BKA Trojaner, Abgesicherter Modus funktioniert eingeschränkt

markusg · 09.07.2013, 01:16

Hi,
Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Benwick · 09.07.2013, 02:25

Das ist das Log. Er behauptet allerdings, dass ein verzeichnis "WPDNSE" im Temp Ordner "unreadable" wäre.

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-07-2013
Ran by SYSTEM on 09-07-2013 03:15:43
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDWare] %ProgramFiles%\Elantech\ETDCtrl.exe [2703752 2010-03-25] (ELAN Microelectronics Corp.)
HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4156 2010-04-16] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [500208 2010-03-05] (Adobe Systems Incorporated)
HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2399632 2011-04-13] (Microsoft Corporation)
HKLM\...\Run: [SpywareTerminatorShield] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [x]
HKLM\...\Run: [SpywareTerminatorUpdater] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [x]
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: []  [x]
HKU\******\...\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe [3666944 2011-01-06] ()
HKU\******\...\Run: [HP Deskjet 3050A J611 series (NET)] "C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN1AJ480VF05PJ:NW" -scfn "HP Deskjet 3050A J611 series (NET)" -AutoStart 1 [2573416 2012-10-16] (Hewlett-Packard Co.)
HKU\******\...\Winlogon: [Shell] explorer.exe,C:\Users\******\AppData\Roaming\skype.dat [52736 2011-11-16] () <==== ATTENTION 
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3050A J611 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3050A J611 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3050A J611 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-08] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-08] (Avira Operations GmbH & Co. KG)
S2 HPSLPSVC; C:\Users\******\AppData\Local\Temp\7zS57E4\hpslpsvc64.dll [1039360 2013-02-06] (Hewlett-Packard Co.)
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S4 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
S4 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1328736 2012-09-24] (Secunia)
S4 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [656480 2012-09-24] (Secunia)
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [x]

