| |
| |||||||
Log-Analyse und Auswertung: GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglichWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
07.10.2013, 14:56
| #1 |
 |  GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Hallo liebes Board, würde mich sehr freuen, wenn Ihr helfen könntet! Der Rechner startet beim Versuch, in den abgesicherten Modus m. E. zu gehen, nach der Benutzeranmeldung immer gleich neu. Habe daher über Computer reparieren - Systemwiederherstellungsoptionen eine Eingabeaufforderung geöffnet und von dort einen Scan mit dem Farbar Recovery Scan Tool gemacht: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MININT-1QF141C on 07-10-2013 15:39:33
Running from H:\
WIN_7 (X86) OS Language: German Standard
Boot Mode: Recovery
Attention: Could not load system hive.
==================== Registry (Whitelisted) ==================
ATTENTION: Software hive is not loaded.
========================== Services (Whitelisted) =================
==================== Drivers (Whitelisted) ====================
========================== Drivers MD5 =======================
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-09-12 06:59 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-12 06:58 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-12 06:58 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-12 06:58 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-12 05:22 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-12 05:22 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-12 05:21 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-12 05:21 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-12 05:21 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-12 05:20 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
==================== One Month Modified Files and Folders =======
2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-07 14:10 - 2011-10-16 18:45 - 01446123 _____ C:\Windows\WindowsUpdate.log
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:12 - 2013-07-21 15:46 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-10-07 10:12 - 2009-07-14 05:39 - 00156841 _____ C:\Windows\setupact.log
2013-10-07 10:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-03 11:58 - 2013-03-12 12:29 - 00491150 _____ C:\test.xml
2013-10-03 11:23 - 2012-01-14 13:40 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Windows Live
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-10-02 06:55 - 2011-10-16 19:50 - 00015392 _____ C:\Windows\PFRO.log
2013-10-02 06:55 - 2011-10-16 19:10 - 00000000 ____D C:\Program Files\McAfee
2013-09-27 08:47 - 2011-10-17 08:59 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Skype
2013-09-23 13:57 - 2010-09-24 21:49 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-23 13:47 - 2013-07-17 14:55 - 00000000 ____D C:\Users\Benutzername\Desktop\15 07 2013
2013-09-20 16:09 - 2013-02-10 12:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-09-20 16:09 - 2013-02-10 12:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-09-20 15:26 - 2012-12-20 10:38 - 00927744 ___SH C:\Users\Benutzername\Desktop\Thumbs.db
2013-09-18 16:23 - 2013-03-10 21:17 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Bico
2013-09-18 12:13 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-09-17 15:18 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-09-16 23:40 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-13 10:11 - 2011-10-21 13:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 11:37 - 2009-07-14 05:33 - 00434488 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-12 11:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-12 06:55 - 2013-07-21 21:51 - 00000000 ____D C:\Windows\System32\MRT
2013-09-12 06:50 - 2011-10-23 09:11 - 76725432 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a
Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon: <===== ATTENTION!
HKLM\...\exefile\open\command: <===== ATTENTION!
==================== Restore Points =========================
39
Restore point made on: 2013-08-26 20:26:00
Restore point made on: 2013-08-28 09:08:52
Restore point made on: 2013-08-31 09:23:28
Restore point made on: 2013-08-31 11:54:10
Restore point made on: 2013-09-02 08:03:01
Restore point made on: 2013-09-03 12:02:43
Restore point made on: 2013-09-04 08:01:16
Restore point made on: 2013-09-06 11:44:52
Restore point made on: 2013-09-09 10:04:46
Restore point made on: 2013-09-12 05:00:12
Restore point made on: 2013-09-12 06:50:06
Restore point made on: 2013-09-13 10:06:06
Restore point made on: 2013-09-15 14:59:42
Restore point made on: 2013-09-16 21:32:10
Restore point made on: 2013-09-16 23:54:08
Restore point made on: 2013-09-18 08:02:24
Restore point made on: 2013-09-18 08:19:08
Restore point made on: 2013-09-18 09:00:57
Restore point made on: 2013-09-20 14:45:14
Restore point made on: 2013-09-20 21:23:51
Restore point made on: 2013-09-21 16:52:58
Restore point made on: 2013-09-26 16:41:26
Restore point made on: 2013-09-26 18:03:20
Restore point made on: 2013-09-27 07:55:41
Restore point made on: 2013-09-28 17:06:52
Restore point made on: 2013-09-29 19:34:30
Restore point made on: 2013-10-02 07:03:07
Restore point made on: 2013-10-03 10:52:28
Restore point made on: 2013-10-03 12:09:15
Restore point made on: 2013-10-04 11:01:03
Restore point made on: 2013-10-04 11:02:13
Restore point made on: 2013-10-07 10:17:25
Restore point made on: 2013-10-07 11:02:08
Restore point made on: 2013-10-07 14:10:42
Restore point made on: 2013-10-07 14:10:48
Restore point made on: 2013-10-07 14:10:50
Restore point made on: 2013-10-07 14:10:54
Restore point made on: 2013-10-07 14:10:56
Restore point made on: 2013-10-07 14:10:58
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=Y:
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {default}
resumeobject {6b41e77b-f826-11e0-ae2c-8723679cab14}
displayorder {default}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {6b41e77b-f826-11e0-ae2c-8723679cab14}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {6b41e77b-f826-11e0-ae2c-8723679cab14}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
pae Yes
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=Y:
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {6b41e77e-f826-11e0-ae2c-8723679cab14}
description Ramdisk Options
ramdisksdidevice partition=E:
ramdisksdipath \Recovery\WindowsRE\boot.sdi
==================== Memory info ===========================
Percentage of memory in use: 21%
Total physical RAM: 1642.9 MB
Available physical RAM: 1292.73 MB
Total Pagefile: 1642.9 MB
Available Pagefile: 1291.9 MB
Total Virtual: 2047.88 MB
Available Virtual: 1943.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:287.64 GB) (Free:217.95 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:10.36 GB) (Free:1.11 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (SWIVEL) (Removable) (Total:7.46 GB) (Free:0.71 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 89BA91F6)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=288 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: ECC810A9)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)
LastRegBack: 2013-10-07 10:44
==================== End Of Log ============================
|
|
07.10.2013, 15:05
| #2 |
| /// the machine /// TB-Ausbilder    | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Hi,
__________________FRST vom Stick löschen, neu laden, nochmal scannen. Der softwarehive wurde nicht geladen.
__________________ |
|
07.10.2013, 15:19
| #3 |
| | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Sorry, jetzt hats geklappt:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MININT-1QF141C on 07-10-2013 16:13:30
Running from H:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet003
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9398888 2010-11-01] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1873192 2010-11-01] (Synaptics Incorporated)
HKLM\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1195408 2011-09-23] (McAfee, Inc.)
