GVU - Trojaner alles tot

MaThi · 08.08.2013, 10:14

Hallo

Ich habe mir gestern einen GVU-Trojaner eingefangen.
Vor gut einem Jahr hatte ich dieses Problem schonmal, konnte es auch mit rstrui.exe "reperieren". Nun komme ich aber gar nicht so weit.
Selbst das Starten im abgesicherten Modus mit Eingabe funktioniert nicht. Das Laptop fährt direkt wirder runter und macht ´nen Neustart, wo wieder das GVU-Bild erscheint.
Habe schon Kaspersky Rescue Disk per USB durchgeführt. Der Trojaner wurde erkannt und angeblich auch gelöscht. Trotzdem war beim normalen Neustart wieder GVU zu sehen...

Ich hoffe jemand kann mir helfen, ohne das ich Windows "rüberbügeln" muss.

BS: Windows Vista
Notebook: Asus/AMD Athlon X2/64

schrauber · 08.08.2013, 10:20

hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)

Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)

Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit

Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.

Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:

Über den Boot Manager:

Starte den Rechner neu.

Während dem Hochfahren drücke mehrmals die F8 Taste

Wähle nun Computer reparieren.

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD (auch bei Windows 8 möglich):

Lege die Windows CD in dein Laufwerk.

Starte den Rechner neu und starte von der CD.

Wähle die Spracheinstellungen und klicke "Weiter".

Klicke auf Computerreparaturoptionen !

Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen: Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.

Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.

Schließe Notepad wieder

Gib nun bitte folgenden Befehl ein.
e:\frst.exe bzw. e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.

Akzeptiere den Disclaimer mit Ja und klicke Untersuchen

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

MaThi · 09.08.2013, 09:32

Hi

Danke, das Du mir hilfst!!!

Gleich am Anfang kommen wir leider schon zu einem weiteren Problem: Ich hab keine Ahnung wie mein Passwort ist. Habe den Laptop 2008 gekauft und bin mir garnicht mehr sicher ob ich überhaupt ´n Passwort vergeben habe. Windows war schon vom Händler vorinstalliert.

Gibt´s ´ne Möglichkeit diesen Punkt zu überspringen, bzw das Tool direkt vom Stick zu starten indem ich vom Stick boote??

Gruß
MaThi

Ich nochmal...

Wer kein Passwort vergibt, muss auch nix eingeben

Bin soweit durchgekommen...

Nun erkennt er meinen Stick bzw das laufwerk nicht.

´f:\frst64.exe´ is not recognized as an internal or external command, operable program or batchfile

Laufwerk F ist aber richtig und dieses I-Mash ist auch auf´n Stick...

LG
MaThi

schrauber · 09.08.2013, 10:53

Mit Laufwerk F biste sicher? Und FRST64.exe liegt auch im Hauptverzeichnis des Sticks und nit in einem Unterordner? Wenn ja einfach

FRST64.exe eingeben, ohne das F

MaThi · 15.08.2013, 08:00

Moin

Es funktioniert wieder :-D

Allerdings habe ich nun einfach den Rechner zurückgesetzt. Nachdem ich ohne Passwort endlich in den Reparaturoptionen war konnte ich da was machen.
Mit dem Stick und der Frst.exe hat es leider nicht geklappt. Das Laufwerk war richtig und der USB-Stick war nach Anleitung bespielt. Keine Ahnung warum es nicht ging :-/
Trotzdem VIELEN VIELEN DANK für deine Unterstützung und hilfe ! ! !
Dieses Board ist echt ´ne klasse Sache

Gruß
MaThi

schrauber · 15.08.2013, 14:21

Kontrollscans im normalen Modus wären angebracht

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

MaThi · 20.08.2013, 09:36

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 20/08/2013 um 10:13:29 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : besitzer - BESITZER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\besitzer\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files\ChatZum Toolbar
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Users\besitzer\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\besitzer\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\besitzer\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\besitzer\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\besitzer\AppData\LocalLow\Smartbar

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\ChatZum Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ChatZum Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35D-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\SmartbarBackup
Schlüssel Gelöscht : HKCU\Software\SmartbarLog
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\ChatZum Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.BHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2325506
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2866295
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16496

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=5d90f53d-03b6-482e-9529-b5f7cacc9a18&searchtype=ds&q={searchTerms}&installDate=05/04/2013 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=5d90f53d-03b6-482e-9529-b5f7cacc9a18&searchtype=ds&q={searchTerms}&installDate=05/04/2013 --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=5d90f53d-03b6-482e-9529-b5f7cacc9a18&searchtype=ds&q={searchTerms}&installDate=05/04/2013 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=QuickObrw&dpid=QuickObrw&co=DE&userid=5d90f53d-03b6-482e-9529-b5f7cacc9a18&searchtype=ds&q={searchTerms}&installDate=05/04/2013 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.chatzum.com/ --> hxxp://www.google.com

*************************

AdwCleaner[S1].txt - [6271 octets] - [20/08/2013 10:13:29]