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-08] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-08] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-12-15] (Avira GmbH)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [270912 2011-11-09] (DT Soft Ltd)
S0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-03-22] (GFI Software)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2011-02-20] (Windows (R) 2003 DDK 3790 provider)
S3 rtport; C:\Windows\SysWOW64\drivers\rtport.sys [15144 2011-02-20] (Windows (R) 2003 DDK 3790 provider)
S2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [142120 2007-04-26] (SafeNet, Inc.)
S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13832 2010-04-16] ()
S1 Aspi32; No ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 3D07F9C090C7A1D76D624972A5384471
C:\Windows\System32\DRIVERS\atikmpag.sys 99AB7E4B24C80155DC4296F657FAF3C7
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athrx.sys 3D68A1EEF77307142636AF5127990BCB
C:\Windows\System32\drivers\AtiHdmi.sys 77C149E6D702737B2E372DEE166FAEF8
C:\Windows\System32\DRIVERS\avgntflt.sys 26E38B5A58C6C55FAFBC563EEDDB0867
C:\Windows\System32\DRIVERS\avipbb.sys 9D1F00BEFF84CBBF46D7F052BC7E0565
C:\Windows\System32\DRIVERS\avkmgr.sys 248DB59FC86DE44D2779F4C7FB1A567D
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\BthEnum.sys CF98190A94F62E405C8CB255018B2315
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys 02DD601B708DD0667E1331FA8518E9FF
C:\Windows\System32\Drivers\BTHport.sys 738D0E9272F59EB7A1449C3EC118E6C4
C:\Windows\System32\Drivers\BTHUSB.sys F188B7394D81010767B6DF3178519A37
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys AAFCB52FE0037207FB6FBEA070D25EFE
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dtsoftbus01.sys D3D64CF7B2BCEAA34A270F45A3FFFB36
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ETD.sys 438021C3F32F30E227D0F5DFD118B7B1
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys 8E98D21EE06192492A5671A6144D092F
C:\Windows\System32\drivers\gfibto.sys 14908F4F9005C29DE8F5587E271390EE
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys A5F72BB0D024E7E463344105BE613AE4
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Impcd.sys DD587A55390ED2295BCE6D36AD567DA9
C:\Windows\System32\drivers\RTKVHD64.sys 0ADF714079AE174A39D69036143E4C50
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 7EFB9333E4ECCE6AE4AE9D777D9E553E
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mbam.sys 92EB844D90615CB266F84C3202B8786E
C:\Windows\system32\drivers\mbam.sys 92EB844D90615CB266F84C3202B8786E
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\point64.sys 33328FA8A580885AB0065BE6DB266E9F
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\psi_mf.sys FB46E9A827A8799EBD7BFA9128C91F37
C:\Windows\System32\Drivers\PxHlpa64.sys 87B04878A6D59D6C79251DC960C674C1
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys 3DD798846E2C28102B922C56E71B7932
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt64win7.sys BAEFEE35D27A5440D35092CE10267BEC
C:\Windows\SysWOW64\drivers\rtport.sys 4CA0DBA9E224473D664C25E411F5A3BD
C:\Windows\SysWOW64\drivers\rtport.sys 4CA0DBA9E224473D664C25E411F5A3BD
C:\Windows\system32\Drivers\SABI.sys 62DB6CC4B0818F1B5F3441241B098F12
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Sentinel64.sys 84AC127242DD3CCDE02F9A4673214B1F
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serscan.sys DECACB6921DED1A38642642685D77DAC
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Tpkd.sys 8DD33A57339ADAE34CDB12994ACBC50F
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys 17C6B51CBCCDED95B3CC14E22791F85E
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\TurboB.sys B355581A9DA34C92E2DBAFA410D2F829
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl64.sys C9E9D59C0099A9FF51697E9306A44240
C:\Windows\System32\drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\DRIVERS\VBoxNetAdp.sys B0A8C5BC95689A130F9E05492341833D
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wacommousefilter.sys E04D43C7D1641E95D35CAE6086C7E350
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wacomvhid.sys EC1CEB237E365330C1FCFC4876AA0AC0
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\System32\DRIVERS\yk62x64.sys E1E858AEF2ED420CBB7605D3ECCEC69A