HKLM\...\Run: [ISBMgr.exe] - C:\Program Files\Sony\ISB Utility\ISBMgr.exe [673136 2010-05-31] (Sony Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Norton Online Backup] - C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe [966488 2010-06-01] (Symantec Corporation)
HKLM\...\Run: [PMBVolumeWatcher] - c:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-26] (Sony Corporation)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [887976 2011-08-23] (Ask)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [TkBellExe] - c:\program files\real\realplayer\Update\realsched.exe [296096 2012-10-01] (RealNetworks, Inc.)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-04-23] (Samsung Electronics Co., Ltd.)
HKU\Benutzername\...\Run: [DAEMON Tools Lite] - C:\Program Files\DAEMON Tools Lite\DTLite.exe [ 2011-08-02] (DT Soft Ltd)
HKU\Benutzername\...\Run: [Bykyud] - C:\Users\Benutzername\AppData\Roaming\Yketis\dipyy.exe [ 2012-07-14] ()
HKU\Benutzername\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-04-23] (Samsung)
HKU\Benutzername\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-04-23] (Samsung)
HKU\Benutzername\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Benutzername\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll [ 2013-10-03] (ValveCorporation) <===== ATTENTION
HKU\Benutzername\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Benutzername\...\Command Processor: "C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" <===== ATTENTION!
AppInit_DLLs: c:\progra~1\magnipic\sprote~1.dll [ 2013-01-24] ()
========================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [284160 2010-11-18] (Advanced Micro Devices, Inc.)
S2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [140224 2010-06-17] (Advanced Micro Devices)
S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [198904 2010-08-30] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [364216 2010-10-07] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [171168 2011-04-14] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [188136 2011-04-14] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [141792 2011-04-14] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 NOBU; C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe [2057560 2010-06-01] (Symantec Corporation)
S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [189048 2011-01-29] (Sony Corporation)
S2 uCamMonitor; C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [217968 2010-05-31] (Sony Corporation)
S3 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [549168 2010-10-25] (Sony Corporation)
S3 VcmINSMgr; C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [387896 2010-10-25] (Sony Corporation)
S3 VCService; C:\Program Files\Sony\VAIO Care\VCService.exe [44736 2011-02-14] (Sony Corporation)
S2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [704512 2010-06-08] (Sony Corporation)
S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
S0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [63616 2010-11-05] (Advanced Micro Devices)
S0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [32384 2010-11-05] (Advanced Micro Devices)
S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-12-03] (ATI Technologies, Inc.)
S3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [297000 2010-11-01] (Broadcom Corporation.)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [56064 2011-04-14] (McAfee, Inc.)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2011-10-21] (DT Soft Ltd)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [95824 2011-04-14] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [153280 2011-04-14] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [52320 2011-04-14] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [314088 2011-04-14] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [387480 2011-04-14] (McAfee, Inc.)
S1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [64584 2011-04-14] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [84488 2011-04-14] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [165032 2011-04-14] (McAfee, Inc.)
S3 mfeavfk01; No ImagePath
========================== Drivers MD5 =======================
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9EBBBA55060F786F0FCAA3893BFA2806
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\amdiox86.sys FF258424F0B2EF25EB98F04EE386E6E3
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 5D3816A677CA50A618AD7138D2C21CED
C:\Windows\System32\DRIVERS\atikmpag.sys F3DC5D5C36FEE050A6C7204F0CB12C4C
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\System32\DRIVERS\amd_sata.sys C67ABECD78888B58BFFA1F9C60C3153B
C:\Windows\System32\DRIVERS\amd_xata.sys ACF7E74A5A813364D0C0BB101E1AC0D5
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys DFD07F0A36BD4F7E7AD2BC5548213694
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\system32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athr.sys 92CE48A7B48D2F836A9706AE215A8CAA
C:\Windows\System32\drivers\AtihdW73.sys C8B17AC82AD2EE9E0E58E3461008C5F7
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\BthEnum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BTHport.sys 1153DE2E4F5941E10C399CB5592F78A1
C:\Windows\System32\Drivers\BTHUSB.sys C81E9413A25A439F436B1D4B6A0CF9E9
C:\Windows\System32\drivers\btwampfl.sys 525432CFD6D8C004860AF7ECD0A84234
C:\Windows\System32\drivers\btwaudio.sys CF8799A563F734984D4E053CACEC1426
C:\Windows\System32\drivers\btwavdt.sys 9ED9932043D599AEA04F6EA2D86964A1
C:\Windows\System32\DRIVERS\btwl2cap.sys DE53089F0678CB5F0AFEB867ACB0FB05
C:\Windows\System32\DRIVERS\btwrchid.sys 373D1BB0F7DC8F1931F9B7E0DE3E9A30
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\System32\drivers\cfwids.sys 7FD604CD7A7A0FF8975AF61BDF64C577
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 247B4CE2DAB1160CD422D532D5241E1F
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys F9F31A9F2A8C0DD0CEB6E380BF0985D4
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dtsoftbus01.sys C0C7CECCB6C85994C2BC92D58E52D3F2
C:\Windows\System32\drivers\dxgkrnl.sys 16498EBC04AE9DD07049A8884B205C05
C:\Windows\System32\DRIVERS\e1y6032.sys 8EEF52AD831471E323EE7364A8656D35
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\System32\DRIVERS\igdkmd32.sys AD626F6964F4D364D226C39E06872DD3
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHDA.sys AEE99ECF06CD1CEA95816CCB5BF73EC8
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys B7895B4182C0D16F6EFADEB8081E8D36
C:\Windows\System32\Drivers\ksecpkg.sys D30159AC9237519FBC62C6EC247D2D46
C:\Windows\System32\DRIVERS\L1C62x86.sys C8FA09049E640B0A27E4B4446D958FE5
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\mfeapfk.sys 113445FC6A858EF453CDED5B0A0DF665
C:\Windows\System32\drivers\mfeavfk.sys DBF6E1B388D5C070D438C61ADB990C30
C:\Windows\System32\drivers\mfebopk.sys A528B15E330EDB83EA649BE318D841D5
C:\Windows\System32\drivers\mfefirek.sys C7DA1B8003C89ACEDAA13768F7A1C622
C:\Windows\System32\drivers\mfehidk.sys 5E9679BB2FC4FA38EC8CA906C47ACD46
C:\Windows\System32\DRIVERS\mfenlfk.sys 3A1AA28066785449DA570462E0532D0C
C:\Windows\System32\drivers\mferkdet.sys CE1711F7C3F72F6762ABD241DCFD5EE1
C:\Windows\System32\drivers\mfewfpk.sys B2BAAC6BBEDDA3E26E82DB13FA0E5BEE
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netw5v32.sys 58218EC6B61B1169CF54AAB0D00F5FE2
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys CB928D9E6DAF51879DD6BA8D02F01321
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 867BEB23207BA425C85293BB0D3EA971
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\system32\drivers\sdbus.sys 0328BE1C7F1CBA23848179F8762E391C
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SFEP.sys DCAFF7089185E6461B92D3D3A17BA295
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\VSTAZL3.SYS E00FDFAFF025E94F9821153750C35A6D
C:\Windows\System32\DRIVERS\VSTDPV3.SYS CEB4E3B6890E1E42DCA6694D9E59E1A0