########## EOF - C:\AdwCleaner[S1].txt - [6331 octets] ##########

--- --- ---

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-08-2013 03
Ran by besitzer at 2013-08-20 10:33:19
Running from C:\Users\besitzer\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 1.0.0)
Adobe Flash Player 11 ActiveX (Version: 11.6.602.180)
Adobe Reader 8.1.4 - Deutsch (Version: 8.1.4)
AMD USB Audio Driver Filter (Version: 1.0.6.0005)
Apple Application Support (Version: 2.1.6)
Apple Mobile Device Support (Version: 4.0.0.97)
Apple Software Update (Version: 2.1.3.127)
ASUS CopyProtect (Version: 1.0.0006)
ASUS Data Security Manager (Version: 1.00.0006)
ASUS InstantFun (Version: 1.0.0015)
ASUS Live Update (Version: 2.5.6)
ASUS MultiFrame (Version: 1.0.0017)
ASUS Power4Gear eXtreme (Version: 1.0.17)
ASUS SmartLogon (Version: 1.0.0005)
ASUS Splendid Video Enhancement Technology (Version: 1.02.0020)
Asus_Camera_ScreenSaver (Version: 2.0.0007)
Atheros Driver Installation Program (Version: 7.1)
ATI Catalyst Install Manager (Version: 3.0.678.0)
ATK Generic Function Service (Version: 1.00.0008)
ATK Hotkey (Version: 1.00.0034)
ATK Media
ATKOSD2 (Version: 6.64.1.8)
Avira Free Antivirus (Version: 13.0.0.3885)
capella 2008 (Version: 6.00.2000)
Catalyst Control Center Core Implementation (Version: 2008.0603.2230.38408)
Catalyst Control Center Graphics Full Existing (Version: 2008.0603.2230.38408)
Catalyst Control Center Graphics Full New (Version: 2008.0603.2230.38408)
Catalyst Control Center Graphics Light (Version: 2008.0603.2230.38408)
Catalyst Control Center Graphics Previews Vista (Version: 2008.0603.2230.38408)
Catalyst Control Center InstallProxy (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Chinese Standard (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Chinese Traditional (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Czech (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Danish (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Dutch (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Finnish (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization French (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization German (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Greek (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Hungarian (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Italian (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Japanese (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Korean (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Norwegian (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Polish (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Portuguese (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Russian (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Spanish (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Swedish (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Thai (Version: 2008.0603.2230.38408)
Catalyst Control Center Localization Turkish (Version: 2008.0603.2230.38408)
CCC Help Chinese Standard (Version: 2008.0603.2229.38408)
CCC Help Chinese Traditional (Version: 2008.0603.2229.38408)
CCC Help Czech (Version: 2008.0603.2229.38408)
CCC Help Danish (Version: 2008.0603.2229.38408)
CCC Help Dutch (Version: 2008.0603.2229.38408)
CCC Help English (Version: 2008.0603.2229.38408)
CCC Help Finnish (Version: 2008.0603.2229.38408)
CCC Help French (Version: 2008.0603.2229.38408)
CCC Help German (Version: 2008.0603.2229.38408)
CCC Help Greek (Version: 2008.0603.2229.38408)
CCC Help Hungarian (Version: 2008.0603.2229.38408)
CCC Help Italian (Version: 2008.0603.2229.38408)
CCC Help Japanese (Version: 2008.0603.2229.38408)
CCC Help Korean (Version: 2008.0603.2229.38408)
CCC Help Norwegian (Version: 2008.0603.2229.38408)
CCC Help Polish (Version: 2008.0603.2229.38408)
CCC Help Portuguese (Version: 2008.0603.2229.38408)
CCC Help Russian (Version: 2008.0603.2229.38408)
CCC Help Spanish (Version: 2008.0603.2229.38408)
CCC Help Swedish (Version: 2008.0603.2229.38408)
CCC Help Thai (Version: 2008.0603.2229.38408)
CCC Help Turkish (Version: 2008.0603.2229.38408)
ccc-core-static (Version: 2008.0603.2230.38408)
ccc-utility (Version: 2008.0603.2230.38408)
CCleaner (Version: 4.04)
CyberLink LabelPrint (Version: 2.0.2830)
DATA BECKER web to date 8 (Version: 8.0.0.2377)
FileZilla Client 3.5.3 (Version: 3.5.3)
HP Wireless Printer Adapter (Version: 1.00.2000)
iCloud (Version: 1.0.2.17)
ImagXpress (Version: 7.0.74.0)
iTunes (Version: 10.5.2.11)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
LightScribe System Software  1.12.37.1 (Version: 1.12.37.1)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office SharePoint Designer 2007 (Version: 12.0.6612.1000)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
Microsoft Office SharePoint Designer MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Picture It! Foto Premium 9 (Version: 9.0.0.0000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MobileMe Control Panel (Version: 3.1.8.0)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Multimedia Card Reader (Version: 1.01.0000.00)
NB Probe
neroxml (Version: 1.0.0)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PDFCreator (Version: 0.9.5)
Power2Go (Version: 5.6.3917)
Protect Disc License Helper 1.0.125 (IE) (HKCU Version: 1.0.125)
ProtectDisc Driver, Version 11 (Version: 11.0.0.14)
QuickTime (Version: 7.71.80.42)
RawPacketDriver (Version: 5.5.1805)
Safari (Version: 5.34.52.7)
Skins (Version: 2008.0603.2230.38408)
Synaptics Pointing Device Driver (Version: 10.1.8.0)
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
VLC media player 1.0.5 (Version: 1.0.5)
WIDCOMM Bluetooth Software (Version: 5.2.0.500)
WinFlash
WinRAR
Wireless Console 2 (Version: 2.0.10)
 

==================== Restore Points  =========================

02-04-2013 06:50:30 Windows Update
03-04-2013 06:07:38 Geplanter Prüfpunkt
20-04-2013 12:58:59 Windows Update
28-04-2013 13:30:46 Windows Update
30-05-2013 13:21:32 Windows Update
02-07-2013 13:47:27 Windows Update
10-07-2013 17:46:54 Windows Update
30-07-2013 08:51:06 Geplanter Prüfpunkt
06-08-2013 09:49:24 Windows Update
10-08-2013 14:59:09 Removed Bonjour
14-08-2013 08:45:06 Windows Update
15-08-2013 11:34:58 Geplanter Prüfpunkt
19-08-2013 08:29:27 Geplanter Prüfpunkt
20-08-2013 07:32:07 Removed Lexware Info Service.
20-08-2013 07:33:27 Removed SweetIM for Messenger 2.8
20-08-2013 07:35:01 Removed SweetIM Toolbar for Internet Explorer 3.6
20-08-2013 07:35:45 Removed Steuer 2010.
20-08-2013 07:55:41 Removed Java(TM) 6 Update 26
20-08-2013 07:57:03 Installed Java 7 Update 25

==================== Hosts content: ==========================

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1FC22C39-9C55-4754-AA43-5CFBC8B29EE5} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.)
Task: {21372B92-7A57-410E-8708-6D47C2A4D806} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {4A9A5451-C44D-4820-A023-334897C00B5E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {56BD6C9E-3AF8-4B21-8F9F-00EBA0947C64} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files\ASUS\SmartLogon\sensorsrv.exe [2008-06-18] (ASUS)
Task: {5C8F26BB-FBB3-448D-8A83-A50CE38FFFEE} - System32\Tasks\ASUS Live Update => C:\Program Files\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {5F56D466-DD3C-4080-B1B2-00794A20F5C0} - System32\Tasks\User_Feed_Synchronization-{CB9D4EE0-A2E4-41A8-A733-477748772518} => C:\Windows\system32\msfeedssync.exe [2011-10-05] (Microsoft Corporation)
Task: {67701D22-FA43-496C-98BB-7C464D835003} - System32\Tasks\GoforFilesUpdate => C:\Program Files\GoforFiles\GFFUpdater.exe No File
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\rundll32.exe [2006-11-02] (Microsoft Corporation)
Task: {B217BAA8-A913-44E4-9930-5235B849FA44} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-12] (Microsoft Corporation)
Task: {B966B07A-D37C-48C3-8839-F2AD111F15DA} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {C97E7E30-ED50-4B6F-82FE-FCE20AC41194} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2008-01-21] (Microsoft Corporation)
Task: {CC6D077C-0B37-47E1-990A-69CCE2654408} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/20/2013 10:25:58 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/20/2013 09:48:03 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/20/2013 09:44:59 AM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (08/14/2013 05:05:16 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/14/2013 05:01:03 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

Error: (08/10/2013 03:27:03 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: -255

Error: (08/10/2013 03:27:03 PM) (Source: ESENT) (User: )
Description: Catalog Database (2252) Catalog Database: Bei Datenbankwiederherstellung trat ein unerwarteter Fehler -255 auf.

Error: (08/10/2013 03:27:03 PM) (Source: ESENT) (User: )
Description: Catalog Database (2252) Catalog Database: Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb: Fehler bei Überprüfung von Seite 2218 (0x000008aa) wegen einer Nichtübereinstimmung in einer Leerungsreihenfolge-Abhängigkeit. Diese Seite muss vor Seite 650 (0x0000028a) geleert werden, letztere wurde jedoch zuerst geleert. Die Wiederherstellung führt zu Fehler -255. Wenn dieser Zustand andauert, stellen Sie die Datenbank aus einer früheren Sicherung wieder her. Diesem Problem liegt vermutlich ein Hardwarefehler zugrunde, wobei in der Vergangenheit mindestens eine Leerung für eine oder beide der Seiten verloren gegangen ist. Wenden Sie sich an den Hardwarehersteller, um Hilfe bei der Problemdiagnose zu erhalten.

