Viele Trojaner im System: Kitana-134/Win32:Crypt -Buzus -Banker -...

garfield01 · 23.07.2013, 18:55

Hallo zusammen

System Win 7 64Bit
AntiVir: avast Free Antivirus aktuelleste version

Hat gestern plötzlich zum ersten mal Meldung gemacht, wegen Virus. Wollte neustarten zum entfernen. Wurde durchgeführt. Hat dann vor WIndows start Dateien durchsucht, viel gefunden. Avast hatte keine Rechte die Dateien zu löschen, reparieren oder sonstwas zu tun. Ging nichts, also in Win7 rein.
Nach erneutem system scan mit avast 1059 invizierte Dateien....

Die Trojaner/Viren sind jetzt auch sehr aktiv. z.B. Spybot S&D kann nicht mehr installiert werden. notepad++läßt sich nicht mehr starten.
Selbst auf der Seite hier kann ich keine Posts erstellen wenn ich auch VOrschau oder Thema erstellen klicke kommt: "Die Verbindung zum Server wurde zurückgesetzt, während die Seite geladen wurde."

Momentan läuft noch der Microsoft Safety Scanner 1.0.3001.1.0 (durch google drauf gestoßen)

Kaspersky TDSS Killer hab ich auch mal runtergeladen, ist noch in wartestellung bis safety scanner fertig.

--> Kann mir jemand weiterhelfen und sagen ob da noch rettung besteht oder nur noch neuinstall in frage kommt ?
Vielen Dank
______________________________________________________________________________________________________________________________________________________ ________________________________________________________________________________

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 19:29:28, on 23.07.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16635)
CHROME: 28.0.1500.72
FIREFOX: 22.0 (de)
Boot mode: Normal

Running processes:
C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\Zoom\TpScrex.exe
C:\Program Files\TPFanControl\TPFanControl.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Users\garfield\Downloads\tdsskiller.exe
C:\Users\garfield\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:21320
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Startup: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll
O22 - SharedTaskScheduler: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll
O23 - Service: AAV UpdateService - Unknown owner - C:\Program Files (x86)\AAVUpdateManager\aavus.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Lenovo Doze Mode Service (DozeSvc) - Lenovo. - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V5 Service4(04) (EPSON_EB_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
O23 - Service: EPSON V3 Service4(04) (EPSON_PM_RPCV4_04) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update-Dienst (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: Autodesk Moldflow Inventor Tool Suite Integration 2012 Job-Manager (mitsijm2012) - Autodesk, Inc. - C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PDF Architect Helper Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\HelperService.exe
O23 - Service: PDF Architect Service - pdfforge GbR - C:\Program Files (x86)\PDF Architect\ConversionService.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cisco EnergyWise Enabler (PwmEWSvc) - Lenovo Group Limited - C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Unknown owner - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (file missing)
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Unknown owner - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (file missing)
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\Windows\System32\TPHDEXLG64.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: Anzeige am Bildschirm (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13495 bytes

______________________________________________________________________________________________________________________________________________________ _________________________________________________________________________________

schrauber · 23.07.2013, 19:23

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

garfield01 · 23.07.2013, 20:42

Hi schrauber

vielen Dank für deine schnelle antwort
zwischenzeitlich lief der TDSS Killer
Ergebnis:
Event------------------------- Objet
Suspicious-------------------------sptd (LockedFile.Multi.Generic)
Copied to quarantine-----------------C:\Windows\system32\Drivers\sptd.sys
Will be deleted after reboot----------HKLM\SYSTEM\ControlSet001\services\sptd
Will be deleted after reboot----------HKLM\SYSTEM\ControlSet002\services\sptd
Will be deleted after reboot----------C:\Windows\system32\Drivers\sptd.sys

FRST.txt

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by garfield (administrator) on 23-07-2013 20:36:24
Running from C:\Users\garfield\Desktop\Trojaner entfernen
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Lenovo) C:\Windows\system32\ibmpmsvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
() C:\Program Files (x86)\AAVUpdateManager\aavus.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Lenovo Group Limited) C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Zoom\TpScrex.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(troubadix) C:\Program Files\TPFanControl\TPFanControl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [222720 2012-06-21] (Lenovo.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [245760 2009-09-09] (Alps Electric Co., Ltd.)
HKLM\...\Run: [TPFanControl] - C:\Program Files\TPFanControl\TPFanControl.exe [153600 2012-06-07] (troubadix)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
MountPoints2: {42bfa07a-cac9-11e2-a859-001fe1d30877} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Paragon-128-PRG_WinInstallSN_9.0.99.9293_000_32BIT.msi
MountPoints2: {42bfa07c-cac9-11e2-a859-001fe1d30877} - H:\Launch.exe
MountPoints2: {d11c871d-7142-11e2-81c2-001fe1d30877} - I:\LGAutoRun.exe
HKLM-x32\...\Run: [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [PWMTRV] - rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor [x]
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [3830224 2013-05-16] (Safer-Networking Ltd.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: localhost:21320
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=15000
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKCU - {c99fdc39-a1ae-4b24-8d71-e5274f8d7c54} URL = hxxp://search.hotspotshield.com/g/results.php?c=s&q={searchTerms}
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKLM-x32 - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://search.sweetim.com/search.asp?src=2&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\garfield\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\garfield\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\searchplugins\sweetim.xml
FF Extension: Visualisateur 3D de 20-20 - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\2020Player_IKEA@2020Technologies.com
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\DTToolbar@toolbarnet.com
FF Extension: FoxyProxy Basic - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\foxyproxy@eric.h.jung
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\ich@maltegoetz.de
FF Extension: Tradesignal Online Chart - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{1acd747e-8470-11db-96a9-00e08161165f}
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Extension: (SweetIM for Facebook) - C:\Users\garfield\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.1.0.1_0
CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\garfield\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-05-16] (Lenovo.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 mitsijm2012; C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [848184 2010-12-08] (Autodesk, Inc.)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-06-26] ()
S4 ApRunSvc; C:\Program Files\Apoint2K\ApRunSvc.exe [x]
S2 SDScannerService; "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" [x]
S2 SDUpdateService; "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2012-07-03] (Google Inc)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
S3 andnetndis; C:\Windows\System32\DRIVERS\lgandnetndis64.sys [93184 2012-07-04] (LG Electronics Inc.)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-07-03] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-07] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-07] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-07] ()
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R3 CnxtHdAudService; C:\Windows\System32\drivers\CHDRTN64.sys [683008 2009-06-22] (Conexant Systems Inc.)
R2 cpuz133; C:\Windows\system32\drivers\cpuz133_x64.sys [20456 2010-03-10] (Windows (R) Win 7 DDK provider)
S3 DSO3064; C:\Windows\System32\Drivers\DSO3064AMD64.SYS [22720 2011-05-13] (Hantek)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2009-08-26] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2009-08-26] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2009-09-16] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2009-09-16] ()
S3 PulseUsb; C:\Windows\System32\DRIVERS\PulseUsb.sys [26112 2011-10-28] (Windows (R) Win 7 DDK provider)
R2 smihlp2; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [254976 2010-08-31] (Jungo)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
S0 xepqmvli; system32\drivers\wrdvkqat.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-23 20:36 - 2013-07-23 20:36 - 00000000 ____D C:\FRST
2013-07-23 20:23 - 2013-07-23 20:23 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-23 20:08 - 2013-07-23 20:08 - 00135168 _____ C:\zip.exe
2013-07-23 20:08 - 2013-07-23 20:08 - 00061440 _____ C:\Windows\SysWOW64\Drivers\wrdvkqat.sys
2013-07-23 20:08 - 2013-07-23 20:08 - 00001022 _____ C:\Windows\SysWOW64\stmj.txt
2013-07-23 20:08 - 2013-07-23 20:08 - 00000883 _____ C:\backup.reg
2013-07-23 20:08 - 2013-07-23 20:08 - 00000574 _____ C:\cleanup.bat
2013-07-23 20:03 - 2013-07-23 20:36 - 00000000 ____D C:\Users\garfield\Desktop\Trojaner entfernen
2013-07-23 19:29 - 2013-07-23 19:29 - 00003138 _____ C:\Windows\System32\Tasks\{D2724CC8-253D-40AA-9A8E-235F2FDA8A96}
2013-07-23 19:14 - 2013-07-23 19:22 - 88691472 _____ (Microsoft Corporation) C:\Users\garfield\Downloads\msert.exe
2013-07-23 18:57 - 2013-07-23 18:57 - 00001164 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-07-23 18:57 - 2013-07-23 18:57 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-23 18:57 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-07-23 18:55 - 2013-07-23 18:57 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\ProgramData\EPSON
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\Program Files\Common Files\EPSON
2013-07-19 19:49 - 2011-04-18 18:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_ILMIKE.DLL
2013-07-19 19:49 - 2011-03-13 18:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_IBCBIKE.DLL
2013-07-19 19:49 - 2007-04-09 16:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2013-07-11 20:05 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 20:05 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 20:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 20:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 20:05 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 20:05 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 19:21 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 19:21 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 19:21 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 19:21 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 19:17 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 19:17 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 19:17 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 20:06 - 2013-07-10 20:06 - 01179136 _____ C:\Users\garfield\Desktop\TastaturSperren.exe
2013-07-10 19:52 - 2013-07-10 19:52 - 00001351 _____ C:\Users\garfield\Documents\AutoHotkey.ahk
2013-07-10 19:34 - 2013-07-10 19:34 - 00000000 ____D C:\Program Files\AutoHotkey
2013-07-10 19:30 - 2013-07-10 19:30 - 02637267 _____ C:\Users\garfield\Downloads\AutoHotkey_L_Install.exe
2013-07-10 19:29 - 2013-07-10 20:05 - 00003776 _____ C:\Users\garfield\Desktop\TastaturSperren.ahk
2013-07-07 14:32 - 2013-07-07 14:32 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-07 14:32 - 2013-07-07 14:32 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-07 14:18 - 2013-07-07 14:21 - 31714216 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-i586.exe
2013-07-07 14:17 - 2013-07-07 14:19 - 07840209 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-x64.exe.part
2013-07-07 14:17 - 2013-07-07 14:17 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-03 21:00 - 2013-07-03 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 19:55 - 2013-07-01 21:04 - 00001187 ____H C:\Windows\EPMBatch.ept
2013-07-01 19:28 - 2013-07-01 19:28 - 00001490 _____ C:\Users\Public\Desktop\EASEUS Partition Master 4.1.1 Professional Edition.lnk
2013-07-01 19:28 - 2013-07-01 19:28 - 00000000 ____D C:\Program Files (x86)\EASEUS
2013-07-01 19:28 - 2009-11-05 16:45 - 02046464 _____ C:\Windows\system32\BootMan.exe
2013-07-01 19:28 - 2009-11-05 16:38 - 01669120 _____ C:\Windows\SysWOW64\BootMan.exe
2013-07-01 19:28 - 2009-09-16 16:55 - 00009096 _____ C:\Windows\system32\EuGdiDrv.sys
2013-07-01 19:28 - 2009-09-16 16:55 - 00008456 _____ C:\Windows\SysWOW64\EuGdiDrv.sys
2013-07-01 19:28 - 2009-09-14 09:21 - 00014848 _____ C:\Windows\SysWOW64\EuEpmGdi.dll
2013-07-01 19:28 - 2009-09-14 09:21 - 00011264 _____ C:\Windows\system32\EuEpmGdi.dll
2013-07-01 19:28 - 2009-08-26 12:45 - 00016776 _____ C:\Windows\system32\epmntdrv.sys
2013-07-01 19:28 - 2009-08-26 12:45 - 00014216 _____ C:\Windows\SysWOW64\epmntdrv.sys
2013-07-01 19:28 - 2009-04-22 14:28 - 00100232 _____ C:\Windows\system32\setupempdrvx64.exe
2013-07-01 19:28 - 2009-04-22 14:28 - 00086408 _____ C:\Windows\SysWOW64\setupempdrv03.exe
2013-06-27 20:31 - 2013-07-23 18:37 - 00000366 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-06-27 20:31 - 2013-07-23 18:36 - 00003432 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-06-27 20:31 - 2013-07-23 18:36 - 00003398 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-06-27 20:31 - 2013-07-14 15:47 - 00000000 ____D C:\ProgramData\PCDr
2013-06-27 20:31 - 2013-07-11 19:00 - 00000512 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-06-27 20:31 - 2013-07-10 19:57 - 00004222 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-06-27 20:31 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-06-27 20:04 - 2013-06-27 20:04 - 00000000 ____D C:\Users\garfield\AppData\Local\LSC
2013-06-27 20:03 - 2013-06-27 20:08 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Lenovo

