| |
| |||||||
Log-Analyse und Auswertung: Spam mails von meinem Email AccountWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
18.10.2013, 09:08
| #1 |
 |  Spam mails von meinem Email Account Hallo zusammen, ich habe am vergangenen Montag mit rund 3800 Mail Deliverys auch eine mail vom T-Online Abuse Team sowie vom T-Online Postfachvirenschutz erhalten. Inhalt der mail Postfachvirenschutz: der T-Online Postfachvirenschutz sorgt automatisch für den Schutz Ihres eMail-Postfachs vor Viren, Würmern und Trojanern. In der eMail mit den folgenden Daten wurde ein Virus gefunden und entfernt: - Zeitstempel des Senders: Tue, 15 Oct 2013 16:53:19 +0000 - Betreff bzw. Subject der ursprünglichen Nachricht: Payroll Received by Intuit - Erkannter Virus, Wurm oder Trojaner: TR/Dropper.Gen8 - Adresse des Absenders*: service@citibank.com Inhalt der mail des Abuseteams: Die Prüfung der über Ihr E-Mail-Konto versendeten Spam-Mails hat ergeben, dass diese von einer IP-Adresse eines ausländischen Providers eingeliefert worden sind. Dies bedeutet, dass Ihre Passwörter kompromittiert sind. Entweder wurden diese durch eine Schadsoftware gestohlen oder durch sogenanntes "Phishing" erschlichen. Auch wenn Sie Ihren Rechner bereinigt haben, kann weiterer Schaden durch den Missbrauch bereits gestohlener Zugangsdaten entstehen. Daher raten wir Ihnen, *alle* Passwörter zu ändern, vergessen Sie dabei nicht etwaige Passwörter für Onlinebanking, eBay, Amazon & Co., falls Sie solche Dienste nutzen. (Wichtig: Dies darf nur von einem Rechner aus erfolgen, der garantiert "sauber" ist, sonst landen die neuen Passwörter gleich wieder bei einem der Angreifer!) ######################## Ich war echt verwundert, da ich seit 10 Jahren nie derartige Probleme hatte. Meine Norton 360 ist auch immer auf dem neuesten Stand. Was habe ich bis jetzt unternommen: 1. Quick Scan mit Norton hat nichts ergeben, ausser ein paar Tracking Cookies. 2. Sämtliche Passwörter von einem sauberen Rechner aus geändert. 3. Malwarebytes gekauft und Systemcheck gemacht, Egebnis hier:  Habe dann angefangen hier im Forum zu lesen, was zu tun ist und die benötigten Logfile zusammengestellt. FRST: Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013 Ran by Svenski (administrator) on SVENSKI-PC on 16-10-2013 22:15:09 Running from A:\ Microsoft Windows 7 Enterprise Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Just Develop It) C:\Program Files\MyPC Backup\BackupStack.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\6.4.1.14\ccSvcHst.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\6.4.1.14\ccSvcHst.exe (Whilokii) C:\Program Files\Whilokii\updateWhilokii.exe (Systweak) C:\Program Files\Advanced System Protector\AdvancedSystemProtector.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Wajam) C:\Program Files\Wajam\Updater\WajamUpdaterV2.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe () C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (CHENGDU YIWO Tech Development Co., Ltd) A:\Program Files\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe (Apple Inc.) B:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Spotify Ltd) C:\Users\Svenski\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Fred's Software) C:\Program Files\PrintKey2000\Printkey2000.exe (Smart PC Solutions) C:\Program Files\PC Speed Maximizer\SPMSmartScan.exe (Deutsche Telekom AG) C:\Users\Svenski\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe (Smart PC Solutions) C:\Program Files\PC Speed Maximizer\SPMReminder.exe (MyPCBackup.com) C:\Program Files\MyPC Backup\MyPC Backup.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\APSDaemon.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM\...\Run: [AgentMonitor] - C:\Program Files\VTech\DownloadManager\System\AgentMonitor.exe [391040 2013-06-20] () HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM\...\Run: [EaseUS EPM tray] - A:\Program Files\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe [2081792 2013-03-29] (CHENGDU YIWO Tech Development Co., Ltd) HKLM\...\Run: [iTunesHelper] - B:\Program Files\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.) HKCU\...\Run: [iCloudServices] - C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.) HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.) HKCU\...\Run: [Spotify] - C:\Users\Svenski\AppData\Roaming\Spotify\Spotify.exe [4752384 2013-10-12] (Spotify Ltd) HKCU\...\Run: [Spotify Web Helper] - C:\Users\Svenski\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1140736 2013-10-12] (Spotify Ltd) HKCU\...