Error: (08/10/2013 03:26:56 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/10/2013 03:26:46 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Während der Initialisierung der Suchengine trat ein unbekannter Fehler auf!
Fehlercode: 0x35


System errors:
=============
Error: (08/20/2013 10:27:50 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/20/2013 10:26:00 AM) (Source: Service Control Manager) (User: )
Description: IPsec-Richtlinien-AgentBFE

Error: (08/20/2013 10:26:00 AM) (Source: Service Control Manager) (User: )
Description: Nero BackItUp Scheduler 4.0%%2

Error: (08/20/2013 10:26:00 AM) (Source: Service Control Manager) (User: )
Description: IKE- und AuthIP IPsec-SchlüsselerstellungsmoduleBFE

Error: (08/20/2013 10:26:00 AM) (Source: Service Control Manager) (User: )
Description: Computerbrowser%%1060

Error: (08/20/2013 09:50:44 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (08/20/2013 09:48:04 AM) (Source: Service Control Manager) (User: )
Description: IPsec-Richtlinien-AgentBFE

Error: (08/20/2013 09:48:04 AM) (Source: Service Control Manager) (User: )
Description: Nero BackItUp Scheduler 4.0%%2

Error: (08/20/2013 09:48:04 AM) (Source: Service Control Manager) (User: )
Description: IKE- und AuthIP IPsec-SchlüsselerstellungsmoduleBFE

Error: (08/20/2013 09:48:04 AM) (Source: Service Control Manager) (User: )
Description: Computerbrowser%%1060


Microsoft Office Sessions:
=========================
Error: (04/09/2009 10:02:53 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 258 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (02/16/2009 02:59:46 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 33 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-01-20 18:52:47.400
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-20 18:52:46.730
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-20 18:52:46.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-20 18:52:45.372
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-20 18:52:38.883
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-20 18:52:38.228
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-20 18:52:37.588
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-20 18:52:36.933
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-28 09:00:39.787
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-01-28 09:00:39.054
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\KLIFX86\klif.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 2814.39 MB
Available physical RAM: 1646.12 MB
Total Pagefile: 5875.16 MB
Available Pagefile: 4646.1 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.14 MB

==================== Drives ================================

Drive c: (VistaOS) (Fixed) (Total:149.04 GB) (Free:94.11 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:139.28 GB) (Free:125 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 8D1C393D)
Partition 1: (Not Active) - (Size=10 GB) - (Type=1C)
Partition 2: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=139 GB) - (Type=OF Extended)

==================== End Of Log ============================

--- --- ---

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-08-2013 03
Ran by besitzer (administrator) on 20-08-2013 10:32:23
Running from C:\Users\besitzer\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\smartlogon.exe
() C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
() C:\Program Files\ATK Hotkey\ASLDRSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files\ASUS\ASUS Live Update\ALU.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ASUS) C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
(ATK0100) C:\Program Files\ATK Hotkey\Hcontrol.exe
() C:\Program Files\ATK Hotkey\MsgTranAgt.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\ASUS\ATK Media\DMedia.exe
() C:\Program Files\ATK Hotkey\HControlUser.exe
() C:\Program Files\ATKOSD2\ATKOSD2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(DATA BECKER GmbH & Co KG) C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
() C:\Program Files\ATK Hotkey\ATKOSD.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(pdfforge  hxxp://www.pdfforge.org/) C:\Program Files\PDFCreator\PDFCreator.exe
() C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
() C:\Program Files\ATK Hotkey\KBFiltr.exe
() C:\Program Files\ATK Hotkey\WDC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [ATKMEDIA] - C:\Program Files\ASUS\ATK Media\DMEDIA.EXE [61440 2008-02-01] ()
HKLM\...\Run: [ASUS Camera ScreenSaver] - C:\Windows\AsScrProlog.exe [47672 2008-08-13] ()
HKLM\...\Run: [HControlUser] - C:\Program Files\ATK Hotkey\HcontrolUser.exe [98304 2008-01-11] ()
HKLM\...\Run: [ATKOSD2] - C:\Program Files\ATKOSD2\ATKOSD2.exe [7766016 2008-01-23] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-10-15] (Adobe Systems Incorporated)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421736 2011-12-08] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$0d3f01397e363c3c979a162a01896066\n. ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2289664 2008-03-18] (Hewlett-Packard Company)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3695063491-2218346931-3815357980-1000\$0d3f01397e363c3c979a162a01896066\n. ATTENTION! ====> ZeroAccess?
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PDFCreator.lnk
ShortcutTarget: PDFCreator.lnk -> C:\Program Files\PDFCreator\PDFCreator.exe (pdfforge  hxxp://www.pdfforge.org/)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Verbindungsmanager.lnk
ShortcutTarget: Verbindungsmanager.lnk -> C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU -No Name - {B9D63C58-90CC-428B-8D3B-CBB88EB07E7E} -  No File
Toolbar: HKCU -No Name - {26647CA4-A2A7-4EAC-8A72-761AA9141DE7} -  No File
Handler: msdaipp - No CLSID Value - 
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

========================== Services (Whitelisted) =================

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-02] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [94208 2007-10-02] ()
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
R2 DBService; C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()
S2 Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [x]

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [25728 2008-10-20] (Google Inc)
R0 AsDsm; C:\Windows\System32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-02] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()
R3 hpnuhst; C:\Windows\System32\DRIVERS\hpnuhst.sys [13824 2007-03-27] (Hewlett-Packard Development Company)
R3 HPNUHUB; C:\Windows\System32\DRIVERS\hpnuhub.sys [35328 2007-10-30] (Hewlett-Packard Development Company)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
S3 PCAMp50; C:\Windows\System32\Drivers\PCAMp50.sys [28224 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S3 PCASp50; C:\Windows\System32\Drivers\PCASp50.sys [27072 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S3 pnetmdm; C:\Windows\System32\DRIVERS\pnetmdm.sys [9472 2006-09-28] (June Fabrics Technology)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2008-10-18] ()
S3 ASUSProcObsrv; \??\E:\I386\AsProcOb.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-20 10:30 - 2013-08-20 10:30 - 01070241 _____ (Farbar) C:\Users\besitzer\Desktop\FRST.exe
2013-08-20 10:13 - 2013-08-20 10:13 - 00006400 _____ C:\AdwCleaner[S1].txt
2013-08-20 10:11 - 2013-08-20 10:11 - 00666633 _____ C:\Users\besitzer\Desktop\adwcleaner.exe
2013-08-20 10:04 - 2013-08-20 10:04 - 00000000 ____D C:\Program Files\CCleaner
2013-08-20 10:03 - 2013-08-20 10:03 - 03395840 _____ (Piriform Ltd) C:\Users\besitzer\Downloads\ccsetup404_slim.exe
2013-08-20 09:58 - 2013-08-20 09:58 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-20 09:57 - 2013-08-20 09:57 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-20 09:57 - 2013-08-20 09:57 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-19 09:49 - 2013-08-19 09:49 - 00031232 _____ C:\Users\besitzer\Desktop\Schichten2013.xls
2013-08-19 09:23 - 2013-08-19 09:23 - 00050176 _____ C:\Users\besitzer\Desktop\kalender-2013-hochformat-2-seiten.xls
2013-08-14 13:56 - 2013-08-14 13:56 - 00011704 _____ C:\Users\besitzer\Desktop\You_Shook_me_all_night_long_Partitur_1.cap
2013-08-14 10:51 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 10:51 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 10:51 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 10:51 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-14 10:51 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 10:51 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 10:51 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-14 10:51 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 10:51 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-14 10:51 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-14 10:51 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 10:51 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 10:51 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 10:51 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 10:51 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-14 10:51 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-10 15:52 - 2013-06-04 03:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-08-10 15:52 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-08-10 15:52 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-08-10 15:52 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-08-10 15:52 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-08-10 15:52 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-10 15:52 - 2013-04-17 12:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-08-10 15:49 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-07 10:15 - 2013-08-07 10:15 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-06 10:03 - 2013-08-06 10:03 - 00163105 _____ C:\Users\besitzer\AppData\Local\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163071 _____ C:\ProgramData\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163025 _____ C:\Users\besitzer\AppData\Roaming\2433f433