==================== One Month Modified Files and Folders =======

2013-07-23 20:36 - 2013-07-23 20:36 - 00000000 ____D C:\FRST
2013-07-23 20:36 - 2013-07-23 20:03 - 00000000 ____D C:\Users\garfield\Desktop\Trojaner entfernen
2013-07-23 20:34 - 2012-07-13 16:55 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Skype
2013-07-23 20:33 - 2009-07-14 06:45 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-23 20:33 - 2009-07-14 06:45 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-23 20:30 - 2009-07-14 19:58 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-07-23 20:30 - 2009-07-14 19:58 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-07-23 20:30 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-23 20:28 - 2012-08-06 18:53 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-23 20:28 - 2012-08-06 18:53 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-23 20:26 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-23 20:26 - 2009-07-14 06:51 - 00118419 _____ C:\Windows\setupact.log
2013-07-23 20:25 - 2012-07-13 15:32 - 02074731 _____ C:\Windows\WindowsUpdate.log
2013-07-23 20:23 - 2013-07-23 20:23 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-23 20:08 - 2013-07-23 20:08 - 00135168 _____ C:\zip.exe
2013-07-23 20:08 - 2013-07-23 20:08 - 00061440 _____ C:\Windows\SysWOW64\Drivers\wrdvkqat.sys
2013-07-23 20:08 - 2013-07-23 20:08 - 00001022 _____ C:\Windows\SysWOW64\stmj.txt
2013-07-23 20:08 - 2013-07-23 20:08 - 00000883 _____ C:\backup.reg
2013-07-23 20:08 - 2013-07-23 20:08 - 00000574 _____ C:\cleanup.bat
2013-07-23 19:29 - 2013-07-23 19:29 - 00003138 _____ C:\Windows\System32\Tasks\{D2724CC8-253D-40AA-9A8E-235F2FDA8A96}
2013-07-23 19:26 - 2012-09-05 18:50 - 00001132 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA.job
2013-07-23 19:26 - 2012-09-05 18:50 - 00001080 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core.job
2013-07-23 19:22 - 2013-07-23 19:14 - 88691472 _____ (Microsoft Corporation) C:\Users\garfield\Downloads\msert.exe
2013-07-23 18:57 - 2013-07-23 18:57 - 00001164 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-07-23 18:57 - 2013-07-23 18:57 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-23 18:57 - 2013-07-23 18:55 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-07-23 18:37 - 2013-06-27 20:31 - 00000366 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-07-23 18:36 - 2013-06-27 20:31 - 00003432 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-07-23 18:36 - 2013-06-27 20:31 - 00003398 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-07-23 18:36 - 2012-08-02 22:14 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-07-23 18:36 - 2012-07-13 22:11 - 00025186 _____ C:\Windows\system32\lvcoinst.log
2013-07-21 21:58 - 2012-07-13 17:01 - 00000000 ____D C:\Users\garfield\Documents\Outlook-Dateien
2013-07-21 09:53 - 2012-07-15 22:14 - 00000000 ____D C:\Users\garfield\AppData\Roaming\vlc
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\ProgramData\EPSON
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\Program Files\Common Files\EPSON
2013-07-14 15:47 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PCDr
2013-07-13 19:21 - 2012-09-05 18:50 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA
2013-07-13 19:21 - 2012-09-05 18:50 - 00003712 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core
2013-07-12 20:23 - 2012-08-06 18:53 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 20:23 - 2012-08-06 18:53 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 21:30 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 21:30 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 21:30 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 21:30 - 2009-07-14 06:45 - 00531928 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 20:13 - 2012-07-13 16:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 20:06 - 2012-07-15 14:04 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 19:12 - 2012-07-15 18:11 - 00000000 ____D C:\Windows\System32\Tasks\TVT
2013-07-11 19:12 - 2012-07-15 13:27 - 00000000 ____D C:\Program Files (x86)\Lenovo
2013-07-11 19:00 - 2013-06-27 20:31 - 00000512 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-07-10 20:06 - 2013-07-10 20:06 - 01179136 _____ C:\Users\garfield\Desktop\TastaturSperren.exe
2013-07-10 20:05 - 2013-07-10 19:29 - 00003776 _____ C:\Users\garfield\Desktop\TastaturSperren.ahk
2013-07-10 19:57 - 2013-06-27 20:31 - 00004222 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-07-10 19:52 - 2013-07-10 19:52 - 00001351 _____ C:\Users\garfield\Documents\AutoHotkey.ahk
2013-07-10 19:34 - 2013-07-10 19:34 - 00000000 ____D C:\Program Files\AutoHotkey
2013-07-10 19:34 - 2012-07-13 20:07 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-10 19:34 - 2012-07-13 20:07 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-10 19:34 - 2009-07-14 20:18 - 00000000 ____D C:\Windows\ShellNew
2013-07-10 19:30 - 2013-07-10 19:30 - 02637267 _____ C:\Users\garfield\Downloads\AutoHotkey_L_Install.exe
2013-07-10 19:29 - 2012-09-03 21:38 - 00000000 ____D C:\Users\garfield\AppData\Local\Adobe
2013-07-07 14:32 - 2013-07-07 14:32 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-07 14:32 - 2013-07-07 14:32 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-07 14:32 - 2013-02-08 21:52 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-07 14:32 - 2013-02-08 21:52 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-07 14:21 - 2013-07-07 14:18 - 31714216 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-i586.exe
2013-07-07 14:19 - 2013-07-07 14:17 - 07840209 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-x64.exe.part
2013-07-07 14:17 - 2013-07-07 14:17 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-07 09:39 - 2013-03-31 12:51 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-07-04 18:41 - 2012-07-13 16:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 21:00 - 2013-07-03 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 21:04 - 2013-07-01 19:55 - 00001187 ____H C:\Windows\EPMBatch.ept
2013-07-01 19:28 - 2013-07-01 19:28 - 00001490 _____ C:\Users\Public\Desktop\EASEUS Partition Master 4.1.1 Professional Edition.lnk
2013-07-01 19:28 - 2013-07-01 19:28 - 00000000 ____D C:\Program Files (x86)\EASEUS
2013-06-30 20:14 - 2012-07-13 16:58 - 00084158 _____ C:\Windows\PFRO.log
2013-06-30 12:27 - 2012-07-17 22:33 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Dropbox
2013-06-30 12:27 - 2012-07-13 15:32 - 00000000 ___RD C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-29 19:59 - 2012-08-26 18:07 - 00005430 _____ C:\Users\garfield\AppData\Roaming\LTspiceIV.ini
2013-06-27 21:06 - 2012-10-13 17:57 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-06-27 20:31 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-06-27 20:08 - 2013-06-27 20:03 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2013-06-27 20:08 - 2012-07-15 18:53 - 00000000 ____D C:\Program Files\Lenovo
2013-06-27 20:04 - 2013-06-27 20:04 - 00000000 ____D C:\Users\garfield\AppData\Local\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Lenovo
2013-06-27 19:59 - 2012-07-15 18:52 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-27 19:32 - 2013-02-07 18:39 - 00002413 _____ C:\Windows\SysWOW64\lgAxconfig.ini
2013-06-27 18:25 - 2013-02-07 18:38 - 00000000 ____D C:\ProgramData\LGMOBILEAX