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-09 03:05 - 2013-07-09 03:05 - 00000000 ____D C:\FRST
2013-07-08 15:02 - 2013-07-08 15:06 - 00000004 ____A C:\Users\******\AppData\Roaming\skype.ini
2013-07-04 03:24 - 2013-07-04 03:24 - 00202456 ____A C:\Users\******\Downloads\Bachelorarbeit_Vorlage_Fakultaet-Medien(1).dotx
2013-07-03 05:08 - 2013-07-03 05:08 - 45475825 ____A C:\Users\******\Downloads\videotraining-videofile-22594.mp4
2013-07-01 04:04 - 2013-07-01 04:04 - 57525143 ____A C:\Users\******\Downloads\Sample.psd.zip
2013-07-01 04:03 - 2013-07-01 04:04 - 64957291 ____A C:\Users\******\Downloads\man.psd.zip
2013-06-28 06:03 - 2013-06-28 06:03 - 00000624 ____A C:\Windows\PFRO.log
2013-06-27 15:41 - 2013-06-27 15:41 - 00000112 ____A C:\Users\******\Desktop\mofa.txt
2013-06-25 13:11 - 2012-11-06 10:09 - 62715153 ____A C:\Users\******\Downloads\tshirt_mock_up.psd
2013-06-25 13:11 - 2012-10-28 14:33 - 65691697 ____A C:\Users\******\Downloads\bag_mock_up.psd
2013-06-25 10:21 - 2013-06-25 13:10 - 501376684 ____A C:\Users\******\Downloads\3357570-corporate-and-brand-identity-mockup.zip
2013-06-25 07:13 - 2013-06-26 01:38 - 02366016 ____A C:\Users\******\Downloads\SMM001.rar.part
2013-06-25 07:13 - 2013-06-25 07:13 - 00000000 ____A C:\Users\******\Downloads\SMM001.rar
2013-06-25 07:12 - 2013-06-25 07:12 - 01051961 ____A C:\Users\******\Downloads\poster_mockup_template_by_pixelentity.zip
2013-06-25 07:09 - 2013-06-25 07:10 - 23290472 ____A C:\Users\******\Downloads\gfxmaster-2571862-corporatebusiness-stationery-mockupgfx.rar
2013-06-25 07:04 - 2013-06-25 07:11 - 19183594 ____A C:\Users\******\Downloads\C8_business-brand-corporate-identity.rar
2013-06-25 06:55 - 2013-06-25 06:55 - 00456158 ____A C:\Users\******\Downloads\Corporate-Identity-Mockup.zip
2013-06-25 06:47 - 2013-06-25 06:47 - 14849282 ____A C:\Users\******\Downloads\iPhone-5-Front-View-Mock-Up.zip
2013-06-25 06:46 - 2013-06-25 06:46 - 51341372 ____A C:\Users\******\Downloads\Realistic-Business-Card-Mock-Up1.zip
2013-06-25 06:46 - 2013-06-25 06:46 - 21956963 ____A C:\Users\******\Downloads\Gold-Stamping-Logo-Mock-Up.zip
2013-06-25 06:45 - 2013-06-25 06:46 - 10760796 ____A C:\Users\******\Downloads\Branding-Identity-Mock-Up-Vol2.zip
2013-06-25 06:42 - 2013-06-25 06:42 - 11205050 ____A C:\Users\******\Downloads\Stack-Business-Card-Mock-Up.zip
2013-06-25 06:42 - 2013-06-25 06:42 - 08405655 ____A C:\Users\******\Downloads\DVD-Envelope-Mock-Up.zip
2013-06-25 06:41 - 2013-06-25 06:41 - 06218088 ____A C:\Users\******\Downloads\Branding-Identity-Mock-Up.zip
2013-06-25 06:40 - 2013-06-25 06:40 - 02680394 ____A C:\Users\******\Downloads\iPhone5-iOS7-Mockup.zip
2013-06-25 06:38 - 2013-06-25 06:39 - 08790650 ____A C:\Users\******\Downloads\Thunderbolt-Display-big.psd.zip
2013-06-25 06:38 - 2013-06-25 06:38 - 08852367 ____A C:\Users\******\Downloads\MacBook-air-big.psd.zip
2013-06-25 06:38 - 2013-06-25 06:38 - 00429686 ____A C:\Users\******\Downloads\Smartphones.psd
2013-06-25 06:37 - 2013-06-25 06:37 - 09464766 ____A C:\Users\******\Downloads\simple-card.psd
2013-06-25 06:37 - 2013-06-25 06:37 - 00296074 ____A C:\Users\******\Downloads\all-devices.psd
2013-06-25 06:36 - 2013-06-25 06:38 - 09688752 ____A C:\Users\******\Downloads\Display_psd.psd.zip
2013-06-25 06:35 - 2013-06-25 06:35 - 00543180 ____A C:\Users\******\Downloads\Mockup.psd
2013-06-25 06:34 - 2013-06-25 06:34 - 01336591 ____A C:\Users\******\Downloads\iPad-Flat-Mockup-PIXEDEN.zip
2013-06-25 06:34 - 2013-06-25 06:34 - 00634154 ____A C:\Users\******\Downloads\Flat-Browsers-Set-PIXEDEN.zip
2013-06-25 06:34 - 2013-06-25 06:34 - 00546580 ____A C:\Users\******\Downloads\iMac-and-Macbook-Flat-Mockup-PIXEDEN.zip
2013-06-25 06:28 - 2013-06-25 06:28 - 14479304 ____A C:\Users\******\Downloads\motion_template_by_begha_by_begha-d6absfa.zip
2013-06-25 06:28 - 2013-06-25 06:28 - 09761690 ____A C:\Users\******\Downloads\iPad-White-Angle.psd
2013-06-25 06:27 - 2013-06-25 06:27 - 07306406 ____A C:\Users\******\Downloads\iphone-mockup-white.psd
2013-06-25 01:09 - 2013-06-25 01:09 - 00001205 ____A C:\Users\******\Downloads\download-downloadfile-26830.zip
2013-06-17 10:07 - 2013-06-19 01:05 - 00000188 ____A C:\Users\******\Desktop\hurricane.txt
2013-06-17 07:34 - 2013-06-17 07:34 - 41805696 ____A C:\Users\******\Downloads\videotraining-videofile-23068.mp4