==================== One Month Modified Files and Folders =======

2013-08-20 10:32 - 2013-08-20 10:32 - 00000000 ____D C:\FRST
2013-08-20 10:30 - 2013-08-20 10:30 - 01070241 _____ (Farbar) C:\Users\besitzer\Desktop\FRST.exe
2013-08-20 10:29 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-20 10:29 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-20 10:28 - 2008-08-13 04:40 - 01377106 _____ C:\Windows\WindowsUpdate.log
2013-08-20 10:24 - 2008-09-30 21:33 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-08-20 10:24 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-20 10:14 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-20 10:13 - 2013-08-20 10:13 - 00006400 _____ C:\AdwCleaner[S1].txt
2013-08-20 10:13 - 2010-07-14 12:51 - 00000000 ____D C:\ProgramData\ICQ
2013-08-20 10:11 - 2013-08-20 10:11 - 00666633 _____ C:\Users\besitzer\Desktop\adwcleaner.exe
2013-08-20 10:05 - 2010-04-07 17:45 - 00000000 ____D C:\Users\besitzer\AppData\Roaming\FileZilla
2013-08-20 10:05 - 2008-04-16 13:27 - 00000000 ____D C:\Windows\Panther
2013-08-20 10:04 - 2013-08-20 10:04 - 00000000 ____D C:\Program Files\CCleaner
2013-08-20 10:03 - 2013-08-20 10:03 - 03395840 _____ (Piriform Ltd) C:\Users\besitzer\Downloads\ccsetup404_slim.exe
2013-08-20 09:58 - 2013-08-20 09:58 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-20 09:57 - 2013-08-20 09:57 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-20 09:57 - 2013-08-20 09:57 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-20 09:57 - 2010-07-06 09:51 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-20 09:57 - 2010-07-06 09:51 - 00000000 ____D C:\Program Files\Java
2013-08-20 09:41 - 2008-12-22 23:54 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-08-20 09:41 - 2008-12-22 23:54 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-08-20 09:38 - 2011-12-13 18:33 - 00000000 ____D C:\Program Files\Common Files\Lexware
2013-08-19 09:49 - 2013-08-19 09:49 - 00031232 _____ C:\Users\besitzer\Desktop\Schichten2013.xls
2013-08-19 09:23 - 2013-08-19 09:23 - 00050176 _____ C:\Users\besitzer\Desktop\kalender-2013-hochformat-2-seiten.xls
2013-08-15 10:30 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-15 08:37 - 2010-04-09 12:24 - 00000680 _____ C:\Users\besitzer\AppData\Local\d3d9caps.dat
2013-08-14 17:04 - 2006-11-02 14:47 - 00496040 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-14 17:02 - 2012-02-22 19:05 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-14 17:01 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-08-14 13:56 - 2013-08-14 13:56 - 00011704 _____ C:\Users\besitzer\Desktop\You_Shook_me_all_night_long_Partitur_1.cap
2013-08-14 11:07 - 2006-11-02 12:33 - 01469650 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-14 11:03 - 2006-11-02 12:23 - 00000275 _____ C:\Windows\win.ini
2013-08-14 10:56 - 2006-11-02 12:24 - 75699896 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-14 10:54 - 2008-08-13 04:47 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 10:46 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-13 15:17 - 2010-09-23 17:19 - 00000000 ____D C:\Users\besitzer\AppData\Roaming\vlc
2013-08-13 15:01 - 2009-06-09 23:30 - 00016384 _____ C:\Users\besitzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-10 16:53 - 2013-01-20 19:44 - 00000000 ____D C:\Program Files\Avira
2013-08-10 15:51 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-08-09 21:07 - 2008-09-30 21:33 - 00000000 ____D C:\Users\besitzer
2013-08-09 21:07 - 2006-11-02 12:22 - 50593792 _____ C:\Windows\system32\config\software_previous
2013-08-09 21:06 - 2008-08-13 06:22 - 00000000 ____D C:\ProgramData\P4G
2013-08-09 21:06 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\ShellNew
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-08-09 21:06 - 2006-11-02 12:22 - 120848384 _____ C:\Windows\system32\config\system_previous
2013-08-09 20:55 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-08-09 20:55 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-08-09 11:08 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-08 08:28 - 2012-09-06 10:42 - 00000000 ____D C:\Program Files\Common Files\DATA BECKER Shared
2013-08-07 10:15 - 2013-08-07 10:15 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-06 11:46 - 2006-11-02 12:22 - 46661632 _____ C:\Windows\system32\config\components_previous
2013-08-06 11:46 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-08-06 10:03 - 2013-08-06 10:03 - 00163105 _____ C:\Users\besitzer\AppData\Local\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163071 _____ C:\ProgramData\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163025 _____ C:\Users\besitzer\AppData\Roaming\2433f433

Files to move or delete:
====================
C:\ProgramData\472630756.pad
C:\Users\besitzer\-331866838.exe
C:\Users\besitzer\install_icq65_1042.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-20 10:31

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 20.08.2013, 12:52

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

MaThi · 20.08.2013, 17:18

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=367e01c21fd05d458d95cce46f8f2c95
# engine=14839
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-20 04:01:36
# local_time=2013-08-20 06:01:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 12120 242437786 4882 0
# compatibility_mode=5892 16776574 66 100 12126402 214547224 0 0
# scanned=147134
# found=4
# cleaned=0
# scan_time=7499
sh=4F51A48E9E449AB4D9F3262368F1E77EA090CB75 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.NPU trojan" ac=I fn="C:\Users\besitzer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\31e88e41-38b47056"
sh=F698EFFC7A448D6B5258BA9278A7BAE470F1A048 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.BI trojan" ac=I fn="C:\Users\besitzer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\ec3b9f-1944237d"
sh=C0170153419734B53877CCA940B0422174C91C4F ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\besitzer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\37f77eac-343abb0b"
sh=D4A82F8068F860799054686FFB3346AE4B746A35 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\besitzer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\61b4aef1-2986180c"

Results of screen317's Security Check version 0.99.72
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
CCleaner
Java 7 Update 25
Adobe Reader 8 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-08-2013 03
Ran by besitzer (administrator) on 20-08-2013 18:17:09
Running from C:\Users\besitzer\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
() C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
() C:\Program Files\ATK Hotkey\ASLDRSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(DATA BECKER GmbH & Co KG) C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\smartlogon.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files\ASUS\ASUS Live Update\ALU.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ASUS) C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
(ATK0100) C:\Program Files\ATK Hotkey\Hcontrol.exe
() C:\Program Files\ATK Hotkey\MsgTranAgt.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
() C:\Program Files\ATK Hotkey\ATKOSD.exe
() C:\Program Files\ATK Hotkey\KBFiltr.exe
() C:\Program Files\ATK Hotkey\WDC.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\ASUS\ATK Media\DMedia.exe
() C:\Program Files\ATK Hotkey\HControlUser.exe
() C:\Program Files\ATKOSD2\ATKOSD2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(pdfforge  hxxp://www.pdfforge.org/) C:\Program Files\PDFCreator\PDFCreator.exe
() C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [ATKMEDIA] - C:\Program Files\ASUS\ATK Media\DMEDIA.EXE [61440 2008-02-01] ()
HKLM\...\Run: [ASUS Camera ScreenSaver] - C:\Windows\AsScrProlog.exe [47672 2008-08-13] ()
HKLM\...\Run: [HControlUser] - C:\Program Files\ATK Hotkey\HcontrolUser.exe [98304 2008-01-11] ()
HKLM\...\Run: [ATKOSD2] - C:\Program Files\ATKOSD2\ATKOSD2.exe [7766016 2008-01-23] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-10-15] (Adobe Systems Incorporated)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421736 2011-12-08] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$0d3f01397e363c3c979a162a01896066\n. ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2289664 2008-03-18] (Hewlett-Packard Company)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex [706776 2013-04-02] (Adobe Systems Incorporated)
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3695063491-2218346931-3815357980-1000\$0d3f01397e363c3c979a162a01896066\n. ATTENTION! ====> ZeroAccess?
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PDFCreator.lnk
ShortcutTarget: PDFCreator.lnk -> C:\Program Files\PDFCreator\PDFCreator.exe (pdfforge  hxxp://www.pdfforge.org/)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Verbindungsmanager.lnk
ShortcutTarget: Verbindungsmanager.lnk -> C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU -No Name - {B9D63C58-90CC-428B-8D3B-CBB88EB07E7E} -  No File
Toolbar: HKCU -No Name - {26647CA4-A2A7-4EAC-8A72-761AA9141DE7} -  No File
Handler: msdaipp - No CLSID Value - 
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