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-13 19:33

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-07-2013
Ran by garfield at 2013-07-23 20:36:58
Running from C:\Users\garfield\Desktop\Trojaner entfernen
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
AAVUpdateManager (x32 Version: 18.00.0000)
Adobe AIR (x32 Version: 3.7.0.2090)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Anzeige am Bildschirm (Version: 6.67.50)
Atmel Software Framework (x32 Version: 3.1.121)
Atmel Studio 6.0 (x32 Version: 6.0.1843)
Atmel USB (x32 Version: 10.6)
Autodesk Design Review 2012 (x32 Version: 12.0.0.93)
Autodesk Inventor Content Center Libraries 2012 (Desktop Content) (Version: 16.0.16000.0000)
Autodesk Inventor Fusion 2012 (Version: 1.0.0.79)
Autodesk Inventor Fusion 2012 Language Pack (Version: 1.0.0.79)
Autodesk Inventor Fusion for Inventor 2012 Add-in (Version: 1.0.0.18)
Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul (Version: 1.0.0.18)
Autodesk Inventor Fusion for Inventor 2012 Zusatzmodul Language Pack (Version: 1.0.0.18)
Autodesk Inventor Professional 2012 (Version: 16.0.16000.0000)
Autodesk Inventor Professional 2012 Deutsch (Version: 16.0.16000.0000)
Autodesk Inventor Professional 2012 Language Pack - Deutsch (Version: 16.0.16000.0000)
Autodesk Material Library 2012 (x32 Version: 2.5.0.8)
Autodesk Material Library Base Resolution Image Library 2012 (x32 Version: 2.5.0.8)
Autodesk Material Library Low Resolution Image Library 2012 (x32 Version: 2.5.0.8)
Autodesk Vault 2012 (Client) (Version: 16.0.56.200)
Autodesk Vault 2012 (Client) (x32 Version: 16.0.56.200)
Autodesk Vault 2012 (Client) German Language Pack (Version: 16.0.56.200)
AutoHotkey 1.1.11.01 (Version: 1.1.11.01)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
AVM FRITZ!fax für FRITZ!Box (x32)
CameraHelperMsi (x32 Version: 13.31.1038.0)
CamStudio Lossless Codec v1.5 (x32 Version: 1.5)
CamStudio version 2.7 (x32 Version: 2.7)
Conexant HD Audio (Version: 4.98.5.50)
CPUID CPU-Z 1.54
D3DX10 (x32 Version: 15.4.2368.0902)
DAEMON Tools Toolbar (x32 Version: 1.1.0.0283)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
DesignSpark PCB (x32 Version: 4.0)
DesignSpark PCB Version 4.0 (x32 Version: 4.0)
Dienstprogramm "ThinkPad UltraNav" (x32 Version: 2.13.0)
dows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
DSO-3064 Ver1.0.7 (x32 Version: 1.0.7)
DWG TrueView 2012 (Version: 18.2.51.0)
EAGLE 5.6.0 (x32 Version: 5.6.0)
EASEUS Partition Master 4.1.1 Professional (x32)
EasyBCD 2.1.2 (x32 Version: 2.1.2)
Eco Materials Adviser (x64) (Version: 1.32.0.0)
Energie-Manager (x32 Version: 6.32)
EPSON XP-302 303 305 306 Series Printer Uninstall
erLT (x32 Version: 1.20.138.34)
Fotogalerie (x32 Version: 16.4.3505.0912)
Foxit Reader (x32 Version: 6.0.2.413)
Free Screen Video Recorder version 2.5.29.426 (x32 Version: 2.5.29.426)
FreeOCR v4.2 (x32)
Google Chrome (HKCU Version: 28.0.1500.72)
Google Earth (x32 Version: 7.0.3.8542)
Google Update Helper (x32 Version: 1.3.21.153)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.1930)
Java 7 Update 25 (64-bit) (Version: 7.0.250)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
JDownloader 0.9 (x32 Version: 0.9)
JLink OB CDC Driver Package (Version: 1.2.1)
Lenovo Auto Scroll Utility (Version: 1.11)
Lenovo Patch Utility (x32 Version: 1.3.1.1)
Lenovo Patch Utility 64 bit (Version: 1.3.2.6)
Lenovo System Interface Driver (Version: 1.05)
Lenovo System Update (x32 Version: 5.02.0018)
Lenovo ThinkVantage Toolbox (Version: 6.0.5717.35)
LG PC Suite (x32 Version: 5.2.37.20130520)
LG SP USB Driver (x32 Version: 1.0)
LG United Mobile Driver (x32 Version: 3.8.1)
LG USB WML Modem Driver (x32 Version: 1.0)
Livescribe Connect (x32 Version: 1.2.1)
Livescribe Connect (x32 Version: 1.2.1.58498)
Livescribe Desktop (x32 Version: 2.8.3)
Logitech Webcam-Software (x32 Version: 2.31)
LTspice IV (x32)
LWS Facebook (x32 Version: 13.31.1038.0)
LWS Gallery (x32 Version: 13.31.1038.0)
LWS Help_main (x32 Version: 13.31.1044.0)
LWS Launcher (x32 Version: 13.31.1038.0)
LWS Motion Detection (x32 Version: 13.30.1395.0)
LWS Pictures And Video (x32 Version: 13.31.1038.0)
LWS Twitter (x32 Version: 13.30.1346.0)
LWS Video Mask Maker (x32 Version: 13.30.1379.0)
LWS VideoEffects (Version: 13.30.1379.0)
LWS Webcam Software (x32 Version: 13.31.1038.0)
LWS WLM Plugin (x32 Version: 1.30.1201.0)
LWS YouTube Plugin (x32 Version: 13.31.1038.0)
Mathcad PDSi viewable support (x32 Version: 9.0.0)
Mathcad Prime 2.0 (x32 Version: 2.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (x32 Version: 3.5.30730.0)
Microsoft Help Viewer 1.0 (Version: 1.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 R2 Management Objects (x32 Version: 10.50.1447.4)
Microsoft SQL Server System CLR Types (x32 Version: 10.50.1447.4)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319 (x32 Version: 10.0.30319)
Microsoft Visual Studio 2010 Shell (Isolated) - ENU (x32 Version: 10.0.30319)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)
Movie Maker (x32 Version: 16.4.3505.0912)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MusicBee (x32 Version: 1.4.4443)
Notepad++ (x32 Version: 6.2.2)
PCMSCAN (x32 Version: 2.4.12)
PDF Architect (x32 Version: 1.0.52.8917)
PDFCreator (x32 Version: 1.6.2)
Photo Gallery (x32 Version: 16.4.3505.0912)
ScanMaster-ELM 2.1.104.771 (Version: 2.1.104.771)
Schnell-Deinstallations-Tool für Autodesk Inventor 2012 (Version: 16.0.16000.0000)
Shutdown Timer (Version: 3.0)
Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) (x32)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (x32 Version: 6.5)
Skype™ 6.3 (x32 Version: 6.3.107)
Spybot - Search & Destroy (x32 Version: 2.1.19)
Steuer-Spar-Erklärung 2013 (x32 Version: 18.08)
TeraCopy 2.27
ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.2.1.3100)
ThinkPad FullScreen Magnifier (Version: 2.40)
ThinkPad Power Management Driver (Version: 1.43)
ThinkPad UltraNav Driver (Version: 7.202.1616.204)
ThinkVantage Fingerprint Software (Version: 5.9.9.7282)
ThinkVantage System für aktiven Festplattenschutz (Version: 1.77.0.5)
TPFanControl v0.62
Trillian (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
VBA (2627.01) (x32 Version: 6.03.00.9402)
VBA (2701.01) (x32 Version: 6.03.00.9402)
VLC media player 2.0.2 (x32 Version: 2.0.2)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430) (Version: 04/08/2010 6.3.5.430)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)
Windows-Treiberpaket - Segger (jlink_ob_x64) USB  (03/13/2012 2.6.6.2) (Version: 03/13/2012 2.6.6.2)
Windows-Treiberpaket - SEGGER (usbser) Ports  (01/25/2012 6.0.2600.4) (Version: 01/25/2012 6.0.2600.4)
WinRAR
Wuala (HKCU Version: 1.0.428.0)
Wuala CBFS (x32 Version: 3.2.107.0)
Wuala OverlayIcons (x32 Version: 1.0.0.2)
XnView 1.97.8 (x32 Version: 1.97.8)

==================== Restore Points  =========================

07-07-2013 12:17:03 Installed Java 7 Update 25 (64-bit)
07-07-2013 12:19:02 Removed Java 7 Update 21
07-07-2013 12:32:26 Installed Java 7 Update 25
09-07-2013 16:17:48 Windows Update
11-07-2013 18:01:01 Windows Update
16-07-2013 15:55:16 Windows Update
19-07-2013 17:13:11 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {288D74F0-7079-49DE-86DB-BA0CF1787C77} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {2DE1FA82-E4FC-4D5C-B20E-21DA1FBC5B81} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {3F6D65CF-CFC4-4146-9BF7-F395544A389C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe No File
Task: {4F5F6CCB-E7EA-4BC3-A3DF-D661C66BD7CD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-06] (Google Inc.)
Task: {5F4F525D-051B-400B-9658-7645F588F0A0} - System32\Tasks\SystemToolsDailyTest => E:\Programme\PC-Doctor\pcdrcui.exe [2010-12-10] (PC-Doctor, Inc.)
Task: {6C3188B2-72A9-448B-985A-8C6239075456} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA => C:\Users\garfield\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-06] (Google Inc.)
Task: {6ED2EE51-F0EB-4D01-A532-B1B12E48C2CD} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core => C:\Users\garfield\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-06] (Google Inc.)
Task: {6F93EE6F-504D-43EC-BB09-D5907D636ACC} - System32\Tasks\PCDoctorBackgroundMonitorTask => E:\Programme\PC-Doctor\uaclauncher.exe [2010-12-10] (PC-Doctor, Inc.)
Task: {78F73B25-6C3C-4D70-9EDE-CD1224047701} - System32\Tasks\{4776E2AC-C11E-4F46-A2BE-8C4C3AE07F8B} => C:\Program Files (x86)\OBD2_Tools\Digimot5\Digimoto.exe No File
Task: {7D271576-3F6F-48F9-BB5C-DF57792A1268} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-06] (Google Inc.)
Task: {897FF396-EA14-4300-9506-B6268CB031D0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe No File
Task: {90AEA10E-CEC1-459F-BBCD-EF28329A1773} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe No File
Task: {CAEE16F9-228A-41BE-8735-DA50340A9812} - System32\Tasks\{E32C5B45-FBD2-45DF-A30B-96F1B610DF96} => E:\_Session Games\Half-life\hl.exe [2008-12-06] (Valve, L.L.C.)
Task: {D0520055-E45D-489B-90A9-5FDF516561E1} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2013-06-26] ()
Task: {D22DA2BE-6889-4B28-80CA-959AACEF4A1B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {DBB64A82-30F5-404D-BE9F-794C6F895471} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe No File
Task: {F1AC6FFC-F245-46F3-B467-F7704261E47E} - System32\Tasks\{0BD3A9E7-1F4B-4E0A-9D3A-FF0A9A51B79D} => E:\Eigene Dateien\Basteleien\Beleuchtungssachen\LED Deckenlampe kw-ww\Structorizer\Structorizer.exe No File
Task: {F305B8C9-45F7-41BD-B592-40BC4F7CCE5B} - System32\Tasks\PCDEventLauncher => E:\Programme\PC-Doctor\sessionchecker.exe [2010-12-10] ()
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core.job => C:\Users\garfield\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA.job => C:\Users\garfield\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => E:\Programme\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => E:\Programme\PC-Doctor\pcdrcui.exe

==================== Faulty Device Manager Devices =============

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Basissystemgerät
Description: Basissystemgerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) enumerator - Error -- 118 pcdrsysinfocsmi: Module returned no data

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) enumerator - Error -- 118 pcdrsysinfostorage: Module returned no data

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) Matrix.ModuleImp - Error -- 52 Unable to get information from module due to failed exec.

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) Matrix.ModuleImp - Error -- 52 Unable to get information from module due to failed exec.

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) libCommon.System.Windows - Error -- 709 execAndGetPipeData(./pcdrsysinfocsmi.p5x) readFromPipeTimed failed, killing: 5560

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) libCommon.System.Windows - Error -- 709 execAndGetPipeData(./pcdrsysinfostorage.p5x) readFromPipeTimed failed, killing: 5520

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1340)(2712) libCommon.System.Windows - Error -- 579 readFromPipeTimed(2508) child process 5560 exited with return code: 259

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:35:1280)(2712) libCommon.System.Windows - Error -- 579 readFromPipeTimed(2532) child process 5520 exited with return code: 259

Error: (07/23/2013 06:36:34 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:34:9670)(2712) enumerator - Error -- 118 pcdrsysinfodirect: Module returned no data

Error: (07/23/2013 06:36:34 PM) (Source: PC-Doctor) (User: )
Description: (2712) Asapi: (18:36:34:9670)(2712) enumerator - Error -- 118 pcdrsysinfosoftware: Module returned no data


System errors:
=============
Error: (07/23/2013 08:27:33 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (07/23/2013 08:26:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/23/2013 08:26:33 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom
xepqmvli

Error: (07/23/2013 08:26:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/23/2013 08:26:32 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/23/2013 08:26:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/23/2013 08:10:54 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (07/23/2013 08:09:55 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (07/23/2013 08:09:55 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
xepqmvli

Error: (07/23/2013 08:09:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) enumerator - Error -- 118 pcdrsysinfocsmi: Module returned no data

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) enumerator - Error -- 118 pcdrsysinfostorage: Module returned no data

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) Matrix.ModuleImp - Error -- 52 Unable to get information from module due to failed exec.

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) Matrix.ModuleImp - Error -- 52 Unable to get information from module due to failed exec.

