Gesperrter Computer Vista 32 Business

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-07-2013
Ran by SYSTEM on 03-07-2013 12:47:04
Running from G:\
Windows Vista (TM) Business (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] RtHDVCpl.exe [x]
HKLM\...\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [90112 2006-11-10] ()
HKLM\...\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [81920 2006-10-03] (Macrovision Corporation)
HKLM\...\Run: []  [x]
HKLM\...\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [221184 2006-11-05] (Sonic Solutions)
HKLM\...\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [118784 2006-10-20] (CyberLink Corp.)
HKLM\...\Run: [Norton Save and Restore 2.0] "C:\Program Files\Norton Save and Restore\Agent\VProTray.exe" [2020968 2007-02-13] (Symantec Corporation)
HKLM\...\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [16384 2007-11-15] ( )
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-27] (Adobe Systems Incorporated)
HKU\EUPROCON\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-18] (Microsoft Corporation)
HKU\EUPROCON\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\EUPROCON\...\Winlogon: [Shell] explorer.exe <==== ATTENTION 
Startup: C:\Users\EUPROCON\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

========================== Services (Whitelisted) =================

S2 Automatisches LiveUpdate - Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [194240 2006-11-08] (Symantec Corporation)
S3 LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2541248 2006-11-08] (Symantec Corporation)
S3 MSSQL$MSSMLBIZ; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 NIS; C:\Program Files\Norton Internet Security\Engine\20.4.0.40\diMaster.dll [556336 2013-05-30] (Symantec Corporation)
S2 Norton Save and Restore; C:\Program Files\Norton Save and Restore\Agent\VProSvc.exe [2655848 2007-02-13] (Symantec Corporation)
S2 PST Service; C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola)

==================== Drivers (Whitelisted) ====================

S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130702.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1404000.028\ccSetx86.sys [134744 2013-04-16] (Symantec Corporation)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2012-12-31] (Symantec Corporation)
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130702.001\IDSvix86.sys [386720 2013-04-25] (Symantec Corporation)
S3 LVUSBSta; C:\Windows\System32\drivers\LVUSBSta.sys [41888 2007-05-09] (Logitech Inc.)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130702.021\NAVENG.SYS [93272 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130702.021\NAVEX15.SYS [1611992 2013-05-22] (Symantec Corporation)
S3 pepifilter; C:\Windows\System32\DRIVERS\lv302af.sys [14112 2007-05-09] (Logitech Inc.)
S3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [1276832 2007-05-09] (Logitech Inc.)
S3 R300; C:\Windows\System32\DRIVERS\atikmdag.sys [10070016 2012-11-16] (Advanced Micro Devices, Inc.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1404000.028\SRTSP.SYS [603224 2013-05-16] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1404000.028\SRTSPX.SYS [32344 2013-03-05] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NIS\1404000.028\SYMDS.SYS [367704 2013-05-21] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1404000.028\SYMEFA.SYS [934488 2013-05-23] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2013-06-19] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1404000.028\Ironx86.SYS [175264 2013-03-05] (Symantec Corporation)
S1 SYMTDIv; C:\Windows\System32\Drivers\NIS\1404000.028\SYMTDIV.SYS [352344 2013-04-25] (Symantec Corporation)