C:\Windows\System32\DRIVERS\VSTCNXT3.SYS BC0C7EA89194C299F051C24119000E17
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\System32\DRIVERS\ssudmdm.sys 07318149E102FD9197AB444C27774372
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys 7DDDF7B78BF4F67AFF691E6EA15E24C0
C:\Windows\System32\drivers\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\DRIVERS\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\tpm.sys 5AD05191DC8B444A7BA4D79B76C42A30
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys BD9C55D7023C5DE374507ACC7A14E2AC
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys F92DE757E4B7CE9C07C5E65423F3AE3B
C:\Windows\System32\DRIVERS\usbfilter.sys FB0E8B624D1F7E214EDB3D6E56B4EC88
C:\Windows\System32\DRIVERS\usbhub.sys 8DC94AEC6A7E644A06135AE7506DC2E9
C:\Windows\System32\DRIVERS\usbohci.sys E185D44FAC515A18D9DEDDC23C2CDF44
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 576096CCBC07E7C4EA4F5E6686D6888F
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\system32\drivers\usbuhci.sys 68DF884CF41CDADA664BEB01DAF67E3D
C:\Windows\System32\Drivers\usbvideo.sys 45F4E7BF43DB40A6C6B4D92C76CBC3F2
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7
C:\Windows\System32\DRIVERS\vwifimp.sys A3F04CBEA6C2A10E6CB01F8B47611882
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys A840213F1ACDCC175B4D1D5AAEAC0D7A
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-09-12 06:59 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-12 06:58 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-12 06:58 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-12 06:58 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-12 05:22 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-12 05:22 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-12 05:21 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-12 05:21 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-12 05:21 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-12 05:20 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
==================== One Month Modified Files and Folders =======
2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-07 14:11 - 2011-10-16 18:45 - 01446123 _____ C:\Windows\WindowsUpdate.log
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:12 - 2013-07-21 15:46 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-10-07 10:12 - 2009-07-14 05:39 - 00156841 _____ C:\Windows\setupact.log
2013-10-07 10:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-03 11:58 - 2013-03-12 12:29 - 00491150 _____ C:\test.xml
2013-10-03 11:23 - 2012-01-14 13:40 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Windows Live
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-10-02 06:55 - 2011-10-16 19:50 - 00015392 _____ C:\Windows\PFRO.log
2013-10-02 06:55 - 2011-10-16 19:10 - 00000000 ____D C:\Program Files\McAfee
2013-09-27 08:47 - 2011-10-17 08:59 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Skype
2013-09-23 13:57 - 2010-09-24 21:49 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-23 13:47 - 2013-07-17 14:55 - 00000000 ____D C:\Users\Benutzername\Desktop\15 07 2013
2013-09-20 16:09 - 2013-02-10 12:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-09-20 16:09 - 2013-02-10 12:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-09-20 15:26 - 2012-12-20 10:38 - 00927744 ___SH C:\Users\Benutzername\Desktop\Thumbs.db
2013-09-18 16:23 - 2013-03-10 21:17 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Bico
2013-09-18 12:13 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-09-17 15:18 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-09-16 23:40 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-13 10:11 - 2011-10-21 13:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 11:37 - 2009-07-14 05:33 - 00434488 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-12 11:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-12 06:55 - 2013-07-21 21:51 - 00000000 ____D C:\Windows\System32\MRT
2013-09-12 06:50 - 2011-10-23 09:11 - 76725432 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a
Files to move or delete:
====================
C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll
Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
39
Restore point made on: 2013-08-26 20:26:00
Restore point made on: 2013-08-28 09:08:52
Restore point made on: 2013-08-31 09:23:28
Restore point made on: 2013-08-31 11:54:10
Restore point made on: 2013-09-02 08:03:01
Restore point made on: 2013-09-03 12:02:43
Restore point made on: 2013-09-04 08:01:16
Restore point made on: 2013-09-06 11:44:52
Restore point made on: 2013-09-09 10:04:46
Restore point made on: 2013-09-12 05:00:12
Restore point made on: 2013-09-12 06:50:06
Restore point made on: 2013-09-13 10:06:06
Restore point made on: 2013-09-15 14:59:42
Restore point made on: 2013-09-16 21:32:10
Restore point made on: 2013-09-16 23:54:08
Restore point made on: 2013-09-18 08:02:24
Restore point made on: 2013-09-18 08:19:08
Restore point made on: 2013-09-18 09:00:57
Restore point made on: 2013-09-20 14:45:14
Restore point made on: 2013-09-20 21:23:51
Restore point made on: 2013-09-21 16:52:58
Restore point made on: 2013-09-26 16:41:26
Restore point made on: 2013-09-26 18:03:20
Restore point made on: 2013-09-27 07:55:41
Restore point made on: 2013-09-28 17:06:52
Restore point made on: 2013-09-29 19:34:30
Restore point made on: 2013-10-02 07:03:07
Restore point made on: 2013-10-03 10:52:28
Restore point made on: 2013-10-03 12:09:15
Restore point made on: 2013-10-04 11:01:03
Restore point made on: 2013-10-04 11:02:13
Restore point made on: 2013-10-07 10:17:25
Restore point made on: 2013-10-07 11:02:08
Restore point made on: 2013-10-07 14:10:42
Restore point made on: 2013-10-07 14:10:48
Restore point made on: 2013-10-07 14:10:50
Restore point made on: 2013-10-07 14:10:54
Restore point made on: 2013-10-07 14:10:56
Restore point made on: 2013-10-07 14:10:58
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=Y:
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {default}
resumeobject {6b41e77b-f826-11e0-ae2c-8723679cab14}
displayorder {default}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {6b41e77b-f826-11e0-ae2c-8723679cab14}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {6b41e77b-f826-11e0-ae2c-8723679cab14}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
pae Yes
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=Y:
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {6b41e77e-f826-11e0-ae2c-8723679cab14}
description Ramdisk Options
ramdisksdidevice partition=E:
ramdisksdipath \Recovery\WindowsRE\boot.sdi
==================== Memory info ===========================
Percentage of memory in use: 27%
Total physical RAM: 1642.9 MB
Available physical RAM: 1183.77 MB
Total Pagefile: 1642.9 MB
Available Pagefile: 1189.4 MB
Total Virtual: 2047.88 MB
Available Virtual: 1952.72 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:287.64 GB) (Free:217.95 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:10.36 GB) (Free:1.11 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (SWIVEL) (Removable) (Total:7.46 GB) (Free:0.71 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 89BA91F6)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=288 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: ECC810A9)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)
LastRegBack: 2013-10-07 10:44
==================== End Of Log ============================
|
|
08.10.2013, 08:05
| #4 |
| /// the machine /// TB-Ausbilder | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\Benutzername\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll [ 2013-10-03] (ValveCorporation) <===== ATTENTION
HKU\Benutzername\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Benutzername\...\Command Processor: "C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" <===== ATTENTION!