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) libCommon.System.Windows - Error -- 709 execAndGetPipeData(./pcdrsysinfocsmi.p5x) readFromPipeTimed failed, killing: 5560

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1460)(2712) libCommon.System.Windows - Error -- 709 execAndGetPipeData(./pcdrsysinfostorage.p5x) readFromPipeTimed failed, killing: 5520

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1340)(2712) libCommon.System.Windows - Error -- 579 readFromPipeTimed(2508) child process 5560 exited with return code: 259

Error: (07/23/2013 06:36:35 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:35:1280)(2712) libCommon.System.Windows - Error -- 579 readFromPipeTimed(2532) child process 5520 exited with return code: 259

Error: (07/23/2013 06:36:34 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:34:9670)(2712) enumerator - Error -- 118 pcdrsysinfodirect: Module returned no data

Error: (07/23/2013 06:36:34 PM) (Source: PC-Doctor)(User: )
Description: (2712) Asapi: (18:36:34:9670)(2712) enumerator - Error -- 118 pcdrsysinfosoftware: Module returned no data


==================== Memory info =========================== 

Percentage of memory in use: 45%
Total physical RAM: 3062.3 MB
Available physical RAM: 1672.13 MB
Total Pagefile: 6122.78 MB
Available Pagefile: 4648.35 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive b: (WinXP) (Fixed) (Total:4.87 GB) (Free:0.24 GB) NTFS (Disk=1 Partition=1)
Drive c: () (Fixed) (Total:109.24 GB) (Free:49.86 GB) NTFS (Disk=0 Partition=2)
Drive d: (WinXP) (Fixed) (Total:9.9 GB) (Free:5.26 GB) NTFS (Disk=0 Partition=3)
Drive e: (Daten) (Fixed) (Total:926.63 GB) (Free:426.42 GB) NTFS (Disk=1 Partition=2)
Drive f: () (Removable) (Total:1.89 GB) (Free:1.89 GB) FAT (Disk=2 Partition=1)
Drive i: () (Removable) (Total:14.88 GB) (Free:14.87 GB) FAT32 (Disk=3 Partition=1)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: 2584A9D8)
Partition 1: (Active) - (Size=111 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=109 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 932 GB) (Disk ID: 4F2710FA)
Partition 1: (Active) - (Size=5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=927 GB) - (Type=OF Extended)

========================================================
Disk: 2 (Size: 2 GB) (Disk ID: 31D85787)
Partition 1: (Not Active) - (Size=2 GB) - (Type=06)

========================================================
Disk: 3 (Size: 15 GB) (Disk ID: F87730A6)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================

http://www.trojaner-board.de/112096-...tml#post798202

ich werde mich wohl an diesem Post orientieren...

schrauber · 23.07.2013, 21:12

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

garfield01 · 23.07.2013, 21:39

hallo schrauber

so hab es ausgeführt.
Bin mal gespannt was du da jetzt rausließt

Combofix Logfile:

Code:

ATTFilter

ComboFix 13-07-23.01 - garfield 23.07.2013  22:27:16.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3062.1682 [GMT 2:00]
ausgeführt von:: c:\users\garfield\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\garfield\AppData\Local\Microsoft\Windows\Temporary Internet Files\{111E623D-DD4D-4ACD-AFF8-572E2AEE1DBB}.xps
c:\users\garfield\AppData\Local\Microsoft\Windows\Temporary Internet Files\{471866A9-6B81-4165-AA5B-C9892FB66EE7}.xps
c:\users\garfield\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A67D0E59-6E11-4233-9341-2890266F5364}.xps
c:\windows\Downloaded Program Files\IDropPTB.dll
c:\windows\IsUn0407.exe
c:\windows\ST6UNST.000
C:\zip.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-06-23 bis 2013-07-23  ))))))))))))))))))))))))))))))
.
.
2013-07-23 20:33 . 2013-07-23 20:33	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2013-07-23 20:33 . 2013-07-23 20:33	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-07-23 18:36 . 2013-07-23 18:36	--------	d-----w-	C:\FRST
2013-07-23 18:23 . 2013-07-23 18:23	--------	d-----w-	C:\TDSSKiller_Quarantine
2013-07-23 18:08 . 2013-07-23 18:08	883	----a-w-	C:\backup.reg
2013-07-23 18:08 . 2013-07-23 18:08	61440	----a-w-	c:\windows\SysWow64\drivers\wrdvkqat.sys
2013-07-23 18:08 . 2013-07-23 18:08	574	----a-w-	C:\cleanup.bat
2013-07-23 16:57 . 2009-01-25 11:14	17272	----a-w-	c:\windows\system32\sdnclean64.exe
2013-07-23 16:55 . 2013-07-23 16:57	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy 2
2013-07-19 17:49 . 2013-07-19 17:49	--------	d-----w-	c:\program files\Common Files\EPSON
2013-07-19 17:49 . 2013-07-19 17:49	--------	d-----w-	c:\programdata\EPSON
2013-07-19 17:49 . 2011-04-18 16:03	120320	----a-w-	c:\windows\system32\E_ILMIKE.DLL
2013-07-19 17:49 . 2007-04-09 14:06	10752	----a-w-	c:\windows\system32\E_GCINST.DLL
2013-07-19 17:49 . 2011-03-13 16:03	83968	----a-w-	c:\windows\system32\E_IBCBIKE.DLL
2013-07-19 17:13 . 2013-07-02 08:34	9460976	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{7000939C-9E0D-47BC-B08C-2F59E3EDEC81}\mpengine.dll
2013-07-11 17:21 . 2013-05-27 05:50	1011712	----a-w-	c:\program files\Windows Defender\MpSvc.dll
2013-07-11 17:21 . 2013-05-27 05:50	571904	----a-w-	c:\program files\Windows Defender\MpClient.dll
2013-07-11 17:21 . 2013-05-27 05:50	314880	----a-w-	c:\program files\Windows Defender\MpCommu.dll
2013-07-11 17:21 . 2013-05-27 04:57	4608	----a-w-	c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-11 17:21 . 2013-05-27 04:57	54784	----a-w-	c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-11 17:21 . 2013-05-27 04:57	392704	----a-w-	c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-11 17:21 . 2013-05-27 03:15	9216	----a-w-	c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-11 17:21 . 2013-06-04 06:00	624128	----a-w-	c:\windows\system32\qedit.dll
2013-07-11 17:21 . 2013-06-04 04:53	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2013-07-11 17:21 . 2013-05-06 06:03	1887744	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-11 17:21 . 2013-05-06 04:56	1620480	----a-w-	c:\windows\SysWow64\WMVDECOD.DLL
2013-07-11 17:17 . 2013-06-05 03:34	3153920	----a-w-	c:\windows\system32\win32k.sys
2013-07-11 17:17 . 2013-04-10 05:48	1732608	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2013-07-11 17:17 . 2013-04-10 05:46	1393152	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2013-07-11 17:17 . 2013-04-10 05:46	1367040	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-11 17:17 . 2013-04-10 05:46	1402880	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2013-07-11 17:17 . 2013-04-10 05:03	936448	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-11 17:17 . 2013-04-09 23:34	1247744	----a-w-	c:\windows\SysWow64\DWrite.dll
2013-07-11 17:17 . 2013-04-02 22:51	1643520	----a-w-	c:\windows\system32\DWrite.dll
2013-07-10 17:34 . 2013-07-10 17:34	--------	d-----w-	c:\program files\AutoHotkey
2013-07-07 12:32 . 2013-07-07 12:32	--------	d-----w-	c:\program files (x86)\Common Files\Java
2013-07-07 12:32 . 2013-07-07 12:32	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-07 12:32 . 2013-07-07 12:32	--------	d-----w-	c:\program files (x86)\Java
2013-07-07 12:17 . 2013-07-07 12:17	312232	----a-w-	c:\windows\system32\javaws.exe
2013-07-07 12:17 . 2013-07-07 12:17	972712	----a-w-	c:\windows\system32\deployJava1.dll
2013-07-07 12:17 . 2013-07-07 12:17	1093032	----a-w-	c:\windows\system32\npDeployJava1.dll
2013-07-07 12:17 . 2013-07-07 12:17	108968	----a-w-	c:\windows\system32\WindowsAccessBridge-64.dll
2013-07-07 12:17 . 2013-07-07 12:17	189352	----a-w-	c:\windows\system32\javaw.exe
2013-07-07 12:17 . 2013-07-07 12:17	188840	----a-w-	c:\windows\system32\java.exe
2013-07-07 12:17 . 2013-07-07 12:17	--------	d-----w-	c:\program files\Java
2013-07-01 17:28 . 2009-11-05 14:45	2046464	----a-w-	c:\windows\system32\BootMan.exe
2013-07-01 17:28 . 2009-11-05 14:38	1669120	----a-w-	c:\windows\SysWow64\BootMan.exe
2013-07-01 17:28 . 2009-09-14 07:21	14848	----a-w-	c:\windows\SysWow64\EuEpmGdi.dll
2013-07-01 17:28 . 2009-09-14 07:21	11264	----a-w-	c:\windows\system32\EuEpmGdi.dll
2013-07-01 17:28 . 2009-09-16 14:55	9096	----a-w-	c:\windows\system32\EuGdiDrv.sys
2013-07-01 17:28 . 2009-09-16 14:55	8456	----a-w-	c:\windows\SysWow64\EuGdiDrv.sys
2013-07-01 17:28 . 2009-08-26 10:45	16776	----a-w-	c:\windows\system32\epmntdrv.sys
2013-07-01 17:28 . 2009-08-26 10:45	14216	----a-w-	c:\windows\SysWow64\epmntdrv.sys
2013-07-01 17:28 . 2009-04-22 12:28	86408	----a-w-	c:\windows\SysWow64\setupempdrv03.exe
2013-07-01 17:28 . 2009-04-22 12:28	100232	----a-w-	c:\windows\system32\setupempdrvx64.exe
2013-07-01 17:28 . 2013-07-01 17:28	--------	d-----w-	c:\program files (x86)\EASEUS
2013-06-27 18:31 . 2013-07-14 13:47	--------	d-----w-	c:\programdata\PCDr
2013-06-27 18:31 . 2013-06-27 18:31	--------	d-----w-	c:\programdata\PC-Doctor for Windows
2013-06-27 18:04 . 2013-06-27 18:04	--------	d-----w-	c:\users\garfield\AppData\Local\LSC
2013-06-27 18:03 . 2013-06-27 18:03	--------	d-----w-	c:\users\garfield\AppData\Roaming\Lenovo
2013-06-27 18:03 . 2013-06-27 18:03	--------	d-----w-	c:\users\garfield\AppData\Roaming\LSC
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-11 18:06 . 2012-07-15 12:04	78185248	----a-w-	c:\windows\system32\MRT.exe
2013-07-10 17:34 . 2012-07-13 18:07	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-10 17:34 . 2012-07-13 18:07	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-07 12:32 . 2013-02-08 19:52	867240	----a-w-	c:\windows\SysWow64\npDeployJava1.dll
2013-07-07 12:32 . 2013-02-08 19:52	789416	----a-w-	c:\windows\SysWow64\deployJava1.dll
2013-07-07 07:39 . 2013-03-31 10:51	189936	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-07-07 07:39 . 2012-07-13 15:16	378944	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-07-07 07:39 . 2012-07-13 15:16	1030952	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-06-01 12:25 . 2013-06-01 12:25	59816	----a-r-	c:\users\garfield\AppData\Roaming\Microsoft\Installer\{49A09C2C-FFF4-478E-B397-5E0979F67F5D}\ARPPRODUCTICON.exe
2013-06-01 12:24 . 2013-06-01 12:24	53248	----a-r-	c:\users\garfield\AppData\Roaming\Microsoft\Installer\{AD32F5E9-6BDD-480A-8B7B-95571D04691C}\ARPPRODUCTICON.exe
2013-05-13 05:51 . 2013-06-12 17:10	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 17:10	1464320	----a-w-	c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 17:10	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 17:10	52224	----a-w-	c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 17:10	1160192	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 17:10	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 17:10	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 17:10	1192448	----a-w-	c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 17:10	903168	----a-w-	c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 17:10	43008	----a-w-	c:\windows\SysWow64\certenc.dll
2013-05-12 10:51 . 2012-07-17 12:37	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-10 05:49 . 2013-06-12 17:11	30720	----a-w-	c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-12 17:11	24576	----a-w-	c:\windows\SysWow64\cryptdlg.dll
2013-05-09 08:59 . 2013-03-31 10:51	65336	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2013-05-09 08:59 . 2012-07-13 15:16	72016	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2013-05-09 08:59 . 2012-07-13 15:16	64288	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2013-05-09 08:59 . 2012-07-13 15:16	80816	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2013-05-09 08:59 . 2012-07-13 15:16	33400	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2013-05-09 08:58 . 2012-07-13 15:16	41664	----a-w-	c:\windows\avastSS.scr
2013-05-09 08:58 . 2012-07-13 15:16	287840	----a-w-	c:\windows\system32\aswBoot.exe
2013-05-08 06:39 . 2013-06-12 17:11	1910632	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-05-02 00:06 . 2012-07-13 13:55	278800	------w-	c:\windows\system32\MpSigStub.exe
2013-04-26 05:51 . 2013-06-12 17:11	751104	----a-w-	c:\windows\system32\win32spl.dll
2013-04-26 04:55 . 2013-06-12 17:11	492544	----a-w-	c:\windows\SysWow64\win32spl.dll
2013-04-25 23:30 . 2013-06-12 17:10	1505280	----a-w-	c:\windows\SysWow64\d3d11.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1EldosIconOverlay]
@="{29DFE580-2161-45C9-9B69-5A2C01372F0A}"
[HKEY_CLASSES_ROOT\CLSID\{29DFE580-2161-45C9-9B69-5A2C01372F0A}]
2012-04-09 14:27	158224	----a-w-	c:\windows\SysWOW64\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-04-09 14:27	158224	----a-w-	c:\windows\SysWOW64\CbFsMntNtf3.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2012-05-16 5941344]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224]
.
c:\users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-1-8 228448]
Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2012-7-2 2298320]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2011-1-24 1090848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
.
R0 xepqmvli;xepqmvli;c:\windows\system32\drivers\wrdvkqat.sys;c:\windows\SYSNATIVE\drivers\wrdvkqat.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 andnetadb;ADB Interface DriverNet;c:\windows\system32\Drivers\lgandnetadb.sys;c:\windows\SYSNATIVE\Drivers\lgandnetadb.sys [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 andnetndis;LGE AndroidNet NDIS Ethernet Adapter;c:\windows\system32\DRIVERS\lgandnetndis64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetndis64.sys [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys;c:\windows\SYSNATIVE\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x]
R3 DSO3064;DSO-3064 DRIVER;c:\windows\system32\Drivers\DSO3064AMD64.SYS;c:\windows\SYSNATIVE\Drivers\DSO3064AMD64.SYS [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 PulseUsb;Livescribe Smartpen USB Driver;c:\windows\system32\DRIVERS\PulseUsb.sys;c:\windows\SYSNATIVE\DRIVERS\PulseUsb.sys [x]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R4 ApRunSvc;Alps Application Launcher Service;c:\program files\Apoint2K\ApRunSvc.exe;c:\program files\Apoint2K\ApRunSvc.exe [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 cbfs3;cbfs3;c:\windows\system32\drivers\cbfs3.sys;c:\windows\SYSNATIVE\drivers\cbfs3.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys;c:\windows\SYSNATIVE\DRIVERS\smiifx64.sys [x]
S2 AAV UpdateService;AAV UpdateService;c:\program files (x86)\AAVUpdateManager\aavus.exe;c:\program files (x86)\AAVUpdateManager\aavus.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x64.sys;c:\windows\SYSNATIVE\drivers\cpuz133_x64.sys [x]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [x]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
S2 mitsijm2012;Autodesk Moldflow Inventor Tool Suite Integration 2012 Job-Manager;c:\program files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe;c:\program files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S2 smihlp2;SMI Helper Driver (smihlp2);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
S2 TVicPort64;TVicPort64; [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech QuickCam Pro 9000(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
S3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 46318979
*NewlyCreated* - 86712030
*Deregistered* - 46318979
*Deregistered* - 86712030
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-06 16:53]
.
2013-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-06 16:53]
.
2013-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core.job
- c:\users\garfield\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-05 16:58]
.
2013-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA.job
- c:\users\garfield\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-05 16:58]
.
2013-07-11 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- e:\programme\PC-Doctor\uaclauncher.exe [2010-12-09 22:52]
.
2013-07-23 c:\windows\Tasks\SystemToolsDailyTest.job
- e:\programme\PC-Doctor\pcdrcui.exe [2010-12-09 22:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58	133840	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon1]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-05-02 12:10	1721856	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon2]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-05-02 12:10	1721856	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon3]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-05-02 12:10	1721856	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0WualaOverlayIcon4]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2012-05-02 12:10	1721856	----a-w-	c:\program files (x86)\Wuala OverlayIcons\OverlayIcon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1EldosIconOverlay]
@="{29DFE580-2161-45C9-9B69-5A2C01372F0A}"
[HKEY_CLASSES_ROOT\CLSID\{29DFE580-2161-45C9-9B69-5A2C01372F0A}]
2012-04-09 14:27	190480	----a-w-	c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-04-09 14:27	190480	----a-w-	c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544]
"TpShocks"="TpShocks.exe" [2012-06-21 222720]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-09-09 245760]
"TPFanControl"="c:\program files\TPFanControl\TPFanControl.exe" [2012-06-07 153600]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>
uInternet Settings,ProxyServer = localhost:21320
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-05-27 17:50; ich@maltegoetz.de; c:\users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\extensions\ich@maltegoetz.de
FF - ExtSQL: 2013-06-01 16:40; DTToolbar@toolbarnet.com; c:\users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\extensions\DTToolbar@toolbarnet.com
FF - ExtSQL: 2013-07-14 14:04; 2020Player_IKEA@2020Technologies.com; c:\users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\extensions\2020Player_IKEA@2020Technologies.com
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Notify-SDWinLogon - SDWinLogon.dll
SafeBoot-46318979.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\program files (x86)\Silabs\MCU\DriverUninstall\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-23  22:36:28
ComboFix-quarantined-files.txt  2013-07-23 20:36
.
Vor Suchlauf: 17 Verzeichnis(se), 55.464.435.712 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 55.941.595.136 Bytes frei
.
- - End Of File - - 2AEF182F95773A280104BCA7E6B8C350