\Run: [PC Speed Maximizer] - C:\Program Files\PC Speed Maximizer\SPMLauncher.exe [134456 2013-03-09] (Smart PC Solutions) Startup: C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk ShortcutTarget: Mediencenter.lnk -> C:\Users\Svenski\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe (Deutsche Telekom AG) Startup: C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk ShortcutTarget: MyPC Backup.lnk -> C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com) Startup: C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.doko-search.com/?babsrc=HP_ss&mntrId=0C9900238B80DFE0&affID=125836&tsp=5037 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x2E8380CA390CCE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.doko-search.com/?babsrc=HP_ss&mntrId=0C9900238B80DFE0&affID=125836&tsp=5037 URLSearchHook: DVDvideoSoft 2.0 Toolbar - {04a8dd1a-4754-48fe-a703-99846646ef04} - C:\Program Files\DVDvideoSoft_2.0\prxtbDVD2.dll (Conduit Ltd.) SearchScopes: HKCU - {F90F97A9-B31A-40BB-AB9D-A23A5D20D07A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3279453&CUI=UN30823455637932185&UM=2 BHO: DVDvideoSoft 2.0 Toolbar - {04a8dd1a-4754-48fe-a703-99846646ef04} - C:\Program Files\DVDvideoSoft_2.0\prxtbDVD2.dll (Conduit Ltd.) BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Whilokii - {204df522-9a96-4a72-abb0-60f7a216d6d2} - C:\Program Files\Whilokii\Whilokiibho.dll (Whilokii) BHO: dokotoolbar Helper Object - {3B9F6E59-04CA-43FF-92DF-F6E66D3A8D82} - C:\Program Files\Doko-Toolbar\dokotoolbar\1.8.26.9\bh\dokotoolbar.dll (Doko-Toolbar) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\6.4.1.14\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files\Wajam\IE\priam_bho.dll (Wajam) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM - DVDvideoSoft 2.0 Toolbar - {04a8dd1a-4754-48fe-a703-99846646ef04} - C:\Program Files\DVDvideoSoft_2.0\prxtbDVD2.dll (Conduit Ltd.) Toolbar: HKLM - dokotoolbar Toolbar - {339E1B37-76D3-4A64-A988-E81425DF831C} - C:\Program Files\Doko-Toolbar\dokotoolbar\1.8.26.9\dokotoolbarTlbr.dll (Doko-Toolbar) Toolbar: HKCU -Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\6.4.1.14\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU -DVDvideoSoft 2.0 Toolbar - {04A8DD1A-4754-48FE-A703-99846646EF04} - C:\Program Files\DVDvideoSoft_2.0\prxtbDVD2.dll (Conduit Ltd.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default FF user.js: detected! => C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\user.js FF NewTab: hxxp://www.doko-search.com/?babsrc=NT_ss&mntrId=0C9900238B80DFE0&affID=125836&tsp=5037 FF DefaultSearchEngine: metaCrawler FF SearchEngineOrder.1: metaCrawler FF SelectedSearchEngine: metaCrawler FF Homepage: hxxp://i.search.metacrawler.com/?f=1&a=ironmc2&cd=2XzuyEtN2Y1L1QzutDtDtBtAzz0BzztD0D0F0EtD0DyD0F0DtN0D0Tzu0CyCyDyDtN1L2XzutBtFtBtFyCtFtCtDzyyBtN1L1Czu&cr=1439537323&ir= FF Keyword.URL: user_pref("keyword.URL", ""); FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - B:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 - C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals) FF Plugin: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 - C:\Program Files\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals) FF Plugin: @videolan.org/vlc,version=2.0.8 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\searchplugins\dokotoolbar.xml FF SearchPlugin: C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\searchplugins\metaCrawler.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: dokotoolbar.com - C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\Extensions\ffxtlbr@dokotoolbar.com FF Extension: metacrawler.com - C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\Extensions\ffxtlbr@metacrawler.com FF Extension: Dấu trang iCloud - C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\Extensions\firefoxdav@icloud.com FF Extension: No Name - C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\Extensions\{60364604-8b4c-42f4-a2ca-a76ca7b61b37} FF Extension: Bitdefender QuickScan - C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} FF Extension: BonanzaDeals - C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\Extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca} FF Extension: firefox - C:\Users\Svenski\AppData\Roaming\Mozilla\Firefox\Profiles\p4wytk0d.default\Extensions\firefox@whilokii.net.xpi FF HKLM\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\IPSFF FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\coFFPlgn\ FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi FF Extension: No Name - C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi ========================== Services (Whitelisted) ================= R2 BackupStack; C:\Program Files\MyPC Backup\BackupStack.exe [38440 2013-09-20] (Just Develop It) S2 bonanzadealslive; C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-16] (BonanzaDeals) S3 bonanzadealslivem; C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-16] (BonanzaDeals) R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 N360; C:\Program Files\Norton 360\Engine\6.4.1.14\diMaster.dll [309688 2012-04-13] (Symantec Corporation) S3 npggsvc; C:\Windows\system32\GameMon.des [3969336 2012-04-05] (INCA Internet Co., Ltd.) R2 Update Whilokii; C:\Program Files\Whilokii\updateWhilokii.exe [65304 2013-10-05] (Whilokii) R2 WajamUpdaterV2; C:\Program Files\Wajam\Updater\WajamUpdaterV2.exe [113152 2013-10-10] (Wajam) S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [x] ==================== Drivers (Whitelisted) ==================== R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\BASHDefs\20131002.001\BHDrvx86.sys [1097304 2013-10-02] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360\0604010.00E\ccSetx86.sys [132768 2012-06-07] (Symantec Corporation) R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-09-01] (Symantec Corporation) S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [14920 