========================== Services (Whitelisted) =================

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-02] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [94208 2007-10-02] ()
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
R2 DBService; C:\Program Files\Common Files\DATA BECKER Shared\DBService.exe [189776 2010-10-28] (DATA BECKER GmbH & Co KG)
R2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()
S2 Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [x]

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [25728 2008-10-20] (Google Inc)
R0 AsDsm; C:\Windows\System32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-02] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()
R3 hpnuhst; C:\Windows\System32\DRIVERS\hpnuhst.sys [13824 2007-03-27] (Hewlett-Packard Development Company)
R3 HPNUHUB; C:\Windows\System32\DRIVERS\hpnuhub.sys [35328 2007-10-30] (Hewlett-Packard Development Company)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
S3 PCAMp50; C:\Windows\System32\Drivers\PCAMp50.sys [28224 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S3 PCASp50; C:\Windows\System32\Drivers\PCASp50.sys [27072 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S3 pnetmdm; C:\Windows\System32\DRIVERS\pnetmdm.sys [9472 2006-09-28] (June Fabrics Technology)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2008-10-18] ()
S3 ASUSProcObsrv; \??\E:\I386\AsProcOb.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-20 15:52 - 2013-08-20 15:52 - 02347384 _____ (ESET) C:\Users\besitzer\Desktop\esetsmartinstaller_enu.exe
2013-08-20 11:03 - 2013-08-20 11:03 - 00000432 _____ C:\Windows\PFRO.log
2013-08-20 10:55 - 2013-08-20 10:59 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 10:46 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-20 10:46 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-20 10:46 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-20 10:46 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-20 10:46 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-20 10:46 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-20 10:46 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-20 10:46 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-20 10:46 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-20 10:46 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-20 10:46 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-20 10:32 - 2013-08-20 10:32 - 00000000 ____D C:\FRST
2013-08-20 10:30 - 2013-08-20 10:30 - 01070241 _____ (Farbar) C:\Users\besitzer\Desktop\FRST.exe
2013-08-20 10:13 - 2013-08-20 10:13 - 00006400 _____ C:\AdwCleaner[S1].txt
2013-08-20 10:04 - 2013-08-20 10:04 - 00000000 ____D C:\Program Files\CCleaner
2013-08-20 10:03 - 2013-08-20 10:03 - 03395840 _____ (Piriform Ltd) C:\Users\besitzer\Downloads\ccsetup404_slim.exe
2013-08-20 09:58 - 2013-08-20 09:58 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-20 09:57 - 2013-08-20 09:57 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-20 09:57 - 2013-08-20 09:57 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-19 09:49 - 2013-08-19 09:49 - 00031232 _____ C:\Users\besitzer\Desktop\Schichten2013.xls
2013-08-19 09:23 - 2013-08-19 09:23 - 00050176 _____ C:\Users\besitzer\Desktop\kalender-2013-hochformat-2-seiten.xls
2013-08-15 08:49 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 08:49 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 08:49 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 08:49 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-15 08:49 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 08:49 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 08:49 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 08:49 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 08:49 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 08:49 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 08:49 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-15 08:49 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 13:56 - 2013-08-14 13:56 - 00011704 _____ C:\Users\besitzer\Desktop\You_Shook_me_all_night_long_Partitur_1.cap
2013-08-10 15:52 - 2013-06-04 03:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-08-10 15:52 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-08-10 15:52 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-08-10 15:52 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-08-10 15:52 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-08-10 15:52 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-10 15:52 - 2013-04-17 12:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-08-10 15:49 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-07 10:15 - 2013-08-07 10:15 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-06 10:03 - 2013-08-06 10:03 - 00163105 _____ C:\Users\besitzer\AppData\Local\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163071 _____ C:\ProgramData\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163025 _____ C:\Users\besitzer\AppData\Roaming\2433f433