S2 v2imount; C:\Windows\System32\DRIVERS\v2imount.sys [37864 2007-02-13] (Symantec Corporation)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [14072 2007-02-13] (Symantec Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-03 12:46 - 2013-07-03 12:46 - 00000000 ____D C:\FRST
2013-07-03 09:58 - 2013-07-03 09:58 - 00001036 ____A C:\Windows\System32\.crusader
2013-07-03 09:08 - 2013-07-03 09:58 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-03 06:59 - 2013-07-03 06:59 - 00393531 ____A C:\ProgramData\2433f433
2013-07-03 06:59 - 2013-07-03 06:59 - 00393512 ____A C:\Users\EUPROCON\AppData\Local\2433f433
2013-07-03 06:59 - 2013-07-03 06:59 - 00393480 ____A C:\Users\EUPROCON\AppData\Roaming\2433f433
2013-07-01 07:57 - 2013-07-01 07:57 - 00001894 ____A C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-07-01 07:57 - 2013-07-01 07:57 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-07-01 07:57 - 2013-07-01 07:57 - 00000000 ____D C:\Program Files\Adobe
2013-07-01 07:27 - 2013-07-01 07:27 - 00000000 ____D C:\Windows\System32\appmgmt
2013-06-20 06:47 - 2013-06-20 06:47 - 00000000 ____D C:\Program Files\GUM16FB.tmp
2013-06-20 06:46 - 2013-07-03 11:16 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-20 06:46 - 2013-07-03 09:51 - 00001102 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-20 06:45 - 2013-06-20 06:46 - 00000000 ____D C:\Users\EUPROCON\AppData\Local\Deployment
2013-06-20 06:45 - 2013-06-20 06:45 - 00000000 ____D C:\Users\EUPROCON\AppData\Local\Apps\2.0
2013-06-13 19:50 - 2013-05-17 00:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 19:50 - 2013-05-16 23:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 19:50 - 2013-05-16 23:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 19:50 - 2013-05-16 23:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 19:50 - 2013-05-16 23:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 19:50 - 2013-05-16 23:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 19:50 - 2013-05-16 23:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 19:50 - 2013-05-16 23:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 19:50 - 2013-05-16 23:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 19:50 - 2013-05-16 23:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 19:50 - 2013-05-16 23:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 19:50 - 2013-05-16 23:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 19:50 - 2013-05-16 23:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 19:50 - 2013-05-16 23:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 19:50 - 2013-05-16 23:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 19:50 - 2013-05-16 23:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-13 05:50 - 2013-05-08 05:37 - 00905576 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 05:50 - 2013-05-02 23:03 - 03603832 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-13 05:50 - 2013-05-02 23:03 - 03551096 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-13 05:50 - 2013-05-02 05:04 - 00443904 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 05:50 - 2013-05-02 05:03 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\printcom.dll
2013-06-13 05:50 - 2013-04-24 05:00 - 00985600 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 05:50 - 2013-04-24 05:00 - 00133120 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 05:50 - 2013-04-24 05:00 - 00098304 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 05:50 - 2013-04-24 05:00 - 00041984 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 05:50 - 2013-04-24 02:46 - 00812544 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 05:50 - 2013-04-17 13:30 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll

==================== One Month Modified Files and Folders ========

2013-07-03 12:46 - 2013-07-03 12:46 - 00000000 ____D C:\FRST
2013-07-03 11:34 - 2006-11-02 11:33 - 01601156 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-03 11:17 - 2008-01-26 12:45 - 00000012 ____A C:\Windows\bthservsdp.dat
2013-07-03 11:17 - 2006-11-02 14:01 - 00032510 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-03 11:17 - 2006-11-02 14:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-03 11:16 - 2013-06-20 06:46 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-03 11:15 - 2006-11-02 13:47 - 00003552 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-03 11:15 - 2006-11-02 13:47 - 00003552 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-03 11:10 - 2008-01-26 12:38 - 01882146 ____A C:\Windows\WindowsUpdate.log
2013-07-03 10:22 - 2013-01-08 08:32 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-03 09:58 - 2013-07-03 09:58 - 00001036 ____A C:\Windows\System32\.crusader
2013-07-03 09:58 - 2013-07-03 09:08 - 00000000 ____D C:\ProgramData\HitmanPro
2013-07-03 09:51 - 2013-06-20 06:46 - 00001102 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-03 08:01 - 2006-11-02 13:52 - 00026169 ____A C:\Windows\setupact.log
2013-07-03 06:59 - 2013-07-03 06:59 - 00393531 ____A C:\ProgramData\2433f433
2013-07-03 06:59 - 2013-07-03 06:59 - 00393512 ____A C:\Users\EUPROCON\AppData\Local\2433f433
2013-07-03 06:59 - 2013-07-03 06:59 - 00393480 ____A C:\Users\EUPROCON\AppData\Roaming\2433f433
2013-07-02 09:01 - 2013-01-01 13:41 - 00000000 ____D C:\Users\EUPROCON\AppData\Local\SimpleSYN
2013-07-01 17:40 - 2006-11-02 14:00 - 00035488 ____A C:\Windows\PFRO.log
2013-07-01 08:02 - 2012-12-30 22:47 - 00000000 ____D C:\Users\EUPROCON\AppData\Local\Adobe
2013-07-01 07:57 - 2013-07-01 07:57 - 00001894 ____A C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-07-01 07:57 - 2013-07-01 07:57 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-07-01 07:57 - 2013-07-01 07:57 - 00000000 ____D C:\Program Files\Adobe
2013-07-01 07:57 - 2008-01-26 13:02 - 00000000 ____D C:\ProgramData\Adobe
2013-07-01 07:27 - 2013-07-01 07:27 - 00000000 ____D C:\Windows\System32\appmgmt
2013-06-20 06:49 - 2012-12-30 22:05 - 00000000 ____D C:\Users\EUPROCON\AppData\Roaming\Google
2013-06-20 06:47 - 2013-06-20 06:47 - 00000000 ____D C:\Program Files\GUM16FB.tmp
2013-06-20 06:47 - 2012-12-30 22:04 - 00000000 ____D C:\Users\EUPROCON\AppData\Local\Google
2013-06-20 06:46 - 2013-06-20 06:45 - 00000000 ____D C:\Users\EUPROCON\AppData\Local\Deployment
2013-06-20 06:46 - 2008-01-26 13:01 - 00000000 ____D C:\ProgramData\Google
2013-06-20 06:46 - 2008-01-26 13:01 - 00000000 ____D C:\Program Files\Google
2013-06-20 06:45 - 2013-06-20 06:45 - 00000000 ____D C:\Users\EUPROCON\AppData\Local\Apps\2.0
2013-06-19 05:49 - 2012-12-31 13:00 - 00000000 ____D C:\Windows\System32\Drivers\NIS
2013-06-19 05:36 - 2012-12-31 13:01 - 00142496 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SYMEVENT.SYS
2013-06-19 05:36 - 2012-12-31 13:01 - 00007611 ____A C:\Windows\System32\Drivers\SYMEVENT.CAT
2013-06-14 08:57 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2013-06-14 08:40 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-13 19:51 - 2008-01-26 12:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-13 19:49 - 2006-11-02 11:24 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe
2013-06-12 16:23 - 2013-01-08 08:32 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-12 16:23 - 2013-01-08 08:32 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-12 10:26:31
Restore point made on: 2013-06-13 06:06:36
Restore point made on: 2013-06-13 19:48:08
Restore point made on: 2013-06-14 11:35:45
Restore point made on: 2013-06-17 07:57:18
Restore point made on: 2013-06-19 08:51:06
Restore point made on: 2013-06-20 06:26:03
Restore point made on: 2013-06-20 20:19:08
Restore point made on: 2013-06-21 09:37:51
Restore point made on: 2013-06-24 07:19:33
Restore point made on: 2013-06-25 10:31:32
Restore point made on: 2013-06-26 08:04:29
Restore point made on: 2013-06-27 09:04:46
Restore point made on: 2013-06-28 06:12:34
Restore point made on: 2013-07-01 06:27:09
Restore point made on: 2013-07-01 07:26:45
Restore point made on: 2013-07-02 09:40:45
Restore point made on: 2013-07-03 06:22:52

==================== Memory info =========================== 

Percentage of memory in use: 13%
Total physical RAM: 2045.56 MB
Available physical RAM: 1767.99 MB
Total Pagefile: 1979.2 MB
Available Pagefile: 1831.1 MB
Total Virtual: 2047.88 MB
Available Virtual: 1972.5 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:216 GB) (Free:144.48 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DELL BACKUP) (Fixed) (Total:72.03 GB) (Free:43.5 GB) NTFS
Drive f: (SecureDrive) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive g: (Transcend) (Removable) (Total:14.94 GB) (Free:14.94 GB) FAT32
Drive x: (RECOVERY) (Fixed) (Total:10 GB) (Free:1.78 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 50000000)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=216 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=72 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0B)


LastRegBack: 2013-07-03 11:37

==================== End Of Log ============================