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a
C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Rechner normal starten 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.10.2013, 14:15
| #5 |
| | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Vielen Dank, schrauber! Zwischenzeitlich habe ich per Boot-CD temp-Ordner und Recycle.bin und ein paar verdächtige Reg-Einträge schon manuell gelöscht, und offenbar waren die Übeltäter mit dabei: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by Benutzername at 2013-10-08 14:56:32 Run:1
Running from F:\
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\Benutzername\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll [ 2013-10-03] (ValveCorporation) <===== ATTENTION
HKU\Benutzername\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Benutzername\...\Command Processor: "C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" <===== ATTENTION!
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a
C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll
*****************
HKU\Benutzername\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value not found.
HKU\Benutzername\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.
HKU\Benutzername\Software\Microsoft\Command Processor\\AutoRun => Value not found.
"C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a" => File/Directory not found.
"C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\converter.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\generka.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\jre7.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\SCC.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll" => File/Directory not found.
==== End of Fixlog ====
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.07.09 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16686 Benutzername :: Benutzername [Administrator] 07.10.2013 19:26:09 mbam-log-2013-10-07 (19-26-09).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 321863 Laufzeit: 1 Stunde(n), 42 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 6 HKCR\CLSID\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EB03EF39-C655-D560-FA95-79182B837D64} (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\AppDataLow\SProtector (PUP.Optional.SProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 4 C:\Quarantäne 1\Yketis\dipyy.exe (Trojan.Agent.ED) -> Keine Aktion durchgeführt. C:\ProgramData\MaganiPic\515de07288508.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Documentation\DTLite4413-0173.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\MaganiPic\uninstall.exe (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.006 - Bericht erstellt am 08/10/2013 um 09:04:13
# Updated 01/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Benutzername - Benutzername
# Gestartet von : C:\Installierer\Virenschutz\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\MaganiPic
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaganiPic
Ordner Gelöscht : C:\Program Files\MagniPic
Ordner Gelöscht : C:\Users\Benutzername\AppData\LocalLow\Industriya
Ordner Gelöscht : C:\Users\Benutzername\AppData\LocalLow\MaganiPic
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_d8283021
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\PrivitizeVPNInstallDates
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKLM\Software\SP Global
Schlüssel Gelöscht : HKLM\Software\SProtector
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16686
*************************
AdwCleaner[R0].txt - [3134 octets] - [08/10/2013 09:02:01]
AdwCleaner[S0].txt - [2985 octets] - [08/10/2013 09:04:13]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3045 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows 7 Home Premium x86
Ran by Benutzername on 08.10.2013 at 9:07:38,17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\privitizevpn_1_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\privitizevpn_1_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskeng_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskeng_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3DFD11DD-7BEF-4D5C-AE35-8D549DE60FA2}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Program Files\myfree codec"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.10.2013 at 9:11:56,04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Gruß, Florian |
|
09.10.2013, 07:55
| #6 |
| /// the machine /// TB-Ausbilder | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Poste mal ein FRST log vom Desktop aus
__________________ --> GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich |
|
09.10.2013, 10:51
| #7 |
| | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Hier ist es: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Benutzername (administrator) on Benutzername on 09-10-2013 11:37:08
Running from C:\Users\Benutzername\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Symantec Corporation) C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe
(Sony Corporation) c:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
(ArcSoft, Inc.) C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Sony Corporation) C:\Program Files\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(DT Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTLite.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Farbar) C:\Users\Benutzername\Desktop\FRST32.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9398888 2010-11-01] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1873192 2010-11-01] (Synaptics Incorporated)
HKLM\...\Run: [ISBMgr.exe] - C:\Program Files\Sony\ISB Utility\ISBMgr.exe [673136 2010-05-31] (Sony Corporation)
HKLM\...\Run: [Norton Online Backup] - C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe [966488 2010-06-01] (Symantec Corporation)
HKLM\...\Run: [PMBVolumeWatcher] - c:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-27] (Sony Corporation)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [TkBellExe] - c:\program files\real\realplayer\Update\realsched.exe [296096 2012-10-01] (RealNetworks, Inc.)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-04-23] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-08-30] (AVAST Software)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files\DAEMON Tools Lite\DTLite.exe [4910912 2011-08-02] (DT Soft Ltd)
HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1561968 2013-04-23] (Samsung)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ard.de/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {34E69FDC-12F0-421F-B05F-1F582E358E2F} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {40BFEB68-5C72-4FD1-B8D9-601C7991729A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox
SearchScopes: HKCU - {8D227CD4-FB17-47E1-A96C-18656FF37EA7} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {AD3B8338-AB79-47A6-9ADC-31D4A9A5CF43} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-16/4?mpre=hxxp://shop.ebay.de/?_nkw={searchTerms}
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1
FireFox:
========
FF ProfilePath: C:\Users\Benutzername\AppData\Roaming\Mozilla\Firefox\Profiles\hk4od86s.default
FF Homepage: hxxp://www.ard.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Benutzername\AppData\Roaming\Mozilla\Firefox\Profiles\hk4od86s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
========================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [284160 2010-11-18] (Advanced Micro Devices, Inc.)
R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [140224 2010-06-17] (Advanced Micro Devices)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
R2 NOBU; C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe [2057560 2010-06-01] (Symantec Corporation)
S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [260992 2013-08-15] (Puran Software)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [189048 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [217968 2010-05-31] (Sony Corporation)
S3 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [549168 2010-10-25] (Sony Corporation)
S3 VcmINSMgr; C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [387896 2010-10-25] (Sony Corporation)
S3 VCService; C:\Program Files\Sony\VAIO Care\VCService.exe [44736 2011-02-14] (Sony Corporation)
R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [704512 2010-06-08] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1020976 2013-08-01] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [63616 2010-11-05] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [32384 2010-11-05] (Advanced Micro Devices)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-08-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [61680 2013-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-08-30] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-08-30] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-08-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [177864 2013-08-30] ()
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-12-03] (ATI Technologies, Inc.)