--- --- ---
A36C5E4F47E84449FF07ED3517B43A31
[/CODE]

schrauber · 24.07.2013, 10:44

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

garfield01 · 24.07.2013, 20:01

Hallo schrauber

soooo

Malwarebytes Anti Maleware

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.07.24.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
garfield :: TECHNOID [Administrator]

24.07.2013 17:41:56
mbam-log-2013-07-24 (17-41-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (B:\|C:\|D:\|E:\|F:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 850804
Laufzeit: 1 Stunde(n), 46 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Program Files\Apoint2K\Apoint.exe (Trojan.Hiloti) -> 1720 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Program Files\Apoint2K\Apoint.exe (Trojan.Hiloti) -> Löschen bei Neustart.
c:\windows\system32\driverstore\filerepository\apfiltr.inf_amd64_neutral_198dbf5eb2c7b198\apoint.exe (Trojan.Hiloti) -> Erfolgreich gelöscht und in Quarantäne gestellt.
E:\Downloads\_Gute Programme\_PC Tools\_Recovery\QueTek.File.Scavenger.v3.2.22.20100719.Incl.Keyfilemaker-CORE.rar (RiskWare.Tool.HCK) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

ADW Cleaner

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 24/07/2013 um 20:41:44 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : garfield - TECHNOID
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\garfield\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\searchplugins\SweetIm.xml
Ordner Gelöscht : C:\Program Files (x86)\DAEMON Tools Toolbar
Ordner Gelöscht : C:\Users\garfield\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Ordner Gelöscht : C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\extensions\DTToolbar@toolbarnet.com
Ordner Gelöscht : C:\Users\garfield\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4FC7-90CC-5EA0ABBE9EB8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C99FDC39-A1AE-4B24-8D71-E5274F8D7C54}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\prefs.js

Gelöscht : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");

-\\ Google Chrome v28.0.1500.72

Datei : C:\Users\garfield\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [3957 octets] - [24/07/2013 20:41:44]

########## EOF - C:\AdwCleaner[S1].txt - [4017 octets] ##########

Junkware Removal tool

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.2 (07.22.2013:2)
OS: Windows 7 Professional x64
Ran by garfield on 24.07.2013 at 20:45:55.69
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\garfield\AppData\Roaming\mozilla\firefox\profiles\3lz0hxry.default\minidumps [145 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\garfield\appdata\local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.07.2013 at 20:54:33.14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST log

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by garfield (administrator) on 24-07-2013 20:57:09
Running from C:\Users\garfield\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Lenovo) C:\Windows\system32\ibmpmsvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
() C:\Program Files (x86)\AAVUpdateManager\aavus.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Lenovo Group Limited) C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Zoom\TpScrex.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(troubadix) C:\Program Files\TPFanControl\TPFanControl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [222720 2012-06-21] (Lenovo.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [x]
HKLM\...\Run: [TPFanControl] - C:\Program Files\TPFanControl\TPFanControl.exe [153600 2012-06-07] (troubadix)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKLM-x32\...\Run: [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [PWMTRV] - rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor [x]
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [3830224 2013-05-16] (Safer-Networking Ltd.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