2013-06-15 05:24 - 2013-06-08 06:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-15 05:24 - 2013-06-08 06:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-15 05:24 - 2013-06-08 06:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-15 05:24 - 2013-06-08 06:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-15 05:24 - 2013-06-08 06:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-15 05:24 - 2013-06-08 04:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-15 05:24 - 2013-06-08 03:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-15 05:24 - 2013-06-08 03:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-15 05:24 - 2013-06-08 03:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-15 05:24 - 2013-06-08 03:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-15 05:24 - 2013-06-08 03:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-15 05:24 - 2013-06-08 03:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-14 07:37 - 2013-06-14 07:37 - 29996308 ____A C:\Users\******\Desktop\01 Backstreet Boys - Everybody VMAs.wav
2013-06-12 16:13 - 2013-05-16 17:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 16:13 - 2013-05-16 17:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 16:13 - 2013-05-16 17:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 16:13 - 2013-05-16 17:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 16:13 - 2013-05-16 17:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 16:13 - 2013-05-16 17:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 16:13 - 2013-05-16 17:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 16:13 - 2013-05-16 17:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 16:13 - 2013-05-16 16:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 16:13 - 2013-05-16 16:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 16:13 - 2013-05-16 16:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 16:13 - 2013-05-16 16:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 16:13 - 2013-05-16 16:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 16:13 - 2013-05-16 16:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 16:13 - 2013-05-16 16:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 16:13 - 2013-05-16 16:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 16:13 - 2013-05-16 16:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 16:13 - 2013-05-14 04:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 16:13 - 2013-05-14 00:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 15:48 - 2013-06-12 15:48 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-12 15:48 - 2013-06-12 15:48 - 00000000 ____D C:\Program Files\iTunes
2013-06-12 15:48 - 2013-06-12 15:48 - 00000000 ____D C:\Program Files\iPod
2013-06-12 09:06 - 2013-05-12 21:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 09:06 - 2013-05-12 21:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 09:06 - 2013-05-12 21:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 09:06 - 2013-05-12 21:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 09:06 - 2013-05-12 20:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 09:06 - 2013-05-12 20:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 09:06 - 2013-05-12 20:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 09:06 - 2013-05-12 19:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 09:06 - 2013-05-12 19:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 09:06 - 2013-05-12 19:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 09:06 - 2013-05-09 21:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 09:06 - 2013-05-09 19:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 09:06 - 2013-05-07 22:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 09:06 - 2013-04-25 21:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 09:06 - 2013-04-25 20:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 09:06 - 2013-04-25 15:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 09:06 - 2013-04-16 23:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 09:06 - 2013-04-16 22:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 09:06 - 2013-03-31 14:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-11 12:04 - 2013-06-11 12:04 - 00328401 ____A C:\Users\******\Downloads\gniffel.zip
2013-06-10 05:23 - 2013-06-10 05:23 - 25782688 ____A C:\Users\******\Downloads\im_wunderschoenen_Monat_Mai.wav