S3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [297000 2010-11-01] (Broadcom Corporation.)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2011-10-21] (DT Soft Ltd)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\MICHAE~1\AppData\Local\Temp\catchme.sys [x]
========================== Drivers MD5 =======================
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9EBBBA55060F786F0FCAA3893BFA2806
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\amdiox86.sys FF258424F0B2EF25EB98F04EE386E6E3
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 5D3816A677CA50A618AD7138D2C21CED
C:\Windows\System32\DRIVERS\atikmpag.sys F3DC5D5C36FEE050A6C7204F0CB12C4C
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\System32\DRIVERS\amd_sata.sys C67ABECD78888B58BFFA1F9C60C3153B
C:\Windows\System32\DRIVERS\amd_xata.sys ACF7E74A5A813364D0C0BB101E1AC0D5
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys DFD07F0A36BD4F7E7AD2BC5548213694
C:\Windows\System32\Drivers\aswFsBlk.sys B9FE438B3CAD82B2014710349A2022F7
C:\Windows\system32\drivers\aswMonFlt.sys AE5549DD21F6DE06406031EF1D51ACC3
C:\Windows\System32\Drivers\aswrdr2.sys A29EF1A46E110F392588F7395BB55F32
C:\Windows\System32\Drivers\aswRvrt.sys FA72FA503F580C3C628DD8C7D7622E37
C:\Windows\System32\Drivers\aswSnx.sys 4D53349D848C6BADB3D4ACBE98C27676
C:\Windows\System32\Drivers\aswSP.sys 813024DFD54A41B3AFAE2B1E2796CB80
C:\Windows\System32\Drivers\aswTdi.sys 5E18413310134130D7772F0668698CB7
C:\Windows\System32\Drivers\aswVmm.sys A5F637D61719D37A5B4868C385E363C0
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\system32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athr.sys 92CE48A7B48D2F836A9706AE215A8CAA
C:\Windows\System32\drivers\AtihdW73.sys C8B17AC82AD2EE9E0E58E3461008C5F7
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 77361D72A04F18809D0EFB6CCEB74D4B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\BthEnum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BTHport.sys 1153DE2E4F5941E10C399CB5592F78A1
C:\Windows\System32\Drivers\BTHUSB.sys C81E9413A25A439F436B1D4B6A0CF9E9
C:\Windows\System32\drivers\btwampfl.sys 525432CFD6D8C004860AF7ECD0A84234
C:\Windows\System32\drivers\btwaudio.sys CF8799A563F734984D4E053CACEC1426
C:\Windows\System32\drivers\btwavdt.sys 9ED9932043D599AEA04F6EA2D86964A1
C:\Windows\System32\DRIVERS\btwl2cap.sys DE53089F0678CB5F0AFEB867ACB0FB05
C:\Windows\System32\DRIVERS\btwrchid.sys 373D1BB0F7DC8F1931F9B7E0DE3E9A30
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 42F158036BD4C2FF3122BF142E60E6FD
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys F9F31A9F2A8C0DD0CEB6E380BF0985D4
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dtsoftbus01.sys C0C7CECCB6C85994C2BC92D58E52D3F2
C:\Windows\System32\drivers\dxgkrnl.sys 16498EBC04AE9DD07049A8884B205C05
C:\Windows\System32\DRIVERS\e1y6032.sys 8EEF52AD831471E323EE7364A8656D35
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\System32\DRIVERS\igdkmd32.sys AD626F6964F4D364D226C39E06872DD3
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHDA.sys AEE99ECF06CD1CEA95816CCB5BF73EC8
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys B7895B4182C0D16F6EFADEB8081E8D36
C:\Windows\System32\Drivers\ksecpkg.sys 5FE1ABF1AF591A3458C9CF24ED9A4D35
C:\Windows\System32\DRIVERS\L1C62x86.sys C8FA09049E640B0A27E4B4446D958FE5
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netw5v32.sys 58218EC6B61B1169CF54AAB0D00F5FE2
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys CB928D9E6DAF51879DD6BA8D02F01321
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 867BEB23207BA425C85293BB0D3EA971
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\system32\drivers\sdbus.sys 0328BE1C7F1CBA23848179F8762E391C
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SFEP.sys DCAFF7089185E6461B92D3D3A17BA295
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\VSTAZL3.SYS E00FDFAFF025E94F9821153750C35A6D
C:\Windows\System32\DRIVERS\VSTDPV3.SYS CEB4E3B6890E1E42DCA6694D9E59E1A0
C:\Windows\System32\DRIVERS\VSTCNXT3.SYS BC0C7EA89194C299F051C24119000E17
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\System32\DRIVERS\ssudmdm.sys 07318149E102FD9197AB444C27774372
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys 7DDDF7B78BF4F67AFF691E6EA15E24C0
C:\Windows\System32\drivers\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\DRIVERS\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\tpm.sys 5AD05191DC8B444A7BA4D79B76C42A30
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys BD9C55D7023C5DE374507ACC7A14E2AC
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys F92DE757E4B7CE9C07C5E65423F3AE3B
C:\Windows\System32\DRIVERS\usbfilter.sys FB0E8B624D1F7E214EDB3D6E56B4EC88
C:\Windows\System32\DRIVERS\usbhub.sys 8DC94AEC6A7E644A06135AE7506DC2E9
C:\Windows\System32\DRIVERS\usbohci.sys E185D44FAC515A18D9DEDDC23C2CDF44
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 576096CCBC07E7C4EA4F5E6686D6888F
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\system32\drivers\usbuhci.sys 68DF884CF41CDADA664BEB01DAF67E3D
C:\Windows\System32\Drivers\usbvideo.sys 45F4E7BF43DB40A6C6B4D92C76CBC3F2
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7
C:\Windows\System32\DRIVERS\vwifimp.sys A3F04CBEA6C2A10E6CB01F8B47611882
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys A840213F1ACDCC175B4D1D5AAEAC0D7A
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-09 11:35 - 2013-10-07 15:27 - 01087213 _____ (Farbar) C:\Users\Benutzername\Desktop\FRST32.exe
2013-10-09 11:28 - 2013-10-09 11:28 - 00434488 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 11:12 - 2013-10-09 11:12 - 00000992 _____ C:\Users\Benutzername\Desktop\Free Registry Defrag.lnk
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Registry Clean Expert
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Puran Defrag
2013-10-09 11:12 - 2013-08-15 16:39 - 01136512 _____ (Puran Software) C:\Windows\system32\PuranFD.exe
2013-10-09 11:12 - 2013-08-15 16:39 - 00260992 _____ (Puran Software) C:\Windows\system32\PuranDefragS.exe
2013-10-09 11:12 - 2013-08-15 16:39 - 00257408 _____ (Puran Software) C:\Windows\system32\PuranDC.exe
2013-10-09 11:12 - 2013-08-15 16:39 - 00219520 _____ (Puran Software) C:\Windows\system32\PuranDefrag.dll
2013-10-09 11:12 - 2013-08-15 16:39 - 00109952 _____ (Puran Software) C:\Windows\system32\PuranDefragBT.exe
2013-10-08 15:46 - 2013-10-08 15:46 - 00002089 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-10-08 15:46 - 2013-08-30 09:48 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00177864 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00066336 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00061680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00056080 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00049376 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00029816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-10-08 15:46 - 2013-08-30 09:47 - 00229648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-10-08 15:45 - 2013-10-08 15:45 - 00000000 ____D C:\Program Files\AVAST Software
2013-10-08 15:45 - 2013-08-30 09:47 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-10-08 15:42 - 2013-10-08 15:45 - 00000000 ____D C:\ProgramData\AVAST Software
2013-10-08 14:38 - 2013-10-08 14:38 - 00000000 ____D C:\Windows\CheckSur