ProxyServer: localhost:21320
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKLM - DefaultScope value is missing.
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\garfield\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\garfield\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Visualisateur 3D de 20-20 - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\2020Player_IKEA@2020Technologies.com
FF Extension: FoxyProxy Basic - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\foxyproxy@eric.h.jung
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\ich@maltegoetz.de
FF Extension: Tradesignal Online Chart - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{1acd747e-8470-11db-96a9-00e08161165f}
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-05-16] (Lenovo.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 mitsijm2012; C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [848184 2010-12-08] (Autodesk, Inc.)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-06-26] ()
S4 ApRunSvc; C:\Program Files\Apoint2K\ApRunSvc.exe [x]
S2 SDScannerService; "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" [x]
S2 SDUpdateService; "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2012-07-03] (Google Inc)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
S3 andnetndis; C:\Windows\System32\DRIVERS\lgandnetndis64.sys [93184 2012-07-04] (LG Electronics Inc.)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-07-03] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-07] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-07] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-07] ()
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R3 CnxtHdAudService; C:\Windows\System32\drivers\CHDRTN64.sys [683008 2009-06-22] (Conexant Systems Inc.)
R2 cpuz133; C:\Windows\system32\drivers\cpuz133_x64.sys [20456 2010-03-10] (Windows (R) Win 7 DDK provider)
S3 DSO3064; C:\Windows\System32\Drivers\DSO3064AMD64.SYS [22720 2011-05-13] (Hantek)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2009-08-26] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2009-08-26] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2009-09-16] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2009-09-16] ()
S3 PulseUsb; C:\Windows\System32\DRIVERS\PulseUsb.sys [26112 2011-10-28] (Windows (R) Win 7 DDK provider)
R2 smihlp2; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [254976 2010-08-31] (Jungo)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
S0 xepqmvli; system32\drivers\wrdvkqat.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-24 20:54 - 2013-07-24 20:54 - 00001275 _____ C:\Users\garfield\Desktop\JRT.txt
2013-07-24 20:45 - 2013-07-24 20:45 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 20:41 - 2013-07-24 20:42 - 00004076 _____ C:\AdwCleaner[S1].txt
2013-07-24 17:43 - 2013-07-23 20:35 - 01779757 _____ (Farbar) C:\Users\garfield\Desktop\FRST64.exe
2013-07-24 17:41 - 2013-07-24 17:38 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\garfield\Desktop\JRT.exe
2013-07-24 17:39 - 2013-07-24 17:39 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-24 17:39 - 2013-07-24 17:38 - 00666633 _____ C:\Users\garfield\Desktop\adwcleaner.exe
2013-07-24 17:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-23 22:36 - 2013-07-23 22:36 - 00032743 _____ C:\ComboFix.txt
2013-07-23 22:25 - 2013-07-23 22:36 - 00000000 ____D C:\Qoobox
2013-07-23 22:25 - 2013-07-23 22:34 - 00000000 ____D C:\Windows\erdnt
2013-07-23 22:25 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-23 22:25 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-23 22:25 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-23 22:24 - 2013-07-23 22:23 - 05092552 ____R (Swearware) C:\Users\garfield\Desktop\ComboFix.exe
2013-07-23 20:36 - 2013-07-23 20:36 - 00000000 ____D C:\FRST
2013-07-23 20:23 - 2013-07-23 20:23 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-23 20:08 - 2013-07-23 20:08 - 00061440 _____ C:\Windows\SysWOW64\Drivers\wrdvkqat.sys
2013-07-23 20:08 - 2013-07-23 20:08 - 00001022 _____ C:\Windows\SysWOW64\stmj.txt
2013-07-23 20:08 - 2013-07-23 20:08 - 00000883 _____ C:\backup.reg
2013-07-23 20:08 - 2013-07-23 20:08 - 00000574 _____ C:\cleanup.bat
2013-07-23 20:03 - 2013-07-23 20:37 - 00000000 ____D C:\Users\garfield\Desktop\Trojaner entfernen
2013-07-23 19:29 - 2013-07-23 19:29 - 00003138 _____ C:\Windows\System32\Tasks\{D2724CC8-253D-40AA-9A8E-235F2FDA8A96}
2013-07-23 19:14 - 2013-07-23 19:22 - 88691472 _____ (Microsoft Corporation) C:\Users\garfield\Downloads\msert.exe
2013-07-23 18:57 - 2013-07-23 18:57 - 00001164 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-07-23 18:57 - 2013-07-23 18:57 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-23 18:57 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-07-23 18:55 - 2013-07-23 18:57 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\ProgramData\EPSON
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\Program Files\Common Files\EPSON
2013-07-19 19:49 - 2011-04-18 18:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_ILMIKE.DLL
2013-07-19 19:49 - 2011-03-13 18:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_IBCBIKE.DLL
2013-07-19 19:49 - 2007-04-09 16:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2013-07-11 20:05 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 20:05 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 20:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 20:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 20:05 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 20:05 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 19:21 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 19:21 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 19:21 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 19:21 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 19:17 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 19:17 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 19:17 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 20:06 - 2013-07-10 20:06 - 01179136 _____ C:\Users\garfield\Desktop\TastaturSperren.exe
2013-07-10 19:52 - 2013-07-10 19:52 - 00001351 _____ C:\Users\garfield\Documents\AutoHotkey.ahk
2013-07-10 19:34 - 2013-07-10 19:34 - 00000000 ____D C:\Program Files\AutoHotkey
2013-07-10 19:30 - 2013-07-10 19:30 - 02637267 _____ C:\Users\garfield\Downloads\AutoHotkey_L_Install.exe
2013-07-10 19:29 - 2013-07-10 20:05 - 00003776 _____ C:\Users\garfield\Desktop\TastaturSperren.ahk
2013-07-07 14:32 - 2013-07-07 14:32 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-07 14:32 - 2013-07-07 14:32 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-07 14:18 - 2013-07-07 14:21 - 31714216 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-i586.exe
2013-07-07 14:17 - 2013-07-07 14:19 - 07840209 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-x64.exe.part
2013-07-07 14:17 - 2013-07-07 14:17 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-03 21:00 - 2013-07-03 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 19:55 - 2013-07-01 21:04 - 00001187 ____H C:\Windows\EPMBatch.ept
2013-07-01 19:28 - 2013-07-01 19:28 - 00001490 _____ C:\Users\Public\Desktop\EASEUS Partition Master 4.1.1 Professional Edition.lnk
2013-07-01 19:28 - 2013-07-01 19:28 - 00000000 ____D C:\Program Files (x86)\EASEUS
2013-07-01 19:28 - 2009-11-05 16:45 - 02046464 _____ C:\Windows\system32\BootMan.exe
2013-07-01 19:28 - 2009-11-05 16:38 - 01669120 _____ C:\Windows\SysWOW64\BootMan.exe
2013-07-01 19:28 - 2009-09-16 16:55 - 00009096 _____ C:\Windows\system32\EuGdiDrv.sys
2013-07-01 19:28 - 2009-09-16 16:55 - 00008456 _____ C:\Windows\SysWOW64\EuGdiDrv.sys
2013-07-01 19:28 - 2009-09-14 09:21 - 00014848 _____ C:\Windows\SysWOW64\EuEpmGdi.dll
2013-07-01 19:28 - 2009-09-14 09:21 - 00011264 _____ C:\Windows\system32\EuEpmGdi.dll
2013-07-01 19:28 - 2009-08-26 12:45 - 00016776 _____ C:\Windows\system32\epmntdrv.sys
2013-07-01 19:28 - 2009-08-26 12:45 - 00014216 _____ C:\Windows\SysWOW64\epmntdrv.sys
2013-07-01 19:28 - 2009-04-22 14:28 - 00100232 _____ C:\Windows\system32\setupempdrvx64.exe
2013-07-01 19:28 - 2009-04-22 14:28 - 00086408 _____ C:\Windows\SysWOW64\setupempdrv03.exe
2013-06-27 20:31 - 2013-07-24 17:50 - 00000366 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-06-27 20:31 - 2013-07-24 17:49 - 00003432 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-06-27 20:31 - 2013-07-24 17:49 - 00003398 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-06-27 20:31 - 2013-07-14 15:47 - 00000000 ____D C:\ProgramData\PCDr
2013-06-27 20:31 - 2013-07-11 19:00 - 00000512 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-06-27 20:31 - 2013-07-10 19:57 - 00004222 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-06-27 20:31 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-06-27 20:04 - 2013-06-27 20:04 - 00000000 ____D C:\Users\garfield\AppData\Local\LSC
2013-06-27 20:03 - 2013-06-27 20:08 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Lenovo

==================== One Month Modified Files and Folders =======

2013-07-24 20:54 - 2013-07-24 20:54 - 00001275 _____ C:\Users\garfield\Desktop\JRT.txt
2013-07-24 20:51 - 2009-07-14 19:58 - 00696870 _____ C:\Windows\system32\perfh007.dat
2013-07-24 20:51 - 2009-07-14 19:58 - 00148134 _____ C:\Windows\system32\perfc007.dat
2013-07-24 20:51 - 2009-07-14 07:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-24 20:51 - 2009-07-14 06:45 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-24 20:51 - 2009-07-14 06:45 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-24 20:45 - 2013-07-24 20:45 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 20:45 - 2012-07-13 16:55 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Skype
2013-07-24 20:44 - 2012-08-06 18:53 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-24 20:43 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-24 20:43 - 2009-07-14 06:51 - 00118643 _____ C:\Windows\setupact.log
2013-07-24 20:42 - 2013-07-24 20:41 - 00004076 _____ C:\AdwCleaner[S1].txt
2013-07-24 20:40 - 2012-07-15 18:55 - 00000000 ____D C:\Program Files\Apoint2K
2013-07-24 20:40 - 2012-07-13 16:58 - 00085824 _____ C:\Windows\PFRO.log
2013-07-24 20:39 - 2012-07-13 15:32 - 01210537 _____ C:\Windows\WindowsUpdate.log
2013-07-24 20:28 - 2012-08-06 18:53 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-24 20:26 - 2012-09-05 18:50 - 00001132 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA.job
2013-07-24 19:26 - 2012-09-05 18:50 - 00001080 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core.job
2013-07-24 17:50 - 2013-06-27 20:31 - 00000366 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-07-24 17:49 - 2013-06-27 20:31 - 00003432 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-07-24 17:49 - 2013-06-27 20:31 - 00003398 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-07-24 17:49 - 2012-07-13 22:11 - 00025486 _____ C:\Windows\system32\lvcoinst.log
2013-07-24 17:39 - 2013-07-24 17:39 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-24 17:38 - 2013-07-24 17:41 - 00560934 _____ (Oleg N. Scherbakov) C:\Users\garfield\Desktop\JRT.exe
2013-07-24 17:38 - 2013-07-24 17:39 - 00666633 _____ C:\Users\garfield\Desktop\adwcleaner.exe
2013-07-23 23:35 - 2012-07-15 22:14 - 00000000 ____D C:\Users\garfield\AppData\Roaming\vlc
2013-07-23 22:36 - 2013-07-23 22:36 - 00032743 _____ C:\ComboFix.txt
2013-07-23 22:36 - 2013-07-23 22:25 - 00000000 ____D C:\Qoobox
2013-07-23 22:34 - 2013-07-23 22:25 - 00000000 ____D C:\Windows\erdnt
2013-07-23 22:34 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-23 22:23 - 2013-07-23 22:24 - 05092552 ____R (Swearware) C:\Users\garfield\Desktop\ComboFix.exe
2013-07-23 20:37 - 2013-07-23 20:03 - 00000000 ____D C:\Users\garfield\Desktop\Trojaner entfernen
2013-07-23 20:36 - 2013-07-23 20:36 - 00000000 ____D C:\FRST
2013-07-23 20:35 - 2013-07-24 17:43 - 01779757 _____ (Farbar) C:\Users\garfield\Desktop\FRST64.exe
2013-07-23 20:23 - 2013-07-23 20:23 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-23 20:08 - 2013-07-23 20:08 - 00061440 _____ C:\Windows\SysWOW64\Drivers\wrdvkqat.sys
2013-07-23 20:08 - 2013-07-23 20:08 - 00001022 _____ C:\Windows\SysWOW64\stmj.txt
2013-07-23 20:08 - 2013-07-23 20:08 - 00000883 _____ C:\backup.reg
2013-07-23 20:08 - 2013-07-23 20:08 - 00000574 _____ C:\cleanup.bat
2013-07-23 19:29 - 2013-07-23 19:29 - 00003138 _____ C:\Windows\System32\Tasks\{D2724CC8-253D-40AA-9A8E-235F2FDA8A96}
2013-07-23 19:22 - 2013-07-23 19:14 - 88691472 _____ (Microsoft Corporation) C:\Users\garfield\Downloads\msert.exe
2013-07-23 18:57 - 2013-07-23 18:57 - 00001164 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-07-23 18:57 - 2013-07-23 18:57 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-23 18:57 - 2013-07-23 18:55 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-07-23 18:36 - 2012-08-02 22:14 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-07-21 21:58 - 2012-07-13 17:01 - 00000000 ____D C:\Users\garfield\Documents\Outlook-Dateien
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\ProgramData\EPSON
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\Program Files\Common Files\EPSON
2013-07-14 15:47 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PCDr
2013-07-13 19:21 - 2012-09-05 18:50 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA
2013-07-13 19:21 - 2012-09-05 18:50 - 00003712 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core
2013-07-12 20:23 - 2012-08-06 18:53 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 20:23 - 2012-08-06 18:53 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 21:30 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 21:30 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 21:30 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 21:30 - 2009-07-14 06:45 - 00531928 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 20:13 - 2012-07-13 16:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 20:06 - 2012-07-15 14:04 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 19:12 - 2012-07-15 18:11 - 00000000 ____D C:\Windows\System32\Tasks\TVT
2013-07-11 19:12 - 2012-07-15 13:27 - 00000000 ____D C:\Program Files (x86)\Lenovo
2013-07-11 19:00 - 2013-06-27 20:31 - 00000512 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-07-10 20:06 - 2013-07-10 20:06 - 01179136 _____ C:\Users\garfield\Desktop\TastaturSperren.exe
2013-07-10 20:05 - 2013-07-10 19:29 - 00003776 _____ C:\Users\garfield\Desktop\TastaturSperren.ahk
2013-07-10 19:57 - 2013-06-27 20:31 - 00004222 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-07-10 19:52 - 2013-07-10 19:52 - 00001351 _____ C:\Users\garfield\Documents\AutoHotkey.ahk
2013-07-10 19:34 - 2013-07-10 19:34 - 00000000 ____D C:\Program Files\AutoHotkey
2013-07-10 19:34 - 2012-07-13 20:07 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-10 19:34 - 2012-07-13 20:07 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-10 19:34 - 2009-07-14 20:18 - 00000000 ____D C:\Windows\ShellNew
2013-07-10 19:30 - 2013-07-10 19:30 - 02637267 _____ C:\Users\garfield\Downloads\AutoHotkey_L_Install.exe
2013-07-10 19:29 - 2012-09-03 21:38 - 00000000 ____D C:\Users\garfield\AppData\Local\Adobe
2013-07-07 14:32 - 2013-07-07 14:32 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-07 14:32 - 2013-07-07 14:32 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-07 14:32 - 2013-02-08 21:52 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-07 14:32 - 2013-02-08 21:52 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-07 14:21 - 2013-07-07 14:18 - 31714216 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-i586.exe
2013-07-07 14:19 - 2013-07-07 14:17 - 07840209 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-x64.exe.part
2013-07-07 14:17 - 2013-07-07 14:17 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-07 09:39 - 2013-03-31 12:51 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-07-04 18:41 - 2012-07-13 16:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 21:00 - 2013-07-03 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 21:04 - 2013-07-01 19:55 - 00001187 ____H C:\Windows\EPMBatch.ept
2013-07-01 19:28 - 2013-07-01 19:28 - 00001490 _____ C:\Users\Public\Desktop\EASEUS Partition Master 4.1.1 Professional Edition.lnk
2013-07-01 19:28 - 2013-07-01 19:28 - 00000000 ____D C:\Program Files (x86)\EASEUS
2013-06-30 12:27 - 2012-07-17 22:33 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Dropbox
2013-06-30 12:27 - 2012-07-13 15:32 - 00000000 ___RD C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-29 19:59 - 2012-08-26 18:07 - 00005430 _____ C:\Users\garfield\AppData\Roaming\LTspiceIV.ini
2013-06-27 21:06 - 2012-10-13 17:57 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-06-27 20:31 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-06-27 20:08 - 2013-06-27 20:03 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2013-06-27 20:08 - 2012-07-15 18:53 - 00000000 ____D C:\Program Files\Lenovo
2013-06-27 20:04 - 2013-06-27 20:04 - 00000000 ____D C:\Users\garfield\AppData\Local\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Lenovo
2013-06-27 19:59 - 2012-07-15 18:52 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-27 19:32 - 2013-02-07 18:39 - 00002413 _____ C:\Windows\SysWOW64\lgAxconfig.ini
2013-06-27 18:25 - 2013-02-07 18:38 - 00000000 ____D C:\ProgramData\LGMOBILEAX

