Hallo, ich habe mir ebenfalls diesen Trojaner eingefangen (Windows 7, 64-bit). Habe schon ein wenig im Forum recherchiert und dann die FRST64.exe Datei ausgeführt. Ich füge das Ergebnis unten ein. Kann mir jemand helfen das Problem zu beseitigen bitte? Wäre sehr dankbar für die Hilfe!
Code:
Alles auswählen Aufklappen ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-07-2013 01
Ran by SYSTEM on 12-07-2013 21:00:31
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1861416 2009-10-09] (Synaptics Incorporated)
HKLM\...\Run: [PSUTility] - C:\Program Files\Fujitsu\PSUtility\TrayManager.exe [188264 2009-07-30] (FUJITSU LIMITED)
HKLM\...\Run: [LoadFujitsuQuickTouch] - C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe [157544 2009-10-15] (FUJITSU LIMITED)
HKLM\...\Run: [LoadBtnHnd] - C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe [35176 2009-10-15] (FUJITSU LIMITED)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8312352 2009-10-28] (Realtek Semiconductor)
HKLM\...\Run: [ConMgr] - "C:\Program Files\CSR\Bluetooth Feature Pack 5.0\ConMgr.exe" [535440 2009-12-24] (CSR, plc)
HKLM\...\Run: [CSRSkype] - C:\Program Files\CSR\Bluetooth Feature Pack 5.0\CSRSkype.exe [431504 2009-12-24] (CSR, plc)
HKLM-x32\...\Run: [LoadFUJ02E3] - C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe [36712 2009-10-08] (FUJITSU LIMITED)
HKLM-x32\...\Run: [IndicatorUtility] - C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe [47976 2009-10-09] (FUJITSU LIMITED)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [UCam_Menu] - "C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] - "C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s [162912 2009-07-08] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-09-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AIS_MessageForYou] - "C:\Program Files (x86)\Fujitsu\AIS Connect\bin\AISMessageForYou.exe" [1965056 2010-03-18] (Fujitsu)
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253672 2011-01-07] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [EEventManager] - "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [NetStat Live] - C:\Program Files (x86)\AnalogX\NetStat Live\nsl.exe [184304 2011-10-11] (AnalogX, LLC)
HKLM-x32\...\Run: [HSDPALauncher] - C:\PROGRA~2\HSPAUS~1\HSPALA~1.EXE [217088 2010-09-29] ()
HKLM-x32\...\Run: [Sweetpacks Communicator] - C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe [231768 2012-08-15] (SweetIM Technologies Ltd.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SearchSettings] - "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [1302336 2013-06-07] (Spigot, Inc.)
HKU\Default\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\openpgsvc\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKTray.exe [336560 2010-10-04] (Expert System S.p.A.)
HKU\openpgsvc\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\p1zzer1a\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-05-23] (Google Inc.)
HKU\p1zzer1a\...\Run: [EPSON2481D3 (Epson Stylus SX420W)] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGCE.EXE /FU "C:\Windows\TEMP\E_SE47C.tmp" /EF "HKCU" [238 2013-05-06] () <===== ATTENTION
HKU\p1zzer1a\...\Run: [Desk 365] - "C:\Program Files (x86)\Desk 365\desk365.exe" /autorun [916048 2013-07-02] (337 Technology Limited.)
HKU\p1zzer1a\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\p1zzer1a\AppData\Local\Temp\ppgwewkfopjkestps.exe [46080 2013-07-12] (NVIDIA Corporation) <===== ATTENTION
HKU\p1zzer1a\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\p1zzer1a\...\Command Processor: "C:\Users\p1zzer1a\AppData\Local\Temp\ppgwewkfopjkestps.exe" <===== ATTENTION!
Startup: C:\ProgramData\Start Menu\Programs\Startup\Bitmeter2.lnk
ShortcutTarget: Bitmeter2.lnk -> C:\Program Files (x86)\Codebox\BitMeter\BitMeter2.exe ( )
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (No File)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (No File)
Startup: C:\Users\openpgsvc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files\Fujitsu\LaunchCenter\LaunchCenter.exe (No File)
Startup: C:\Users\p1zzer1a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)
==================== Services (Whitelisted) =================
S2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S2 AISConnect; C:\Program Files (x86)\Fujitsu\AIS Connect\bin\qsaMain.exe [32768 2009-01-26] ()
S2 desksvc; C:\Program Files (x86)\Desk 365\deskSvc.exe [424016 2013-07-02] (337 Technology Limited.)