2013-10-08 14:18 - 2012-08-24 19:05 - 00136560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-10-08 14:18 - 2012-08-24 19:02 - 00369856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-10-08 14:18 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-10-08 14:18 - 2012-08-24 18:56 - 01039360 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-10-08 14:18 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-10-08 14:07 - 2013-10-09 11:28 - 00000280 _____ C:\Windows\setupact.log
2013-10-08 14:07 - 2013-10-08 14:07 - 00000000 _____ C:\Windows\setuperr.log
2013-10-08 10:18 - 2013-10-08 10:18 - 00001999 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-10-08 10:17 - 2013-10-08 16:03 - 00000000 ____D C:\Program Files\Adobe
2013-10-08 09:19 - 2013-10-08 09:19 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Macromedia
2013-10-08 09:18 - 2013-10-08 09:25 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Mozilla
2013-10-08 09:18 - 2013-10-08 09:19 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00001119 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\ProgramData\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-08 09:07 - 2013-10-08 09:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-07 19:25 - 2013-10-07 19:25 - 00001081 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-07 19:25 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-07 19:03 - 2013-10-09 11:20 - 00116192 _____ C:\Users\Benutzername\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-07 18:34 - 2013-10-07 19:19 - 00000000 ____D C:\Windows\erdnt
2013-10-07 18:25 - 2013-10-09 11:21 - 00000000 ____D C:\Program Files\CCleaner
2013-10-07 18:25 - 2013-10-07 18:25 - 00000969 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-10-07 18:23 - 2013-10-08 14:36 - 00000000 ____D C:\Installierer
2013-10-07 16:35 - 2013-10-07 16:35 - 00000000 ____D C:\FRST
2013-09-12 07:59 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 07:58 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 07:58 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 07:58 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 07:58 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 07:58 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 06:22 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 06:22 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 06:21 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 06:21 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 06:21 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 06:21 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 06:21 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 06:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
==================== One Month Modified Files and Folders =======
2013-10-09 11:36 - 2009-07-14 06:34 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-09 11:36 - 2009-07-14 06:34 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-09 11:35 - 2011-10-16 19:45 - 01245192 _____ C:\Windows\WindowsUpdate.log
2013-10-09 11:32 - 2011-12-10 16:32 - 00000000 ____D C:\Update
2013-10-09 11:28 - 2013-10-09 11:28 - 00434488 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 11:28 - 2013-10-08 14:07 - 00000280 _____ C:\Windows\setupact.log
2013-10-09 11:28 - 2013-07-21 16:46 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-09 11:28 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-09 11:24 - 2011-10-16 20:13 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-10-09 11:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing
2013-10-09 11:21 - 2013-10-07 18:25 - 00000000 ____D C:\Program Files\CCleaner
2013-10-09 11:20 - 2013-10-07 19:03 - 00116192 _____ C:\Users\Benutzername\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-09 11:18 - 2013-02-10 13:17 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-09 11:18 - 2011-10-16 20:50 - 00019970 _____ C:\Windows\PFRO.log
2013-10-09 11:16 - 2011-10-21 14:34 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-10-09 11:16 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-09 11:12 - 2013-10-09 11:12 - 00000992 _____ C:\Users\Benutzername\Desktop\Free Registry Defrag.lnk
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Registry Clean Expert
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Puran Defrag
2013-10-09 11:09 - 2013-02-10 13:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-09 11:09 - 2013-02-10 13:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-08 16:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-08 16:03 - 2013-10-08 10:17 - 00000000 ____D C:\Program Files\Adobe
2013-10-08 16:03 - 2011-10-16 20:14 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2013-10-08 16:03 - 2011-10-16 20:06 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Adobe
2013-10-08 16:02 - 2011-10-16 20:06 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Adobe
2013-10-08 15:46 - 2013-10-08 15:46 - 00002089 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-10-08 15:46 - 2009-07-14 04:04 - 00002577 _____ C:\Windows\system32\config.nt
2013-10-08 15:45 - 2013-10-08 15:45 - 00000000 ____D C:\Program Files\AVAST Software
2013-10-08 15:45 - 2013-10-08 15:42 - 00000000 ____D C:\ProgramData\AVAST Software
2013-10-08 14:57 - 2010-09-24 22:49 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-08 14:38 - 2013-10-08 14:38 - 00000000 ____D C:\Windows\CheckSur
2013-10-08 14:36 - 2013-10-07 18:23 - 00000000 ____D C:\Installierer
2013-10-08 14:26 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-08 14:15 - 2011-10-16 20:14 - 00000000 ____D C:\ProgramData\Adobe
2013-10-08 14:07 - 2013-10-08 14:07 - 00000000 _____ C:\Windows\setuperr.log
2013-10-08 10:18 - 2013-10-08 10:18 - 00001999 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-10-08 10:17 - 2011-10-16 20:14 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-08 09:25 - 2013-10-08 09:18 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Mozilla
2013-10-08 09:19 - 2013-10-08 09:19 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Macromedia
2013-10-08 09:19 - 2013-10-08 09:18 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00001119 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\ProgramData\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-08 09:18 - 2013-04-04 21:41 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-08 09:07 - 2013-10-08 09:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-08 08:57 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-10-07 19:52 - 2013-01-21 16:56 - 00000000 ____D C:\ProgramData\tmp
2013-10-07 19:25 - 2013-10-07 19:25 - 00001081 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-07 19:19 - 2013-10-07 18:34 - 00000000 ____D C:\Windows\erdnt
2013-10-07 19:16 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2013-10-07 19:16 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-10-07 19:11 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-07 18:49 - 2011-12-29 12:44 - 00000000 ____D C:\ProgramData\WinZip
2013-10-07 18:49 - 2011-10-16 19:52 - 00000000 ____D C:\Users\Benutzername
2013-10-07 18:37 - 2011-10-16 20:10 - 00000000 ____D C:\ProgramData\McAfee
2013-10-07 18:31 - 2011-10-21 14:02 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\DAEMON Tools Lite
2013-10-07 18:30 - 2011-10-17 09:59 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Skype
2013-10-07 18:25 - 2013-10-07 18:25 - 00000969 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-10-07 16:35 - 2013-10-07 16:35 - 00000000 ____D C:\FRST
2013-10-07 15:27 - 2013-10-09 11:35 - 01087213 _____ (Farbar) C:\Users\Benutzername\Desktop\FRST32.exe
2013-10-03 12:23 - 2012-01-14 14:40 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Windows Live