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 20:58

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 25.07.2013, 07:26

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

garfield01 · 26.07.2013, 06:21

Hallo schrauber

ich lass nochmal avast laufen und schauen ob der noch meldungen bringt.
dauert aber noch.

Im Vorraus mal die Logfiles...

eset

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=6170a0c8bd86b547b0e119da93ab6ebf
# engine=14530
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-25 10:35:14
# local_time=2013-07-26 12:35:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 91 1229649 151505186 0 0
# compatibility_mode=5893 16776573 100 94 188777 126421564 0 0
# scanned=616662
# found=0
# cleaned=0
# scan_time=19259

security check

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.70  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Spybot - Search & Destroy 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 25  
 Adobe Flash Player 11.8.800.94  
 Adobe Reader 10.1.7 Adobe Reader out of Date!  
 Mozilla Firefox (22.0) 
 Google Chrome 28.0.1500.71  
 Google Chrome 28.0.1500.72  
````````Process Check: objlist.exe by Laurent````````  
 Spybot Teatimer.exe is disabled! 
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

und ein neues FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by garfield (administrator) on 26-07-2013 07:16:04
Running from C:\Users\garfield\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Lenovo) C:\Windows\system32\ibmpmsvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
() C:\Program Files (x86)\AAVUpdateManager\aavus.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Lenovo Group Limited) C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Zoom\TpScrex.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(troubadix) C:\Program Files\TPFanControl\TPFanControl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Users\garfield\Desktop\SecurityCheck.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [222720 2012-06-21] (Lenovo.)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [x]
HKLM\...\Run: [TPFanControl] - C:\Program Files\TPFanControl\TPFanControl.exe [153600 2012-06-07] (troubadix)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKLM-x32\...\Run: [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [PWMTRV] - rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor [x]
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [3830224 2013-05-16] (Safer-Networking Ltd.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

ProxyServer: localhost:21320
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKLM - DefaultScope value is missing.
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\garfield\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\garfield\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Visualisateur 3D de 20-20 - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\2020Player_IKEA@2020Technologies.com
FF Extension: FoxyProxy Basic - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\foxyproxy@eric.h.jung
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\ich@maltegoetz.de
FF Extension: Tradesignal Online Chart - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{1acd747e-8470-11db-96a9-00e08161165f}
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\garfield\AppData\Roaming\Mozilla\Firefox\Profiles\3lz0hxry.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\garfield\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-05-16] (Lenovo.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 mitsijm2012; C:\Program Files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [848184 2010-12-08] (Autodesk, Inc.)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-06-26] ()
S4 ApRunSvc; C:\Program Files\Apoint2K\ApRunSvc.exe [x]
S2 SDScannerService; "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" [x]
S2 SDUpdateService; "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2012-07-03] (Google Inc)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
S3 andnetndis; C:\Windows\System32\DRIVERS\lgandnetndis64.sys [93184 2012-07-04] (LG Electronics Inc.)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-07-03] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-07] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-07] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-07] ()
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
R3 CnxtHdAudService; C:\Windows\System32\drivers\CHDRTN64.sys [683008 2009-06-22] (Conexant Systems Inc.)
R2 cpuz133; C:\Windows\system32\drivers\cpuz133_x64.sys [20456 2010-03-10] (Windows (R) Win 7 DDK provider)
S3 DSO3064; C:\Windows\System32\Drivers\DSO3064AMD64.SYS [22720 2011-05-13] (Hantek)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2009-08-26] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2009-08-26] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2009-09-16] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2009-09-16] ()
S3 PulseUsb; C:\Windows\System32\DRIVERS\PulseUsb.sys [26112 2011-10-28] (Windows (R) Win 7 DDK provider)
R2 smihlp2; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [254976 2010-08-31] (Jungo)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
S0 xepqmvli; system32\drivers\wrdvkqat.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-26 07:11 - 2013-07-25 19:07 - 00891062 _____ C:\Users\garfield\Desktop\SecurityCheck.exe
2013-07-25 19:07 - 2013-07-25 19:13 - 00000000 ____D C:\Users\garfield\Desktop\4Schritt
2013-07-24 20:54 - 2013-07-24 20:54 - 00001275 _____ C:\Users\garfield\Desktop\JRT.txt
2013-07-24 20:45 - 2013-07-24 20:45 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 20:41 - 2013-07-24 20:42 - 00004076 _____ C:\AdwCleaner[S1].txt
2013-07-24 17:43 - 2013-07-23 20:35 - 01779757 _____ (Farbar) C:\Users\garfield\Desktop\FRST64.exe
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-24 17:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-24 17:37 - 2013-07-24 17:37 - 00000000 ____D C:\Users\garfield\Desktop\3Schritt
2013-07-23 22:36 - 2013-07-23 22:36 - 00032743 _____ C:\ComboFix.txt
2013-07-23 22:25 - 2013-07-23 22:36 - 00000000 ____D C:\Qoobox
2013-07-23 22:25 - 2013-07-23 22:34 - 00000000 ____D C:\Windows\erdnt
2013-07-23 22:25 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-23 22:25 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-23 22:25 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-23 22:25 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-23 22:24 - 2013-07-23 22:23 - 05092552 ____R (Swearware) C:\Users\garfield\Desktop\ComboFix.exe
2013-07-23 20:36 - 2013-07-23 20:36 - 00000000 ____D C:\FRST
2013-07-23 20:23 - 2013-07-23 20:23 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-23 20:08 - 2013-07-23 20:08 - 00061440 _____ C:\Windows\SysWOW64\Drivers\wrdvkqat.sys
2013-07-23 20:08 - 2013-07-23 20:08 - 00001022 _____ C:\Windows\SysWOW64\stmj.txt
2013-07-23 20:08 - 2013-07-23 20:08 - 00000883 _____ C:\backup.reg
2013-07-23 20:08 - 2013-07-23 20:08 - 00000574 _____ C:\cleanup.bat
2013-07-23 20:03 - 2013-07-23 20:37 - 00000000 ____D C:\Users\garfield\Desktop\Trojaner entfernen
2013-07-23 19:29 - 2013-07-23 19:29 - 00003138 _____ C:\Windows\System32\Tasks\{D2724CC8-253D-40AA-9A8E-235F2FDA8A96}
2013-07-23 19:14 - 2013-07-23 19:22 - 88691472 _____ (Microsoft Corporation) C:\Users\garfield\Downloads\msert.exe
2013-07-23 18:57 - 2013-07-23 18:57 - 00001164 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-07-23 18:57 - 2013-07-23 18:57 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-23 18:57 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-07-23 18:55 - 2013-07-23 18:57 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\ProgramData\EPSON
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\Program Files\Common Files\EPSON
2013-07-19 19:49 - 2011-04-18 18:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_ILMIKE.DLL
2013-07-19 19:49 - 2011-03-13 18:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_IBCBIKE.DLL
2013-07-19 19:49 - 2007-04-09 16:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2013-07-11 20:05 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 20:05 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 20:05 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 20:05 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 20:05 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 20:05 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 20:05 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 20:05 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 20:05 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 20:05 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 19:21 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 19:21 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 19:21 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 19:21 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 19:17 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 19:17 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 19:17 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 20:06 - 2013-07-10 20:06 - 01179136 _____ C:\Users\garfield\Desktop\TastaturSperren.exe
2013-07-10 19:52 - 2013-07-10 19:52 - 00001351 _____ C:\Users\garfield\Documents\AutoHotkey.ahk
2013-07-10 19:34 - 2013-07-10 19:34 - 00000000 ____D C:\Program Files\AutoHotkey
2013-07-10 19:30 - 2013-07-10 19:30 - 02637267 _____ C:\Users\garfield\Downloads\AutoHotkey_L_Install.exe
2013-07-10 19:29 - 2013-07-10 20:05 - 00003776 _____ C:\Users\garfield\Desktop\TastaturSperren.ahk
2013-07-07 14:32 - 2013-07-07 14:32 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-07 14:32 - 2013-07-07 14:32 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-07 14:18 - 2013-07-07 14:21 - 31714216 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-i586.exe
2013-07-07 14:17 - 2013-07-07 14:19 - 07840209 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-x64.exe.part
2013-07-07 14:17 - 2013-07-07 14:17 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-03 21:00 - 2013-07-03 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 19:55 - 2013-07-01 21:04 - 00001187 ____H C:\Windows\EPMBatch.ept
2013-07-01 19:28 - 2013-07-01 19:28 - 00001490 _____ C:\Users\Public\Desktop\EASEUS Partition Master 4.1.1 Professional Edition.lnk
2013-07-01 19:28 - 2013-07-01 19:28 - 00000000 ____D C:\Program Files (x86)\EASEUS
2013-07-01 19:28 - 2009-11-05 16:45 - 02046464 _____ C:\Windows\system32\BootMan.exe
2013-07-01 19:28 - 2009-11-05 16:38 - 01669120 _____ C:\Windows\SysWOW64\BootMan.exe
2013-07-01 19:28 - 2009-09-16 16:55 - 00009096 _____ C:\Windows\system32\EuGdiDrv.sys
2013-07-01 19:28 - 2009-09-16 16:55 - 00008456 _____ C:\Windows\SysWOW64\EuGdiDrv.sys
2013-07-01 19:28 - 2009-09-14 09:21 - 00014848 _____ C:\Windows\SysWOW64\EuEpmGdi.dll
2013-07-01 19:28 - 2009-09-14 09:21 - 00011264 _____ C:\Windows\system32\EuEpmGdi.dll
2013-07-01 19:28 - 2009-08-26 12:45 - 00016776 _____ C:\Windows\system32\epmntdrv.sys