==================== One Month Modified Files and Folders =======

2013-07-09 03:05 - 2013-07-09 03:05 - 00000000 ____D C:\FRST
2013-07-08 15:39 - 2013-03-22 17:31 - 00022800 ____A C:\Windows\setupact.log
2013-07-08 15:39 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-08 15:06 - 2013-07-08 15:02 - 00000004 ____A C:\Users\******\AppData\Roaming\skype.ini
2013-07-08 15:06 - 2011-06-22 10:14 - 00000000 ____D C:\Users\******\.rainlendar2
2013-07-08 15:05 - 2012-03-30 16:59 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-08 15:02 - 2012-03-30 16:59 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-08 14:38 - 2013-02-28 12:33 - 00000932 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2806026202-95748070-3344758458-1000UA.job
2013-07-08 14:37 - 2010-11-24 11:40 - 00654400 ____A C:\Windows\System32\perfh007.dat
2013-07-08 14:37 - 2010-11-24 11:40 - 00130240 ____A C:\Windows\System32\perfc007.dat
2013-07-08 14:37 - 2009-07-13 21:13 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-08 14:32 - 2010-11-23 18:09 - 01053054 ____A C:\Windows\WindowsUpdate.log
2013-07-08 14:31 - 2012-09-19 05:58 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-08 12:39 - 2013-02-28 12:33 - 00000910 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2806026202-95748070-3344758458-1000Core.job
2013-07-07 15:11 - 2011-09-29 04:35 - 00000000 ____D C:\Users\******\AppData\Roaming\vlc
2013-07-07 13:43 - 2011-10-10 13:12 - 00000000 ____D C:\Users\******\AppData\Local\Last.fm
2013-07-06 06:52 - 2013-03-10 07:34 - 00000000 ____D C:\Users\******\Documents\Youcam
2013-07-04 22:30 - 2009-07-13 20:45 - 00013936 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-04 22:30 - 2009-07-13 20:45 - 00013936 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-04 22:24 - 2013-03-09 03:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-04 22:24 - 2012-04-24 22:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-04 22:23 - 2011-10-16 13:10 - 00000000 ___RD C:\Users\******\Dropbox
2013-07-04 22:23 - 2011-10-16 13:08 - 00000000 ____D C:\Users\******\AppData\Roaming\Dropbox
2013-07-04 03:24 - 2013-07-04 03:24 - 00202456 ____A C:\Users\******\Downloads\Bachelorarbeit_Vorlage_Fakultaet-Medien(1).dotx
2013-07-03 15:37 - 2012-09-24 00:03 - 00000090 ____A C:\Users\******\Documents\Powers.log
2013-07-03 05:08 - 2013-07-03 05:08 - 45475825 ____A C:\Users\******\Downloads\videotraining-videofile-22594.mp4
2013-07-01 04:04 - 2013-07-01 04:04 - 57525143 ____A C:\Users\******\Downloads\Sample.psd.zip
2013-07-01 04:04 - 2013-07-01 04:03 - 64957291 ____A C:\Users\******\Downloads\man.psd.zip
2013-06-28 06:03 - 2013-06-28 06:03 - 00000624 ____A C:\Windows\PFRO.log
2013-06-27 15:41 - 2013-06-27 15:41 - 00000112 ____A C:\Users\******\Desktop\mofa.txt
2013-06-26 01:38 - 2013-06-25 07:13 - 02366016 ____A C:\Users\******\Downloads\SMM001.rar.part
2013-06-25 07:13 - 2013-06-25 07:13 - 00000000 ____A C:\Users\******\Downloads\SMM001.rar
2013-06-25 07:12 - 2013-06-25 07:12 - 01051961 ____A C:\Users\******\Downloads\poster_mockup_template_by_pixelentity.zip
2013-06-25 07:11 - 2013-06-25 07:04 - 19183594 ____A C:\Users\******\Downloads\C8_business-brand-corporate-identity.rar
2013-06-25 07:10 - 2013-06-25 07:09 - 23290472 ____A C:\Users\******\Downloads\gfxmaster-2571862-corporatebusiness-stationery-mockupgfx.rar
2013-06-25 06:55 - 2013-06-25 06:55 - 00456158 ____A C:\Users\******\Downloads\Corporate-Identity-Mockup.zip
2013-06-25 06:47 - 2013-06-25 06:47 - 14849282 ____A C:\Users\******\Downloads\iPhone-5-Front-View-Mock-Up.zip