==================== One Month Modified Files and Folders =======

2013-08-20 18:10 - 2013-08-20 18:10 - 00891115 _____ C:\Users\besitzer\Desktop\SecurityCheck.exe
2013-08-20 17:39 - 2008-08-13 04:40 - 01571505 _____ C:\Windows\WindowsUpdate.log
2013-08-20 17:05 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-20 17:05 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-20 15:52 - 2013-08-20 15:52 - 02347384 _____ (ESET) C:\Users\besitzer\Desktop\esetsmartinstaller_enu.exe
2013-08-20 13:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-20 11:21 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-08-20 11:05 - 2008-09-30 21:33 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-08-20 11:05 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-20 11:03 - 2013-08-20 11:03 - 00000432 _____ C:\Windows\PFRO.log
2013-08-20 11:02 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-20 11:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-20 10:59 - 2013-08-20 10:55 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 10:55 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-20 10:53 - 2008-08-13 04:47 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-20 10:49 - 2006-11-02 12:33 - 01469650 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-20 10:46 - 2006-11-02 12:23 - 00000275 _____ C:\Windows\win.ini
2013-08-20 10:32 - 2013-08-20 10:32 - 00000000 ____D C:\FRST
2013-08-20 10:30 - 2013-08-20 10:30 - 01070241 _____ (Farbar) C:\Users\besitzer\Desktop\FRST.exe
2013-08-20 10:13 - 2013-08-20 10:13 - 00006400 _____ C:\AdwCleaner[S1].txt
2013-08-20 10:13 - 2010-07-14 12:51 - 00000000 ____D C:\ProgramData\ICQ
2013-08-20 10:05 - 2010-04-07 17:45 - 00000000 ____D C:\Users\besitzer\AppData\Roaming\FileZilla
2013-08-20 10:05 - 2008-04-16 13:27 - 00000000 ____D C:\Windows\Panther
2013-08-20 10:04 - 2013-08-20 10:04 - 00000000 ____D C:\Program Files\CCleaner
2013-08-20 10:03 - 2013-08-20 10:03 - 03395840 _____ (Piriform Ltd) C:\Users\besitzer\Downloads\ccsetup404_slim.exe
2013-08-20 09:58 - 2013-08-20 09:58 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-20 09:57 - 2013-08-20 09:57 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-20 09:57 - 2013-08-20 09:57 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-20 09:57 - 2010-07-06 09:51 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-20 09:57 - 2010-07-06 09:51 - 00000000 ____D C:\Program Files\Java
2013-08-20 09:41 - 2008-12-22 23:54 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-08-20 09:41 - 2008-12-22 23:54 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-08-20 09:38 - 2011-12-13 18:33 - 00000000 ____D C:\Program Files\Common Files\Lexware
2013-08-19 09:49 - 2013-08-19 09:49 - 00031232 _____ C:\Users\besitzer\Desktop\Schichten2013.xls
2013-08-19 09:23 - 2013-08-19 09:23 - 00050176 _____ C:\Users\besitzer\Desktop\kalender-2013-hochformat-2-seiten.xls
2013-08-15 08:37 - 2010-04-09 12:24 - 00000680 _____ C:\Users\besitzer\AppData\Local\d3d9caps.dat
2013-08-14 17:04 - 2006-11-02 14:47 - 00496040 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-14 17:02 - 2012-02-22 19:05 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-14 17:01 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-08-14 13:56 - 2013-08-14 13:56 - 00011704 _____ C:\Users\besitzer\Desktop\You_Shook_me_all_night_long_Partitur_1.cap
2013-08-14 10:46 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-13 15:17 - 2010-09-23 17:19 - 00000000 ____D C:\Users\besitzer\AppData\Roaming\vlc
2013-08-13 15:01 - 2009-06-09 23:30 - 00016384 _____ C:\Users\besitzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-10 16:53 - 2013-01-20 19:44 - 00000000 ____D C:\Program Files\Avira
2013-08-09 21:07 - 2008-09-30 21:33 - 00000000 ____D C:\Users\besitzer
2013-08-09 21:07 - 2006-11-02 12:22 - 50593792 _____ C:\Windows\system32\config\software_previous
2013-08-09 21:06 - 2008-08-13 06:22 - 00000000 ____D C:\ProgramData\P4G
2013-08-09 21:06 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\ShellNew
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-08-09 21:06 - 2006-11-02 12:22 - 120848384 _____ C:\Windows\system32\config\system_previous
2013-08-09 20:55 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-08-09 20:55 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-08-08 08:28 - 2012-09-06 10:42 - 00000000 ____D C:\Program Files\Common Files\DATA BECKER Shared
2013-08-07 10:15 - 2013-08-07 10:15 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-06 11:46 - 2006-11-02 12:22 - 46661632 _____ C:\Windows\system32\config\components_previous
2013-08-06 11:46 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-08-06 10:03 - 2013-08-06 10:03 - 00163105 _____ C:\Users\besitzer\AppData\Local\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163071 _____ C:\ProgramData\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163025 _____ C:\Users\besitzer\AppData\Roaming\2433f433
2013-07-25 04:40 - 2013-08-20 10:46 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-25 04:32 - 2013-08-20 10:46 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-25 04:30 - 2013-08-20 10:46 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-25 04:26 - 2013-08-20 10:46 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-25 04:26 - 2013-08-20 10:46 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-25 04:25 - 2013-08-20 10:46 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-25 04:24 - 2013-08-20 10:46 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-25 04:24 - 2013-08-20 10:46 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-25 04:22 - 2013-08-20 10:46 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-25 04:22 - 2013-08-20 10:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-25 04:22 - 2013-08-20 10:46 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

Files to move or delete:
====================
C:\ProgramData\472630756.pad
C:\Users\besitzer\-331866838.exe
C:\Users\besitzer\install_icq65_1042.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-20 11:10

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 21.08.2013, 07:21

Adobe updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Downloade dir bitte

Farbar Service Scanner

Starte das Tool mit Doppelklick auf die FSS.exe
Gehe sicher, dass folgende Optionen angehakt sind.
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Klicke auf Scan.
Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.

MaThi · 21.08.2013, 08:13

Farbar Service Scanner Version: 18-08-2013
Ran by besitzer (administrator) on 21-08-2013 at 09:11:13
Running from "C:\Users\besitzer\Desktop"
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is set to Disabled. The default start type is Auto.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error. Google IP is unreachable
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo.com returned error: Other errors

Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking LEGACY_MpsSvc: ATTENTION!=====> Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist.

bfe Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking LEGACY_bfe: ATTENTION!=====> Unable to open LEGACY_bfe\0000 registry key. The key does not exist.

Firewall Disabled Policy:
==================
"HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" registry key does not exist.

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

wscsvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking LEGACY_wscsvc: ATTENTION!=====> Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.

Security Center Notification Icon =====> Unable to open HKLM\...\ShellServiceObjects\{FD6905CE-952F-41F1-9A6F-135D9C6622CC} key. The key does not exist.

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Other Services:
==============
Checking Start type of SharedAccess: ATTENTION!=====> Unable to retrieve start type of SharedAccess. The value does not exist.
Checking ImagePath of SharedAccess: ATTENTION!=====> Unable to retrieve ImagePath of SharedAccess. The value does not exist.
Checking ServiceDll of SharedAccess: ATTENTION!=====> Unable to retrieve ServiceDll of SharedAccess. The value does not exist.
Checking FirewallRules of SharedAccess: ATTENTION!=====> Unable to open "SharedAccess\Defaults\FirewallPolicy\FirewallRules" registry key. The key does not exist.
Checking Start type of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ImagePath of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ServiceDll of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-08-15 08:49] - [2013-07-05 06:53] - 0905664 ____A (Microsoft Corporation) D18D53974FD715D50FC76F9FFE1C830D

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-08-15 08:49] - [2013-07-08 06:16] - 0133120 ____A (Microsoft Corporation) 684C130BBC6DB681BAD4920A4C944AA5

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

schrauber · 21.08.2013, 09:54

Downloade dir bitte Windows Repair (All In One) von hier.

Installiere das Programm. Starte es, nachdem die Installation abgeschlossen wurde.
Klicke auf Step 2 und drücke unter Check Disk auf Do It.
Wenn der Vorgang abgeschlossen ist, klicke auf Step 3 und drücke unter System File Check auf Do It.
Nachdem der Vorgang abgeschlossen ist, klicke auf Start Repairs, wähle den Advanced Mode und drücke Start.
Gehe bitte sicher, dass die Kästchen wie unten zu sehen angehakt sind. Bitte hake zusätzlich noch Set Windows Services to Default Startup an.
Hake Restart System when Finished an.
Drücke Start.

Danach bitte rebooten, frisches FSS und FRST log posten. Denk an die Codetags

MaThi · 21.08.2013, 12:29

Code:

ATTFilter

Farbar Service Scanner Version: 18-08-2013
Ran by besitzer (administrator) on 21-08-2013 at 13:19:08
Running from "C:\Users\besitzer\Desktop"
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Disabled Policy: 
========================


Security Center:
============

Security Center Notification Icon =====> Unable to open HKLM\...\ShellServiceObjects\{FD6905CE-952F-41F1-9A6F-135D9C6622CC} key. The key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.