2013-09-23 14:47 - 2013-07-17 15:55 - 00000000 ____D C:\Users\Benutzername\Desktop\15 07 2013
2013-09-21 13:24 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-20 16:26 - 2012-12-20 11:38 - 00927744 ___SH C:\Users\Benutzername\Desktop\Thumbs.db
2013-09-18 13:13 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-09-13 11:11 - 2011-10-21 14:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 07:55 - 2013-07-21 22:51 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 07:50 - 2011-10-23 10:11 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=\Device\HarddiskVolume2
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {current}
resumeobject {6b41e77b-f826-11e0-ae2c-8723679cab14}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {6b41e77d-f826-11e0-ae2c-8723679cab14}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {6b41e77b-f826-11e0-ae2c-8723679cab14}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {6b41e77d-f826-11e0-ae2c-8723679cab14}
device ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {6b41e77b-f826-11e0-ae2c-8723679cab14}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
pae Yes
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=\Device\HarddiskVolume2
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {6b41e77e-f826-11e0-ae2c-8723679cab14}
description Ramdisk Options
ramdisksdidevice partition=\Device\HarddiskVolume1
ramdisksdipath \Recovery\WindowsRE\boot.sdi
LastRegBack: 2013-10-07 11:44
==================== End Of Log ============================
und Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Benutzername at 2013-10-09 11:38:32
Running from C:\Users\Benutzername\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Disabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958)
Adobe AIR (Version: 3.9.0.1030)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Reader XI (11.0.04) - Deutsch (Version: 11.0.04)
AMD Fuel (Version: 2010.1118.1603.28745)
ArcSoft Magic-i Visual Effects 2 (Version: 2.0.1.134)
ArcSoft WebCam Companion 4 (Version: 4.0.21.356)
ATI Catalyst Install Manager (Version: 3.0.800.0)
avast! Free Antivirus (Version: 8.0.1497.0)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version: 2010.1118.1603.28745)
Catalyst Control Center InstallProxy (Version: 2010.1118.1603.28745)
Catalyst Control Center Localization All (Version: 2010.1118.1603.28745)
Catalyst Control Center Profiles Mobile (Version: 2010.1118.1603.28745)
CCC Help Chinese Standard (Version: 2010.1118.1602.28745)
CCC Help Chinese Traditional (Version: 2010.1118.1602.28745)
CCC Help Czech (Version: 2010.1118.1602.28745)
CCC Help Danish (Version: 2010.1118.1602.28745)
CCC Help Dutch (Version: 2010.1118.1602.28745)
CCC Help English (Version: 2010.1118.1602.28745)
CCC Help Finnish (Version: 2010.1118.1602.28745)
CCC Help French (Version: 2010.1118.1602.28745)
CCC Help German (Version: 2010.1118.1602.28745)
CCC Help Greek (Version: 2010.1118.1602.28745)
CCC Help Hungarian (Version: 2010.1118.1602.28745)
CCC Help Italian (Version: 2010.1118.1602.28745)
CCC Help Japanese (Version: 2010.1118.1602.28745)
CCC Help Korean (Version: 2010.1118.1602.28745)
CCC Help Norwegian (Version: 2010.1118.1602.28745)
CCC Help Polish (Version: 2010.1118.1602.28745)
CCC Help Portuguese (Version: 2010.1118.1602.28745)
CCC Help Russian (Version: 2010.1118.1602.28745)
CCC Help Spanish (Version: 2010.1118.1602.28745)
CCC Help Swedish (Version: 2010.1118.1602.28745)
CCC Help Thai (Version: 2010.1118.1602.28745)
ccc-core-static (Version: 2010.1118.1603.28745)
ccc-utility (Version: 2010.1118.1603.28745)
CCleaner (Version: 4.06)
Complément Messenger (Version: 15.4.3502.0922)
Control ActiveX de Windows Live Mesh para conexiones remotas (Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (Version: 15.4.5722.2)
CutePDF Writer 2.8
D3DX10 (Version: 15.4.2368.0902)
DAEMON Tools Lite (Version: 4.41.3.0173)
Evernote (Version: 3.5.7.2910)
Free Registry Defrag
Galería fotográfica de Windows Live (Version: 15.4.3502.0922)
Galerie de photos Windows Live (Version: 15.4.3502.0922)
Junk Mail filter update (Version: 15.4.3502.0922)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Media Gallery (Version: 1.4.0.11300)
Mein CEWE FOTOBUCH (Version: 5.0.1)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel 2007 Help Îáíîâëåíèå (KB963678)
Microsoft Office Excel MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office InfoPath MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Outlook 2007 Help Îáíîâëåíèå (KB963677)
Microsoft Office Outlook MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Powerpoint 2007 Help Îáíîâëåíèå (KB963669)
Microsoft Office PowerPoint MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proof (Ukrainian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proofing (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Shared MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Word 2007 Help Îáíîâëåíèå (KB963665)
Microsoft Office Word MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft PowerPoint Viewer (Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (Version: 10.0.30319)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB2721691) (Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
Norton Online Backup (Version: 2.1.17869)
PMB (Version: 5.5.00.11260)
PMB VAIO Edition Plug-in (Version: 1.4.00.09190)
PMB VAIO Edition Plug-in (Version: 1.4.00.11290)
Puran Defrag 7.7
Raccolta foto di Windows Live (Version: 15.4.3502.0922)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
Realtek High Definition Audio Driver (Version: 6.0.1.6167)
Realtek USB 2.0 Card Reader (Version: 6.1.7600.30113)
RealUpgrade 1.1 (Version: 1.1.0)
Remote Keyboard (Version: 1.1.0.10220)
Remote Play mit PlayStation®3 (Version: 1.0.2.06210)
Remote Play with PlayStation 3 (Version: 1.0.2.06210)
Samsung Kies (Version: 2.5.3.13043_14)
Skype Click to Call (Version: 5.6.8442)
Skype™ 6.0 (Version: 6.0.126)
Synaptics Pointing Device Driver (Version: 15.1.9.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825641) 32-Bit Edition
VAIO - Media Gallery (Version: 1.4.0.11300)
VAIO - PMB VAIO Edition Guide (Version: 1.4.00.10090)
VAIO - PMB VAIO Edition Plug-in (Version: 1.4.00.11300)
VAIO - Remote-Tastatur (Version: 1.0.0.10220)
VAIO Care (Version: 6.4.2.11150)
VAIO Control Center (Version: 4.3.0.05310)
VAIO Data Restore Tool (Version: 1.5.0.10140)
VAIO Gate (Version: 2.3.0.11090)
VAIO Gate Default (Version: 2.3.0.11220)
VAIO Hardware Diagnostics (Version: 4.1.0.10120)
VAIO Media plus (Version: 2.1.0.23300)
VAIO Media plus Opening Movie (Version: 2.1.0.13220)
VAIO Sample Contents (Version: 1.4.2.09010)
VAIO Smart Network (Version: 3.3.0.06080)
VAIO Update (Version: 6.3.0.08010)
VAIO-Handbuch (Version: 1.1.0.05280)
VAIO-Support für Übertragungen (Version: 1.3.0.11250)
VU5x86 (Version: 1.1.0)
WIDCOMM Bluetooth Software (Version: 6.3.0.6300)
Windows Live (Version: 15.4.3502.0922)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (Version: 15.4.5722.2)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WMV9/VC-1 Video Playback (Version: 1.0.51110.1535)
Компаньон Messenger (Version: 15.4.3502.0922)
Основные компоненты Windows Live (Version: 15.4.3502.0922)
Почта Windows Live (Version: 15.4.3502.0922)
Фотоальбом Windows Live (Version: 15.4.3502.0922)
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (Version: 15.4.5722.2)
==================== Restore Points =========================
07-10-2013 17:22:04 ComboFix created restore point
08-10-2013 07:01:49 Windows Update
08-10-2013 07:52:56 Die Service Pack-Sicherungsdateien wurden entfernt.