2013-06-25 06:46 - 2013-06-25 06:46 - 51341372 ____A C:\Users\******\Downloads\Realistic-Business-Card-Mock-Up1.zip
2013-06-25 06:46 - 2013-06-25 06:46 - 21956963 ____A C:\Users\******\Downloads\Gold-Stamping-Logo-Mock-Up.zip
2013-06-25 06:46 - 2013-06-25 06:45 - 10760796 ____A C:\Users\******\Downloads\Branding-Identity-Mock-Up-Vol2.zip
2013-06-25 06:42 - 2013-06-25 06:42 - 11205050 ____A C:\Users\******\Downloads\Stack-Business-Card-Mock-Up.zip
2013-06-25 06:42 - 2013-06-25 06:42 - 08405655 ____A C:\Users\******\Downloads\DVD-Envelope-Mock-Up.zip
2013-06-25 06:41 - 2013-06-25 06:41 - 06218088 ____A C:\Users\******\Downloads\Branding-Identity-Mock-Up.zip
2013-06-25 06:40 - 2013-06-25 06:40 - 02680394 ____A C:\Users\******\Downloads\iPhone5-iOS7-Mockup.zip
2013-06-25 06:39 - 2013-06-25 06:38 - 08790650 ____A C:\Users\******\Downloads\Thunderbolt-Display-big.psd.zip
2013-06-25 06:38 - 2013-06-25 06:38 - 08852367 ____A C:\Users\******\Downloads\MacBook-air-big.psd.zip
2013-06-25 06:38 - 2013-06-25 06:38 - 00429686 ____A C:\Users\******\Downloads\Smartphones.psd
2013-06-25 06:38 - 2013-06-25 06:36 - 09688752 ____A C:\Users\******\Downloads\Display_psd.psd.zip
2013-06-25 06:37 - 2013-06-25 06:37 - 09464766 ____A C:\Users\******\Downloads\simple-card.psd
2013-06-25 06:37 - 2013-06-25 06:37 - 00296074 ____A C:\Users\******\Downloads\all-devices.psd
2013-06-25 06:35 - 2013-06-25 06:35 - 00543180 ____A C:\Users\******\Downloads\Mockup.psd
2013-06-25 06:34 - 2013-06-25 06:34 - 01336591 ____A C:\Users\******\Downloads\iPad-Flat-Mockup-PIXEDEN.zip
2013-06-25 06:34 - 2013-06-25 06:34 - 00634154 ____A C:\Users\******\Downloads\Flat-Browsers-Set-PIXEDEN.zip
2013-06-25 06:34 - 2013-06-25 06:34 - 00546580 ____A C:\Users\******\Downloads\iMac-and-Macbook-Flat-Mockup-PIXEDEN.zip
2013-06-25 06:28 - 2013-06-25 06:28 - 14479304 ____A C:\Users\******\Downloads\motion_template_by_begha_by_begha-d6absfa.zip
2013-06-25 06:28 - 2013-06-25 06:28 - 09761690 ____A C:\Users\******\Downloads\iPad-White-Angle.psd
2013-06-25 06:27 - 2013-06-25 06:27 - 07306406 ____A C:\Users\******\Downloads\iphone-mockup-white.psd
2013-06-25 01:09 - 2013-06-25 01:09 - 00001205 ____A C:\Users\******\Downloads\download-downloadfile-26830.zip
2013-06-19 01:05 - 2013-06-17 10:07 - 00000188 ____A C:\Users\******\Desktop\hurricane.txt
2013-06-17 07:34 - 2013-06-17 07:34 - 41805696 ____A C:\Users\******\Downloads\videotraining-videofile-23068.mp4
2013-06-14 07:38 - 2011-06-25 05:17 - 00000000 ____D C:\Users\******\AppData\Roaming\Audacity
2013-06-14 07:37 - 2013-06-14 07:37 - 29996308 ____A C:\Users\******\Desktop\01 Backstreet Boys - Everybody VMAs.wav
2013-06-14 02:38 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2013-06-13 03:11 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-06-12 16:14 - 2011-06-17 09:23 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 15:48 - 2013-06-12 15:48 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-12 15:48 - 2013-06-12 15:48 - 00000000 ____D C:\Program Files\iTunes
2013-06-12 15:48 - 2013-06-12 15:48 - 00000000 ____D C:\Program Files\iPod
2013-06-12 15:48 - 2011-08-06 08:22 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-06-12 15:44 - 2012-12-01 17:12 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-12 05:31 - 2012-09-19 05:58 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 05:31 - 2012-09-19 05:58 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 12:04 - 2013-06-11 12:04 - 00328401 ____A C:\Users\******\Downloads\gniffel.zip
2013-06-10 05:23 - 2013-06-10 05:23 - 25782688 ____A C:\Users\******\Downloads\im_wunderschoenen_Monat_Mai.wav

