 11:32 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-12 22:40 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 22:40 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 22:40 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 22:40 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-12 22:40 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 22:40 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 22:40 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-12 22:40 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-12 22:40 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 22:40 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 22:40 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-12 22:40 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 22:40 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 22:39 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 22:39 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 22:39 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-12 19:38 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 19:38 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 19:38 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 19:38 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 19:38 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 19:38 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 19:38 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 19:38 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 19:38 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 19:38 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 19:38 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 19:38 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-09 17:18 - 2013-06-09 17:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iPod
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 14:10 - 2013-06-01 14:13 - 00000032 ____A C:\Windows\CD_Start.INI
2013-05-30 14:17 - 2013-04-10 07:18 - 00728424 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-30 14:17 - 2013-04-10 07:18 - 00218984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-30 14:17 - 2013-04-10 05:14 - 02347520 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-30 14:17 - 2013-03-19 06:53 - 00186368 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2013-05-30 14:17 - 2013-03-19 05:33 - 00040960 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll
2013-05-30 14:17 - 2013-02-27 07:05 - 00101720 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-30 14:17 - 2013-02-27 06:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-30 14:17 - 2013-02-27 06:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-30 14:17 - 2013-02-27 06:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-30 14:17 - 2013-02-27 06:49 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll

==================== One Month Modified Files and Folders ========

2013-06-17 20:48 - 2013-06-17 20:48 - 00001000 ____A C:\Users\volker\Desktop\checkup.txt
2013-06-17 20:47 - 2013-06-17 20:47 - 00890839 ____A C:\Users\volker\Desktop\SecurityCheck.exe
2013-06-17 20:47 - 2011-07-17 15:26 - 00000000 ____D C:\Users\volker\AppData\Roaming\SlimBrowser
2013-06-17 20:45 - 2012-12-17 20:00 - 00000398 ____A C:\Windows\System32\AppLog.log
2013-06-17 20:45 - 2012-12-16 21:22 - 00000270 ____A C:\Windows\Tasks\NUSchedule.job
2013-06-17 20:45 - 2011-05-12 13:53 - 00178968 ____A C:\Windows\setupact.log
2013-06-17 20:21 - 2011-11-27 17:42 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-17 20:20 - 2012-03-30 16:24 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-17 16:19 - 2011-07-15 19:58 - 01219722 ____A C:\Windows\WindowsUpdate.log
2013-06-17 14:26 - 2010-11-20 23:01 - 00006630 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-17 14:26 - 2009-07-14 06:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-17 14:26 - 2009-07-14 06:34 - 00026544 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-17 14:25 - 2013-06-17 14:25 - 00000000 ____D C:\Program Files\ESET
2013-06-17 14:23 - 2013-06-17 14:23 - 02347384 ____A (ESET) C:\Users\volker\Desktop\esetsmartinstaller_enu.exe
2013-06-17 14:21 - 2011-11-27 17:42 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-17 14:19 - 2013-03-23 14:08 - 00033591 ____A C:\Users\volker\DesktopStCenter.txt
2013-06-17 14:19 - 2012-12-16 21:22 - 00000278 ____A C:\Windows\Tasks\NUAutoUpdate.job
2013-06-17 14:19 - 2011-07-15 19:58 - 00028160 ____A (secr9tos) C:\Windows\System32\Drivers\oem-drv86.sys
2013-06-17 14:19 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-16 21:57 - 2012-10-30 17:20 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.BAK
2013-06-16 21:57 - 2012-10-30 17:17 - 04931577 ____A C:\Windows\{00000005-00000000-00000001-00001102-00000004-20021102}.CDF