08-10-2013 12:18:40 Windows Update
08-10-2013 12:32:56 Windows Update
08-10-2013 12:38:15 Windows Update
08-10-2013 12:58:19 Windows Update
08-10-2013 13:44:49 avast! Free Antivirus Setup
08-10-2013 19:28:00 Windows Update
09-10-2013 09:22:54 Installiert VAIO Update
==================== Hosts content: ==========================
2009-07-14 04:04 - 2013-10-07 19:11 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {02464BE2-5A1C-4B0A-9EC5-DE6B66D3A176} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-08-01] (Sony Corporation)
Task: {089316C2-51AA-4837-A42C-8C5BA500770F} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2011-02-16] (Sony Corporation)
Task: {0A5B39B4-2EFA-4CB9-862F-226D720273E6} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-11-16] (Sony Corporation)
Task: {302DB9FD-6807-45CB-B035-F28DDF16DBB1} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1377547152-2328664034-3037785392-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {3BFD0E2A-4F2F-497C-BFB9-F97E1B3AFB6F} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2013-08-01] (Sony Corporation)
Task: {5D36CEB4-395E-4A2C-B49E-9BFE9B8DD6B3} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-11-16] (Sony Corporation)
Task: {656B48D8-37DD-407F-9D95-9BC4C4939F2C} - System32\Tasks\SONY\VAIO Wallpaper Setting Tool\VAIO Wallpaper Setting Tool => C:\Program Files\Sony\VAIO Wallpaper Setting Tool\VWSet.exe
Task: {6FBB39C0-3391-4051-87AA-8B43EEE06F9F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {7768C420-35FF-4550-A254-6193A3C26013} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2011-02-16] (Sony Corporation)
Task: {93AD7E7A-D542-4029-9826-30F0A9E6C33B} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1377547152-2328664034-3037785392-1001
Task: {9E03458A-1D22-4D80-A907-AC9EECD9C754} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {9E9B2117-2B7C-43FA-9536-AA84823330A1} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {AF061290-51B0-41FB-B038-0C1D11ACB43A} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1377547152-2328664034-3037785392-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {D7F4549F-6CD2-402C-922B-F72D94D1A444} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-04-18 20:17 - 2013-04-18 20:17 - 00036352 _____ () C:\Program Files\Samsung\Kies\Common\Kies.Common.DeviceServiceLib.Interface.dll
2013-04-23 12:44 - 2013-04-23 12:44 - 17497600 _____ () C:\Program Files\Samsung\Kies\Theme\Kies.Theme.dll
2013-04-19 12:34 - 2013-04-19 12:34 - 00563200 _____ () C:\Program Files\Samsung\Kies\Common\Kies.UI.dll
2013-04-18 20:17 - 2013-04-18 20:17 - 00023040 _____ () C:\Program Files\Samsung\Kies\MVVM\Kies.MVVM.dll
2013-04-18 18:08 - 2013-04-18 18:08 - 00057856 _____ () C:\Program Files\Samsung\Kies\External\MediaModules\ASF_cSharpAPI.dll
2010-11-18 16:13 - 2010-11-18 16:13 - 00096256 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2010-11-18 16:02 - 2010-11-18 16:02 - 00243712 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-08-24 14:39 - 2010-08-24 14:39 - 00016384 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/08/2013 03:25:09 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (10/08/2013 03:24:21 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (10/08/2013 09:52:55 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {8ee216ac-496a-4560-b358-1f7bdcfbf4fc}
System errors:
=============
Error: (10/08/2013 09:28:21 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)
Error: (10/08/2013 02:59:06 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)
Error: (10/08/2013 02:33:41 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)
Error: (10/08/2013 02:21:27 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)
Error: (10/08/2013 09:47:29 AM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 63%
Total physical RAM: 1642.9 MB
Available physical RAM: 602.91 MB
Total Pagefile: 3285.8 MB
Available Pagefile: 1957.14 MB
Total Virtual: 2047.88 MB
Available Virtual: 1910.99 MB
==================== Drives ================================
Drive c: (Festplatte) (Fixed) (Total:287.64 GB) (Free:234.76 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 89BA91F6)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=288 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
09.10.2013, 14:05
| #8 |
| /// the machine /// TB-Ausbilder | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich sieht gut aus, noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.10.2013, 16:43
| #9 |
| | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Alles wieder im grünen Bereich. Klasse, danke!! |
|
10.10.2013, 08:42
| #10 |
| /// the machine /// TB-Ausbilder | GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich |
| adobe, appdata, association, bootmgr, computer, desktop, explorer.exe, farbar, farbar recovery scan tool, nicht möglich, pup.optional.multiplug.a, pup.optional.opencandy, pup.optional.silentinstall.a, pup.optional.sprotector.a, recovery, registry, roaming, services, services.exe, software, svchost.exe, system32, trojan.agent.ed, windows, windows xp, winlogon.exe |
Linear-Darstellung