Files to move or delete:
====================
C:\Users\******\AppData\Roaming\skype.dat
C:\Users\******\AppData\Roaming\skype.ini

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-06-15 05:24:37
Restore point made on: 2013-06-24 10:06:13
Restore point made on: 2013-06-28 06:09:36
Restore point made on: 2013-07-02 01:20:58

==================== BCD ================================

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=Y:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {default}
resumeobject            {2089195e-f805-11df-95c5-002454b0048b}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {2089195e-f805-11df-95c5-002454b0048b}
nx                      OptIn
numproc                 4

Windows Boot Loader
-------------------
identifier              {current}
device                  ramdisk=[C:]\Recovery\20891960-f805-11df-95c5-002454b0048b\Winre.wim,{20891961-f805-11df-95c5-002454b0048b}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\20891960-f805-11df-95c5-002454b0048b\Winre.wim,{20891961-f805-11df-95c5-002454b0048b}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {2089195e-f805-11df-95c5-002454b0048b}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=Y:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 Yes

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {20891961-f805-11df-95c5-002454b0048b}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\20891960-f805-11df-95c5-002454b0048b\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 16%
Total physical RAM: 3946.16 MB
Available physical RAM: 3277.8 MB
Total Pagefile: 3944.31 MB
Available Pagefile: 3269.67 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:246 GB) (Free:81.53 GB) NTFS (Disk=0 Partition=3)
Drive d: () (Fixed) (Total:175.25 GB) (Free:8.76 GB) NTFS (Disk=0 Partition=4)
Drive f: (RECOVERY) (Fixed) (Total:20 GB) (Free:2.64 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
Drive h: (Spaceloop) (Removable) (Total:29.79 GB) (Free:19.11 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 02FC8BF3)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=246 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=200 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 30 GB) (Disk ID: 00000000)
Partition 1: (Active) - (Size=30 GB) - (Type=06)


LastRegBack: 2013-07-03 03:33

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

BKA Trojaner, Abgesicherter Modus funktioniert eingeschränkt

Plagegeister aller Art und deren Bekämpfung: BKA Trojaner, Abgesicherter Modus funktioniert eingeschränkt

BKA Trojaner, Abgesicherter Modus funktioniert eingeschränkt

BKA Trojaner, Abgesicherter Modus funktioniert eingeschränkt

Ähnliche Themen: BKA Trojaner, Abgesicherter Modus funktioniert eingeschränkt