S2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1447728 2013-05-21] ()
S2 MSSQL$ACROSS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe [126400 2011-08-04] (Symantec Corporation)
S2 openerp-server-6.1; C:\Program Files (x86)\OpenERP 6.1-20120713-233548\Server\service\OpenERPServerService.exe [24064 2012-07-14] ()
S2 pgsql-8.3; C:\Program Files (x86)\OpenERP 6.1-20120713-233548\PostgreSQL\bin\pg_ctl.exe [65536 2008-09-19] (PostgreSQL Global Development Group)
S2 PowerSavingUtilityService; C:\Program Files\Fujitsu\PSUtility\PSUService.exe [63336 2009-07-30] (FUJITSU LIMITED)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
S2 VFPRadioSupportService; C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [145840 2009-12-24] (CSR, plc)
S4 VMCService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-09-11] (Vodafone)
S2 WirelessSelectorService; C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe [62312 2009-07-21] ()
==================== Drivers (Whitelisted) ====================
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130702.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20130702.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [34704 2009-12-24] (CSR, plc)
S1 ccHP; C:\Windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys [593544 2011-08-04] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-29] (Huawei Technologies Co., Ltd.)
S3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED)
S3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130711.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20130711.001\IDSvia64.sys [513184 2012-09-06] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130711.021\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130711.021\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130711.021\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20130711.021\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1109000.00C\SRTSP64.SYS [505392 2010-04-22] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1109000.00C\SRTSPX64.SYS [32304 2010-04-22] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMDS64.SYS [433200 2009-08-30] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NISx64\1109000.00C\SYMEFA64.SYS [221304 2011-08-22] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2011-05-23] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS [150064 2010-04-29] (Symantec Corporation)
S1 SYMTDIv; C:\Windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS [451704 2011-08-22] (Symantec Corporation)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-12 20:58 - 2013-07-12 20:58 - 00000000 ____D C:\FRST
2013-07-12 19:06 - 2013-07-12 19:06 - 01084684 _____ C:\Users\p1zzer1a\AppData\Local\2433f433
2013-07-12 19:06 - 2013-07-12 19:06 - 01084676 _____ C:\ProgramData\2433f433
2013-07-12 19:06 - 2013-07-12 19:06 - 01084663 _____ C:\Users\p1zzer1a\AppData\Roaming\2433f433
2013-07-10 13:20 - 2013-07-10 17:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-07 15:39 - 2013-07-07 15:39 - 00001217 _____ C:\Users\p1zzer1a\Desktop\FileZilla.lnk
2013-07-04 20:13 - 2013-07-04 20:13 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\dvdcss
2013-07-02 15:22 - 2013-07-02 15:22 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-07-02 14:44 - 2013-07-12 19:29 - 00000000 ____D C:\Program Files (x86)\Desk 365
2013-07-02 14:44 - 2013-07-12 13:23 - 00000000 ____D C:\ProgramData\eSafe
2013-07-02 14:44 - 2013-07-10 16:13 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\Desk 365
2013-07-02 14:44 - 2013-07-02 14:44 - 00773712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2013-07-02 14:44 - 2013-07-02 14:43 - 00420944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2013-07-02 14:42 - 2013-07-02 14:42 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\eIntaller
2013-06-26 05:06 - 2013-06-26 05:06 - 00000094 _____ C:\Users\p1zzer1a\Downloads\AVG Certification.txt
2013-06-15 09:16 - 2013-06-15 09:16 - 00000000 ____D C:\Program Files (x86)\YTD Toolbar
2013-06-15 09:16 - 2013-06-15 09:16 - 00000000 ____D C:\Program Files (x86)\Application Updater
==================== One Month Modified Files and Folders =======
2013-07-12 20:58 - 2013-07-12 20:58 - 00000000 ____D C:\FRST
2013-07-12 19:41 - 2011-05-21 21:19 - 01889027 _____ C:\Windows\WindowsUpdate.log
2013-07-12 19:29 - 2013-07-02 14:44 - 00000000 ____D C:\Program Files (x86)\Desk 365
2013-07-12 19:26 - 2011-05-23 07:33 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-12 19:26 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-12 19:26 - 2009-07-14 05:51 - 00234200 _____ C:\Windows\setupact.log