2013-07-01 19:28 - 2009-08-26 12:45 - 00014216 _____ C:\Windows\SysWOW64\epmntdrv.sys
2013-07-01 19:28 - 2009-04-22 14:28 - 00100232 _____ C:\Windows\system32\setupempdrvx64.exe
2013-07-01 19:28 - 2009-04-22 14:28 - 00086408 _____ C:\Windows\SysWOW64\setupempdrv03.exe
2013-06-27 20:31 - 2013-07-25 19:21 - 00000366 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-06-27 20:31 - 2013-07-25 19:20 - 00003432 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-06-27 20:31 - 2013-07-25 19:20 - 00003398 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-06-27 20:31 - 2013-07-14 15:47 - 00000000 ____D C:\ProgramData\PCDr
2013-06-27 20:31 - 2013-07-11 19:00 - 00000512 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-06-27 20:31 - 2013-07-10 19:57 - 00004222 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-06-27 20:31 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-06-27 20:04 - 2013-06-27 20:04 - 00000000 ____D C:\Users\garfield\AppData\Local\LSC
2013-06-27 20:03 - 2013-06-27 20:08 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Lenovo

==================== One Month Modified Files and Folders =======

2013-07-26 07:08 - 2012-09-05 18:50 - 00001132 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA.job
2013-07-26 07:08 - 2012-08-06 18:53 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-26 07:08 - 2012-07-13 15:32 - 01432391 _____ C:\Windows\WindowsUpdate.log
2013-07-26 07:07 - 2009-07-14 06:51 - 00118755 _____ C:\Windows\setupact.log
2013-07-25 20:42 - 2012-08-06 18:53 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-25 19:49 - 2009-07-14 19:58 - 00700418 _____ C:\Windows\system32\perfh007.dat
2013-07-25 19:49 - 2009-07-14 19:58 - 00149182 _____ C:\Windows\system32\perfc007.dat
2013-07-25 19:49 - 2009-07-14 07:13 - 01621308 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-25 19:26 - 2012-09-05 18:50 - 00001080 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core.job
2013-07-25 19:21 - 2013-06-27 20:31 - 00000366 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-07-25 19:20 - 2013-06-27 20:31 - 00003432 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-07-25 19:20 - 2013-06-27 20:31 - 00003398 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-07-25 19:20 - 2012-07-13 22:11 - 00025786 _____ C:\Windows\system32\lvcoinst.log
2013-07-25 19:14 - 2012-11-04 23:04 - 00007614 _____ C:\Users\garfield\AppData\Local\Resmon.ResmonCfg
2013-07-25 19:13 - 2013-07-25 19:07 - 00000000 ____D C:\Users\garfield\Desktop\4Schritt
2013-07-25 19:12 - 2009-07-14 06:45 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-25 19:12 - 2009-07-14 06:45 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-25 19:08 - 2012-07-13 16:55 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Skype
2013-07-25 19:07 - 2013-07-26 07:11 - 00891062 _____ C:\Users\garfield\Desktop\SecurityCheck.exe
2013-07-25 19:05 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-24 22:30 - 2012-07-13 17:01 - 00000000 ____D C:\Users\garfield\Documents\Outlook-Dateien
2013-07-24 22:29 - 2012-07-15 13:03 - 01641654 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-24 20:54 - 2013-07-24 20:54 - 00001275 _____ C:\Users\garfield\Desktop\JRT.txt
2013-07-24 20:45 - 2013-07-24 20:45 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 20:42 - 2013-07-24 20:41 - 00004076 _____ C:\AdwCleaner[S1].txt
2013-07-24 20:40 - 2012-07-15 18:55 - 00000000 ____D C:\Program Files\Apoint2K
2013-07-24 20:40 - 2012-07-13 16:58 - 00085824 _____ C:\Windows\PFRO.log
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-24 17:39 - 2013-07-24 17:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-24 17:37 - 2013-07-24 17:37 - 00000000 ____D C:\Users\garfield\Desktop\3Schritt
2013-07-23 23:35 - 2012-07-15 22:14 - 00000000 ____D C:\Users\garfield\AppData\Roaming\vlc
2013-07-23 22:36 - 2013-07-23 22:36 - 00032743 _____ C:\ComboFix.txt
2013-07-23 22:36 - 2013-07-23 22:25 - 00000000 ____D C:\Qoobox
2013-07-23 22:34 - 2013-07-23 22:25 - 00000000 ____D C:\Windows\erdnt
2013-07-23 22:34 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-23 22:23 - 2013-07-23 22:24 - 05092552 ____R (Swearware) C:\Users\garfield\Desktop\ComboFix.exe
2013-07-23 20:37 - 2013-07-23 20:03 - 00000000 ____D C:\Users\garfield\Desktop\Trojaner entfernen
2013-07-23 20:36 - 2013-07-23 20:36 - 00000000 ____D C:\FRST
2013-07-23 20:35 - 2013-07-24 17:43 - 01779757 _____ (Farbar) C:\Users\garfield\Desktop\FRST64.exe
2013-07-23 20:23 - 2013-07-23 20:23 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-23 20:08 - 2013-07-23 20:08 - 00061440 _____ C:\Windows\SysWOW64\Drivers\wrdvkqat.sys
2013-07-23 20:08 - 2013-07-23 20:08 - 00001022 _____ C:\Windows\SysWOW64\stmj.txt
2013-07-23 20:08 - 2013-07-23 20:08 - 00000883 _____ C:\backup.reg
2013-07-23 20:08 - 2013-07-23 20:08 - 00000574 _____ C:\cleanup.bat
2013-07-23 19:29 - 2013-07-23 19:29 - 00003138 _____ C:\Windows\System32\Tasks\{D2724CC8-253D-40AA-9A8E-235F2FDA8A96}
2013-07-23 19:22 - 2013-07-23 19:14 - 88691472 _____ (Microsoft Corporation) C:\Users\garfield\Downloads\msert.exe
2013-07-23 18:57 - 2013-07-23 18:57 - 00001164 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-07-23 18:57 - 2013-07-23 18:57 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-07-23 18:57 - 2013-07-23 18:55 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-07-23 18:36 - 2012-08-02 22:14 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\ProgramData\EPSON
2013-07-19 19:49 - 2013-07-19 19:49 - 00000000 ____D C:\Program Files\Common Files\EPSON
2013-07-14 15:47 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PCDr
2013-07-13 19:21 - 2012-09-05 18:50 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001UA
2013-07-13 19:21 - 2012-09-05 18:50 - 00003712 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1440466351-2282255906-3086371156-1001Core
2013-07-12 20:23 - 2012-08-06 18:53 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-12 20:23 - 2012-08-06 18:53 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 21:30 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 21:30 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 21:30 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 21:30 - 2009-07-14 06:45 - 00531928 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-11 20:13 - 2012-07-13 16:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 20:06 - 2012-07-15 14:04 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 19:12 - 2012-07-15 18:11 - 00000000 ____D C:\Windows\System32\Tasks\TVT
2013-07-11 19:12 - 2012-07-15 13:27 - 00000000 ____D C:\Program Files (x86)\Lenovo
2013-07-11 19:00 - 2013-06-27 20:31 - 00000512 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-07-10 20:06 - 2013-07-10 20:06 - 01179136 _____ C:\Users\garfield\Desktop\TastaturSperren.exe
2013-07-10 20:05 - 2013-07-10 19:29 - 00003776 _____ C:\Users\garfield\Desktop\TastaturSperren.ahk
2013-07-10 19:57 - 2013-06-27 20:31 - 00004222 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-07-10 19:52 - 2013-07-10 19:52 - 00001351 _____ C:\Users\garfield\Documents\AutoHotkey.ahk
2013-07-10 19:34 - 2013-07-10 19:34 - 00000000 ____D C:\Program Files\AutoHotkey
2013-07-10 19:34 - 2012-07-13 20:07 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-10 19:34 - 2012-07-13 20:07 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-10 19:34 - 2009-07-14 20:18 - 00000000 ____D C:\Windows\ShellNew
2013-07-10 19:30 - 2013-07-10 19:30 - 02637267 _____ C:\Users\garfield\Downloads\AutoHotkey_L_Install.exe
2013-07-10 19:29 - 2012-09-03 21:38 - 00000000 ____D C:\Users\garfield\AppData\Local\Adobe
2013-07-07 14:32 - 2013-07-07 14:32 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-07 14:32 - 2013-07-07 14:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-07 14:32 - 2013-07-07 14:32 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-07 14:32 - 2013-02-08 21:52 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-07 14:32 - 2013-02-08 21:52 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-07 14:21 - 2013-07-07 14:18 - 31714216 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-i586.exe
2013-07-07 14:19 - 2013-07-07 14:17 - 07840209 _____ (Oracle Corporation) C:\Users\garfield\Downloads\jre-7u25-windows-x64.exe.part
2013-07-07 14:17 - 2013-07-07 14:17 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-07 14:17 - 2013-07-07 14:17 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-07 14:17 - 2013-07-07 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-07 09:39 - 2013-07-07 09:39 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-07 09:39 - 2013-03-31 12:51 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-07-07 09:39 - 2012-07-13 17:16 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-07-04 18:41 - 2012-07-13 16:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 21:00 - 2013-07-03 21:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-01 21:04 - 2013-07-01 19:55 - 00001187 ____H C:\Windows\EPMBatch.ept
2013-07-01 19:28 - 2013-07-01 19:28 - 00001490 _____ C:\Users\Public\Desktop\EASEUS Partition Master 4.1.1 Professional Edition.lnk
2013-07-01 19:28 - 2013-07-01 19:28 - 00000000 ____D C:\Program Files (x86)\EASEUS
2013-06-30 12:27 - 2012-07-17 22:33 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Dropbox
2013-06-30 12:27 - 2012-07-13 15:32 - 00000000 ___RD C:\Users\garfield\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-29 19:59 - 2012-08-26 18:07 - 00005430 _____ C:\Users\garfield\AppData\Roaming\LTspiceIV.ini
2013-06-27 21:06 - 2012-10-13 17:57 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-06-27 20:31 - 2013-06-27 20:31 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2013-06-27 20:08 - 2013-06-27 20:03 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2013-06-27 20:08 - 2012-07-15 18:53 - 00000000 ____D C:\Program Files\Lenovo
2013-06-27 20:04 - 2013-06-27 20:04 - 00000000 ____D C:\Users\garfield\AppData\Local\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\LSC
2013-06-27 20:03 - 2013-06-27 20:03 - 00000000 ____D C:\Users\garfield\AppData\Roaming\Lenovo
2013-06-27 19:59 - 2012-07-15 18:52 - 00000000 ____D C:\Windows\Downloaded Installations
2013-06-27 19:32 - 2013-02-07 18:39 - 00002413 _____ C:\Windows\SysWOW64\lgAxconfig.ini
2013-06-27 18:25 - 2013-02-07 18:38 - 00000000 ____D C:\ProgramData\LGMOBILEAX

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 20:58

==================== End Of Log ============================

--- --- ---

schrauber · 26.07.2013, 09:45

Adobe updaten. Alle Passwörter und Zugänge ändern. Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

garfield01 · 27.07.2013, 20:18

Hallo schrauber,

ich bin fasziniert. avast findet keine verseuchte .exe mehr.

Mich würde schon interessieren wie man aus diesen Logfiles die ensprechenden trojaner rausließt.
Habt ihr da nochmal ne Software welche die Logfiles untersucht ?

Und wie ist es dann möglich aus vorhandene exe dateien den trojaner dann wieder rauszubekommen ?

Auf jedenfall vielen Dank für deine Hilfe.

Es scheint erstmal alles wieder zu funktionieren.
Unglaublich

grüße garfield01