Other Services:
==============
Checking Start type of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ImagePath of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ServiceDll of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-08-15 08:49] - [2013-07-05 06:53] - 0905664 ____A (Microsoft Corporation) D18D53974FD715D50FC76F9FFE1C830D

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-08-15 08:49] - [2013-07-08 06:16] - 0133120 ____A (Microsoft Corporation) 684C130BBC6DB681BAD4920A4C944AA5

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-08-2013
Ran by besitzer (administrator) on 21-08-2013 13:24:22
Running from C:\Users\besitzer\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\smartlogon.exe
() C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
() C:\Program Files\ATK Hotkey\ASLDRSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ASUS) C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files\ASUS\ASUS Live Update\ALU.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(ASUS) C:\Program Files\ASUS\ASUS CopyProtect\aspg.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ATK) C:\Program Files\ASUS\Splendid\ACMON.exe
(ATK0100) C:\Program Files\ATK Hotkey\Hcontrol.exe
() C:\Program Files\ATK Hotkey\MsgTranAgt.exe
(ASUSTeK) C:\Windows\System32\ACEngSvr.exe
() C:\Program Files\ATK Hotkey\ATKOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files\ATK Hotkey\KBFiltr.exe
() C:\Program Files\ATK Hotkey\WDC.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
() C:\Program Files\ASUS\ATK Media\DMedia.exe
() C:\Program Files\ATK Hotkey\HControlUser.exe
() C:\Program Files\ATKOSD2\ATKOSD2.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
(pdfforge  hxxp://www.pdfforge.org/) C:\Program Files\PDFCreator\PDFCreator.exe
() C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [ATKMEDIA] - C:\Program Files\ASUS\ATK Media\DMEDIA.EXE [61440 2008-02-01] ()
HKLM\...\Run: [ASUS Camera ScreenSaver] - C:\Windows\AsScrProlog.exe [47672 2008-08-13] ()
HKLM\...\Run: [HControlUser] - C:\Program Files\ATK Hotkey\HcontrolUser.exe [98304 2008-01-11] ()
HKLM\...\Run: [ATKOSD2] - C:\Program Files\ATKOSD2\ATKOSD2.exe [7766016 2008-01-23] ()
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-10-15] (Adobe Systems Incorporated)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-02] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421736 2011-12-08] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-07-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2289664 2008-03-18] (Hewlett-Packard Company)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3695063491-2218346931-3815357980-1000\$0d3f01397e363c3c979a162a01896066\n. ATTENTION! ====> ZeroAccess?
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PDFCreator.lnk
ShortcutTarget: PDFCreator.lnk -> C:\Program Files\PDFCreator\PDFCreator.exe (pdfforge  hxxp://www.pdfforge.org/)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Verbindungsmanager.lnk
ShortcutTarget: Verbindungsmanager.lnk -> C:\Program Files\HP Wireless Printer Adapter\ConnectMgr.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU -No Name - {B9D63C58-90CC-428B-8D3B-CBB88EB07E7E} -  No File
Toolbar: HKCU -No Name - {26647CA4-A2A7-4EAC-8A72-761AA9141DE7} -  No File
Handler: msdaipp - No CLSID Value - 
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

========================== Services (Whitelisted) =================

R2 ADSMService; C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [73728 2007-05-18] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-07-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-07-02] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [94208 2007-10-02] ()
R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
R2 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [125496 2007-08-03] ()
S2 Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [x]

==================== Drivers (Whitelisted) ====================

R2 acedrv11; C:\Windows\system32\drivers\acedrv11.sys [185472 2010-02-24] (Protect Software GmbH)
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [25728 2008-10-20] (Google Inc)
R0 AsDsm; C:\Windows\System32\Drivers\AsDsm.sys [29752 2007-08-11] (Windows (R) Codename Longhorn DDK provider)
R2 ASMMAP; C:\Program Files\ATKGFNEX\ASMMAP.sys [13880 2007-07-24] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-04-02] (Avira Operations GmbH & Co. KG)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R2 ghaio; C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [20936 2007-08-03] ()
R3 hpnuhst; C:\Windows\System32\DRIVERS\hpnuhst.sys [13824 2007-03-27] (Hewlett-Packard Development Company)
R3 HPNUHUB; C:\Windows\System32\DRIVERS\hpnuhub.sys [35328 2007-10-30] (Hewlett-Packard Development Company)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15928 2008-06-03] ( )
R0 lullaby; C:\Windows\System32\DRIVERS\lullaby.sys [15416 2008-05-29] (Windows (R) Codename Longhorn DDK provider)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2006-12-14] (ATK0100)
S3 PCAMp50; C:\Windows\System32\Drivers\PCAMp50.sys [28224 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S3 PCASp50; C:\Windows\System32\Drivers\PCASp50.sys [27072 2006-11-28] (Printing Communications Assoc., Inc. (PCAUSA))
S3 pnetmdm; C:\Windows\System32\DRIVERS\pnetmdm.sys [9472 2006-09-28] (June Fabrics Technology)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2008-10-18] ()
S3 ASUSProcObsrv; \??\E:\I386\AsProcOb.sys [x]
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-21 12:40 - 2013-08-21 12:40 - 00000000 ____D C:\RegBackup
2013-08-21 12:15 - 2013-08-21 12:15 - 00000000 __SHD C:\found.001
2013-08-21 12:11 - 2013-08-21 13:09 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-08-21 12:07 - 2013-08-21 12:10 - 00000000 ____D C:\Users\besitzer\Desktop\Tweaking.com - Windows Repair
2013-08-21 09:03 - 2013-08-21 09:03 - 00358507 _____ (Farbar) C:\Users\besitzer\Desktop\FSS.exe
2013-08-20 11:03 - 2013-08-21 13:11 - 00001582 _____ C:\Windows\PFRO.log
2013-08-20 10:55 - 2013-08-20 10:59 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 10:46 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-20 10:46 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-20 10:46 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-20 10:46 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-20 10:46 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-20 10:46 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-20 10:46 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-20 10:46 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-20 10:46 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-20 10:46 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-20 10:46 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-20 10:46 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-20 10:32 - 2013-08-20 10:32 - 00000000 ____D C:\FRST
2013-08-20 10:13 - 2013-08-20 10:13 - 00006400 _____ C:\AdwCleaner[S1].txt
2013-08-20 10:04 - 2013-08-20 10:04 - 00000000 ____D C:\Program Files\CCleaner
2013-08-20 10:03 - 2013-08-20 10:03 - 03395840 _____ (Piriform Ltd) C:\Users\besitzer\Downloads\ccsetup404_slim.exe
2013-08-20 09:58 - 2013-08-20 09:58 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-20 09:57 - 2013-08-20 09:57 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-20 09:57 - 2013-08-20 09:57 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-19 09:49 - 2013-08-19 09:49 - 00031232 _____ C:\Users\besitzer\Desktop\Schichten2013.xls
2013-08-19 09:23 - 2013-08-19 09:23 - 00050176 _____ C:\Users\besitzer\Desktop\kalender-2013-hochformat-2-seiten.xls
2013-08-15 08:49 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-15 08:49 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-15 08:49 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-15 08:49 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-15 08:49 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-15 08:49 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-15 08:49 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-15 08:49 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-15 08:49 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-15 08:49 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-15 08:49 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-15 08:49 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 13:56 - 2013-08-14 13:56 - 00011704 _____ C:\Users\besitzer\Desktop\You_Shook_me_all_night_long_Partitur_1.cap
2013-08-10 15:52 - 2013-06-04 03:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-08-10 15:52 - 2013-06-01 06:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-10 15:52 - 2013-04-17 13:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-08-10 15:52 - 2013-04-17 12:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-08-10 15:52 - 2013-04-17 12:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-08-10 15:52 - 2013-04-17 12:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-08-10 15:52 - 2013-04-17 12:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-10 15:52 - 2013-04-17 12:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-08-10 15:49 - 2013-05-08 06:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-07 10:15 - 2013-08-07 10:15 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-06 10:03 - 2013-08-06 10:03 - 00163105 _____ C:\Users\besitzer\AppData\Local\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163071 _____ C:\ProgramData\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163025 _____ C:\Users\besitzer\AppData\Roaming\2433f433