2013-07-12 19:12 - 2012-07-24 16:23 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-12 19:07 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-12 19:07 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-12 19:06 - 2013-07-12 19:06 - 01084684 _____ C:\Users\p1zzer1a\AppData\Local\2433f433
2013-07-12 19:06 - 2013-07-12 19:06 - 01084676 _____ C:\ProgramData\2433f433
2013-07-12 19:06 - 2013-07-12 19:06 - 01084663 _____ C:\Users\p1zzer1a\AppData\Roaming\2433f433
2013-07-12 19:05 - 2011-12-06 08:19 - 00000000 ____D C:\ProgramData\Bitmeter2
2013-07-12 19:01 - 2011-05-23 09:40 - 00000000 ___RD C:\Users\p1zzer1a\Dropbox
2013-07-12 19:01 - 2011-05-23 09:39 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\Dropbox
2013-07-12 16:10 - 2013-05-08 10:12 - 00000000 ____D C:\Users\p1zzer1a\Desktop\fuhrmann
2013-07-12 15:18 - 2011-05-23 07:33 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-12 13:23 - 2013-07-02 14:44 - 00000000 ____D C:\ProgramData\eSafe
2013-07-11 16:19 - 2011-06-08 16:11 - 00011080 _____ C:\Users\p1zzer1a\Documents\Kostenrechnung.xlsx
2013-07-11 16:02 - 2011-05-30 10:59 - 00000000 ____D C:\Program Files (x86)\f4
2013-07-10 18:58 - 2012-07-24 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-10 17:37 - 2013-07-10 13:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-10 16:13 - 2013-07-02 14:44 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\Desk 365
2013-07-10 05:10 - 2010-05-19 14:30 - 00700874 _____ C:\Windows\System32\perfh007.dat
2013-07-10 05:10 - 2010-05-19 14:30 - 00147408 _____ C:\Windows\System32\perfc007.dat
2013-07-10 05:10 - 2009-07-14 06:13 - 01629436 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-09 05:06 - 2011-05-21 14:00 - 00053116 _____ C:\Windows\PFRO.log
2013-07-08 19:36 - 2012-07-24 16:06 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\vlc
2013-07-08 18:34 - 2013-04-05 06:31 - 00000000 ____D C:\Users\p1zzer1a\Desktop\Hey
2013-07-07 15:43 - 2011-09-12 17:03 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\FileZilla
2013-07-07 15:39 - 2013-07-07 15:39 - 00001217 _____ C:\Users\p1zzer1a\Desktop\FileZilla.lnk
2013-07-04 20:13 - 2013-07-04 20:13 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\dvdcss
2013-07-02 15:22 - 2013-07-02 15:22 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-07-02 14:44 - 2013-07-02 14:44 - 00773712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2013-07-02 14:43 - 2013-07-02 14:44 - 00420944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2013-07-02 14:42 - 2013-07-02 14:42 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\eIntaller
2013-07-02 11:49 - 2012-11-10 07:56 - 00000000 ____D C:\ProgramData\SweetIM
2013-07-02 11:49 - 2012-11-10 07:56 - 00000000 ____D C:\Program Files (x86)\SweetIM
2013-07-02 11:49 - 2011-05-21 14:03 - 00000000 ____D C:\Users\p1zzer1a\AppData\Local\Google
2013-07-01 09:36 - 2012-02-12 07:28 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software
2013-06-27 17:13 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-26 05:06 - 2013-06-26 05:06 - 00000094 _____ C:\Users\p1zzer1a\Downloads\AVG Certification.txt
2013-06-24 14:54 - 2013-05-09 08:03 - 00000000 ____D C:\Users\p1zzer1a\Desktop\B. Voigt
2013-06-23 13:34 - 2011-09-10 15:31 - 00000000 ____D C:\Users\p1zzer1a\AppData\Roaming\Skype
2013-06-21 05:37 - 2013-06-03 04:34 - 00000000 ____D C:\Windows\SysWOW64\WNLT
2013-06-15 09:16 - 2013-06-15 09:16 - 00000000 ____D C:\Program Files (x86)\YTD Toolbar
2013-06-15 09:16 - 2013-06-15 09:16 - 00000000 ____D C:\Program Files (x86)\Application Updater
2013-06-12 06:12 - 2012-07-24 16:23 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 06:12 - 2012-07-24 16:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-12 06:12 - 2012-07-24 16:23 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
==================== Memory info ===========================
Percentage of memory in use: 16%
Total physical RAM: 3956.57 MB
Available physical RAM: 3311.71 MB
Total Pagefile: 3954.71 MB
Available Pagefile: 3309.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:100 GB) (Free:8.89 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:196.08 GB) (Free:59.58 GB) NTFS (Disk=0 Partition=3)
Drive e: (WINRE) (Fixed) (Total:2 GB) (Free:1.38 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
Drive f: (AMERICAN_GANGSTER) (CDROM) (Total:7.62 GB) (Free:0 GB) UDF
Drive g: () (Removable) (Total:0.98 GB) (Free:0.97 GB) FAT (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.13 GB) (Free:0.12 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8E760A6D)
Partition 1: (Active) - (Size=2 GB) - (Type=27)
Partition 2: (Not Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=196 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 999 MB) (Disk ID: 004DE9DC)
Partition 1: (Active) - (Size=999 MB) - (Type=06)
LastRegBack: 2013-07-08 11:29
==================== End Of Log ============================