2013-06-16 21:43 - 2011-07-21 21:39 - 00000000 ____D C:\Program Files\Zoom Player
2013-06-16 17:56 - 2013-06-16 17:56 - 00000000 ____D C:\Program Files\Common Files\Java
2013-06-16 17:55 - 2013-06-16 17:55 - 00866720 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2013-06-16 17:55 - 2013-06-16 17:55 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-06-16 17:55 - 2011-07-17 17:00 - 00788896 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-06-16 17:55 - 2011-07-17 17:00 - 00263584 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-06-16 17:55 - 2011-07-17 17:00 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-06-16 17:55 - 2011-07-17 17:00 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-06-16 17:55 - 2011-07-17 17:00 - 00000000 ____D C:\Program Files\Java
2013-06-16 17:53 - 2010-11-20 23:48 - 00464278 ____A C:\Windows\PFRO.log
2013-06-16 13:53 - 2012-03-07 20:12 - 00001090 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-16 13:53 - 2012-03-07 20:12 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-16 13:52 - 2013-06-16 13:51 - 00000000 ____D C:\ProgramData\HitmanPro
2013-06-16 13:23 - 2013-06-15 00:27 - 00023392 ____A C:\FRST.txt
2013-06-16 13:20 - 2012-03-30 16:24 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-16 13:20 - 2011-07-17 15:27 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-16 13:09 - 2013-06-16 13:09 - 01359389 ____A (Farbar) C:\Users\volker\Desktop\FRST.exe
2013-06-16 13:08 - 2013-06-16 13:08 - 00000675 ____A C:\JRT.txt
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\Windows\ERUNT
2013-06-16 13:06 - 2013-06-16 13:06 - 00000000 ____D C:\JRT
2013-06-16 12:59 - 2013-06-16 12:58 - 00022123 ____A C:\AdwCleaner[S1].txt
2013-06-16 12:51 - 2011-07-17 15:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-15 00:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\LogFiles
2013-06-15 00:27 - 2013-06-15 00:27 - 00000000 ____D C:\FRST
2013-06-14 23:18 - 2013-06-14 23:18 - 00000000 __SHD C:\found.000
2013-06-14 23:11 - 2011-07-17 21:35 - 00000000 ____D C:\ProgramData\Norton
2013-06-14 23:11 - 2011-07-15 21:41 - 00000000 ____D C:\Users\volker\AppData\Roaming\GHISLER
2013-06-14 23:11 - 2011-07-15 20:00 - 00000000 ____D C:\users\volker
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\wfp
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 23:11 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-06-14 21:46 - 2013-06-14 23:20 - 01359323 ____A (Farbar) C:\FRST.exe
2013-06-14 19:05 - 2013-06-14 21:16 - 09171472 ____A (SurfRight B.V.) C:\HitmanPro.exe
2013-06-12 22:40 - 2011-05-12 13:26 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 19:55 - 2012-12-16 20:57 - 00000000 ____D C:\Windows\System32\Drivers\NAV
2013-06-09 17:18 - 2013-06-09 17:18 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iTunes
2013-06-09 17:18 - 2013-06-09 17:18 - 00000000 ____D C:\Program Files\iPod
2013-06-09 17:18 - 2011-07-24 20:50 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-06-03 11:32 - 2013-06-14 21:16 - 09833328 ____A (SurfRight B.V.) C:\HitmanPro_x64.exe
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt32.exe.lnk
2013-06-01 14:14 - 2013-06-01 14:14 - 00002911 ____A C:\Users\volker\Desktop\Watt Kurzanleitung.pdf.lnk
2013-06-01 14:13 - 2013-06-01 14:10 - 00000032 ____A C:\Windows\CD_Start.INI
2013-06-01 14:07 - 2012-07-03 22:43 - 00000000 ____D C:\Program Files\WATT32
2013-05-30 22:37 - 2011-07-17 16:58 - 00000000 ____D C:\Program Files\JDownloader
2013-05-30 21:50 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-05-30 16:22 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-30 14:23 - 2009-07-14 06:33 - 00420072 ____A C:\Windows\System32\FNTCACHE.DAT

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-06-16 14:40

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 17.06.2013, 20:03

Firefox bitte updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

cayinda2 · 17.06.2013, 20:19

Hallo schrauber,

hier das Log

Farbar Service Scanner Version: 16-06-2013
Ran by volker (administrator) on 17-06-2013 at 21:18:41
Running from "C:\Users\volker\Desktop"
Windows 7 Ultimate Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

wscsvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-06-12 19:38] - [2013-05-08 07:38] - 1293672 ____A (Microsoft Corporation) D32FDAC73FCD76B85389C39BC1087F2A

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-06-12 19:38] - [2013-05-13 06:45] - 0140288 ____A (Microsoft Corporation) 3897DFF247D9ED0006190349DE264E14

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

gruß

volker

16.06.2013, 11:16	#4
schrauber /// the machine /// TB-Ausbilder	BKA/GVU Trojaner Win7 32bit Was? Ich faile nie Neues Scanlog FRST aus der Recovery bitte. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

BKA/GVU Trojaner Win7 32bit

Plagegeister aller Art und deren Bekämpfung: BKA/GVU Trojaner Win7 32bit