==================== One Month Modified Files and Folders =======

2013-08-21 13:23 - 2013-08-21 13:23 - 01070183 _____ (Farbar) C:\Users\besitzer\Desktop\FRST.exe
2013-08-21 13:19 - 2006-11-02 12:33 - 01445546 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-21 13:18 - 2008-08-13 04:40 - 01634306 _____ C:\Windows\WindowsUpdate.log
2013-08-21 13:15 - 2008-09-30 21:33 - 00141232 _____ C:\Users\besitzer\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-21 13:12 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-21 13:12 - 2006-11-02 14:47 - 00496040 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-21 13:12 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-21 13:12 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-21 13:12 - 2006-11-02 14:37 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-21 13:11 - 2013-08-20 11:03 - 00001582 _____ C:\Windows\PFRO.log
2013-08-21 13:10 - 2006-11-02 15:01 - 00032706 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-21 13:09 - 2013-08-21 12:11 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-08-21 12:40 - 2013-08-21 12:40 - 00000000 ____D C:\RegBackup
2013-08-21 12:18 - 2008-09-30 21:33 - 00045056 _____ C:\Windows\system32\acovcnt.exe
2013-08-21 12:15 - 2013-08-21 12:15 - 00000000 __SHD C:\found.001
2013-08-21 12:10 - 2013-08-21 12:07 - 00000000 ____D C:\Users\besitzer\Desktop\Tweaking.com - Windows Repair
2013-08-21 09:34 - 2008-09-30 21:33 - 00000000 ____D C:\Users\besitzer
2013-08-21 09:28 - 2012-09-06 10:42 - 00000000 ____D C:\Program Files\Common Files\DATA BECKER Shared
2013-08-21 09:03 - 2013-08-21 09:03 - 00358507 _____ (Farbar) C:\Users\besitzer\Desktop\FSS.exe
2013-08-20 13:24 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-20 11:21 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-08-20 11:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-08-20 10:59 - 2013-08-20 10:55 - 00000000 ____D C:\Windows\system32\MRT
2013-08-20 10:55 - 2006-11-02 12:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-20 10:53 - 2008-08-13 04:47 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-20 10:46 - 2006-11-02 12:23 - 00000275 _____ C:\Windows\win.ini
2013-08-20 10:32 - 2013-08-20 10:32 - 00000000 ____D C:\FRST
2013-08-20 10:13 - 2013-08-20 10:13 - 00006400 _____ C:\AdwCleaner[S1].txt
2013-08-20 10:13 - 2010-07-14 12:51 - 00000000 ____D C:\ProgramData\ICQ
2013-08-20 10:05 - 2010-04-07 17:45 - 00000000 ____D C:\Users\besitzer\AppData\Roaming\FileZilla
2013-08-20 10:05 - 2008-04-16 13:27 - 00000000 ____D C:\Windows\Panther
2013-08-20 10:04 - 2013-08-20 10:04 - 00000000 ____D C:\Program Files\CCleaner
2013-08-20 10:03 - 2013-08-20 10:03 - 03395840 _____ (Piriform Ltd) C:\Users\besitzer\Downloads\ccsetup404_slim.exe
2013-08-20 09:58 - 2013-08-20 09:58 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-20 09:57 - 2013-08-20 09:57 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-20 09:57 - 2013-08-20 09:57 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-20 09:57 - 2013-08-20 09:57 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-20 09:57 - 2010-07-06 09:51 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-20 09:57 - 2010-07-06 09:51 - 00000000 ____D C:\Program Files\Java
2013-08-20 09:41 - 2008-12-22 23:54 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-08-20 09:41 - 2008-12-22 23:54 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-08-20 09:38 - 2011-12-13 18:33 - 00000000 ____D C:\Program Files\Common Files\Lexware
2013-08-19 09:49 - 2013-08-19 09:49 - 00031232 _____ C:\Users\besitzer\Desktop\Schichten2013.xls
2013-08-19 09:23 - 2013-08-19 09:23 - 00050176 _____ C:\Users\besitzer\Desktop\kalender-2013-hochformat-2-seiten.xls
2013-08-15 08:37 - 2010-04-09 12:24 - 00000680 _____ C:\Users\besitzer\AppData\Local\d3d9caps.dat
2013-08-14 17:02 - 2012-02-22 19:05 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-14 17:01 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-08-14 13:56 - 2013-08-14 13:56 - 00011704 _____ C:\Users\besitzer\Desktop\You_Shook_me_all_night_long_Partitur_1.cap
2013-08-14 10:46 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-13 15:17 - 2010-09-23 17:19 - 00000000 ____D C:\Users\besitzer\AppData\Roaming\vlc
2013-08-13 15:01 - 2009-06-09 23:30 - 00016384 _____ C:\Users\besitzer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-10 16:53 - 2013-01-20 19:44 - 00000000 ____D C:\Program Files\Avira
2013-08-09 21:07 - 2006-11-02 12:22 - 50593792 _____ C:\Windows\system32\config\software_previous
2013-08-09 21:06 - 2008-08-13 06:22 - 00000000 ____D C:\ProgramData\P4G
2013-08-09 21:06 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\ShellNew
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-08-09 21:06 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-08-09 21:06 - 2006-11-02 12:22 - 120848384 _____ C:\Windows\system32\config\system_previous
2013-08-09 20:55 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-08-09 20:55 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-08-07 10:15 - 2013-08-07 10:15 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-06 11:46 - 2006-11-02 12:22 - 46661632 _____ C:\Windows\system32\config\components_previous
2013-08-06 11:46 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-08-06 10:03 - 2013-08-06 10:03 - 00163105 _____ C:\Users\besitzer\AppData\Local\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163071 _____ C:\ProgramData\2433f433
2013-08-06 10:03 - 2013-08-06 10:03 - 00163025 _____ C:\Users\besitzer\AppData\Roaming\2433f433
2013-07-25 04:40 - 2013-08-20 10:46 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-25 04:32 - 2013-08-20 10:46 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-25 04:30 - 2013-08-20 10:46 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-25 04:26 - 2013-08-20 10:46 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-25 04:26 - 2013-08-20 10:46 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-25 04:25 - 2013-08-20 10:46 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-25 04:24 - 2013-08-20 10:46 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-25 04:24 - 2013-08-20 10:46 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-25 04:23 - 2013-08-20 10:46 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-25 04:22 - 2013-08-20 10:46 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-25 04:22 - 2013-08-20 10:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-25 04:22 - 2013-08-20 10:46 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

Files to move or delete:
====================
C:\ProgramData\472630756.pad
C:\Users\besitzer\-331866838.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-21 13:20

==================== End Of Log ============================

--- --- ---

--- --- ---

Eine Frage mal "nebenbei": Was meinst Du wie lange diese Operation noch dauert?? Hier haben sie heute in den Nachrichten gebracht, dass sie ´n Hacker festgenommen haben. Und irgendwie bekomme ich so langsam ´n mulmiges Gefühl wenn ich hier ständig das Innenleben von meinem Läppi poste... :-/

schrauber · 21.08.2013, 13:05

Die Logs sind total unrelevant für sowas, keine Panik. Vista DVD zur Hand?

MaThi · 21.08.2013, 13:18

Das einzige was ich hab (noch eingeschweißt) ist ne Recovery DVD
"Windows Vista Recovery Media for Windows Vista Products 32-bit"
Original von ASUS

Wie ich schon erwähnte, das war damals vorinstalliert...

09.08.2013, 10:53	#4
schrauber /// the machine /// TB-Ausbilder	GVU - Trojaner alles tot Mit Laufwerk F biste sicher? Und FRST64.exe liegt auch im Hauptverzeichnis des Sticks und nit in einem Unterordner? Wenn ja einfach FRST64.exe eingeben, ohne das F __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

21.08.2013, 13:05	#14
schrauber /// the machine /// TB-Ausbilder	GVU - Trojaner alles tot Die Logs sind total unrelevant für sowas, keine Panik. Vista DVD zur Hand? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

GVU - Trojaner alles tot

Plagegeister aller Art und deren Bekämpfung: GVU - Trojaner alles tot