2013-03-07] () R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-09-01] (Symantec Corporation) S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9160 2013-03-07] () R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\IPSDefs\20131014.001\IDSvix86.sys [392792 2013-10-08] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20131016.004\NAVENG.SYS [93272 2013-09-01] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_6.0.0.145\Definitions\VirusDefs\20131016.004\NAVEX15.SYS [1612376 2013-09-01] (Symantec Corporation) R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [722416 2013-05-05] (Duplex Secure Ltd.) R3 SRTSP; C:\Windows\System32\Drivers\N360\0604010.00E\SRTSP.SYS [574112 2012-07-06] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360\0604010.00E\SRTSPX.SYS [32928 2012-07-06] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360\0604010.00E\SYMDS.SYS [340088 2011-08-16] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360\0604010.00E\SYMEFA.SYS [924320 2012-05-22] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2013-02-10] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360\0604010.00E\Ironx86.SYS [149624 2011-11-16] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360\0604010.00E\SYMNETS.SYS [318584 2011-11-16] (Symantec Corporation) R3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [43008 2007-03-28] (Winbond Electronics Corporation) U4 cisvc; U4 ImapiService; S3 SYMFW; \SystemRoot\System32\Drivers\N360\0308000.029\SYMFW.SYS [x] S3 SYMNDISV; \SystemRoot\System32\Drivers\N360\0308000.029\SYMNDISV.SYS [x] S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x] S3 tsusbhub; system32\drivers\tsusbhub.sys [x] S3 VGPU; System32\drivers\rdvgkmd.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-16 22:15 - 2013-10-16 22:15 - 00000000 ____D C:\FRST 2013-10-16 22:06 - 2013-10-16 22:08 - 00000020 _____ C:\Users\Svenski\defogger_reenable 2013-10-16 22:02 - 2013-10-16 22:02 - 00000000 ____D C:\Users\Svenski\Documents\PC Speed Maximizer 2013-10-16 22:02 - 2013-10-16 22:02 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\PC Speed Maximizer 2013-10-16 21:57 - 2013-10-16 21:57 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam 2013-10-16 21:56 - 2013-10-16 22:09 - 00000300 _____ C:\Windows\Tasks\MetaCrawler.job 2013-10-16 21:56 - 2013-10-16 21:57 - 00000000 ____D C:\Program Files\Wajam 2013-10-16 21:56 - 2013-10-16 21:56 - 00001079 _____ C:\Users\Svenski\Desktop\PC Speed Maximizer.lnk 2013-10-16 21:56 - 2013-10-16 21:56 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\MetaCrawler 2013-10-16 21:56 - 2013-10-16 21:56 - 00000000 ____D C:\Program Files\PC Speed Maximizer 2013-10-16 21:56 - 2013-10-16 21:56 - 00000000 ____D C:\Program Files\metaCrawler 2013-10-16 21:48 - 2013-10-16 22:10 - 00000000 ____D C:\Program Files\MyPC Backup 2013-10-16 21:48 - 2013-10-16 22:09 - 00000268 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job 2013-10-16 21:48 - 2013-10-16 21:48 - 00001163 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk 2013-10-16 21:48 - 2013-10-16 21:48 - 00001049 _____ C:\Users\Svenski\Desktop\MyPC Backup.lnk 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\ProgramData\Systweak 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\ProgramData\BitGuard 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\Program Files\Doko-Toolbar 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\Program Files\Advanced System Protector 2013-10-16 21:48 - 2012-07-25 12:03 - 00017136 _____ C:\Windows\system32\sasnative32.exe 2013-10-16 21:47 - 2013-10-16 22:10 - 00000912 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job 2013-10-16 21:47 - 2013-10-16 22:09 - 00000300 _____ C:\Windows\Tasks\DigitalSite.job 2013-10-16 21:47 - 2013-10-16 22:09 - 00000276 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job 2013-10-16 21:47 - 2013-10-16 21:57 - 00000000 ____D C:\Program Files\BonanzaDeals 2013-10-16 21:47 - 2013-10-16 21:56 - 00001072 _____ C:\Users\Public\Desktop\Open It!.lnk 2013-10-16 21:47 - 2013-10-16 21:52 - 00000916 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job 2013-10-16 21:47 - 2013-10-16 21:48 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Systweak 2013-10-16 21:47 - 2013-10-16 21:48 - 00000000 ____D C:\Program Files\Whilokii 2013-10-16 21:47 - 2013-10-16 21:47 - 00001012 _____ C:\Users\Public\Desktop\RegClean Pro.lnk 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\DigitalSite 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\BabSolution 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\0D0S1L2Z1P1B 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Local\Google 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Local\BonanzaDealsLive 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\ProgramData\BonanzaDealsLive 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\ProgramData\Babylon 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\RegClean Pro 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\OpenIt 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\BonanzaDealsLive 2013-10-16 21:47 - 2013-07-22 16:07 - 00018776 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot.exe 2013-10-15 19:07 - 2013-10-15 19:07 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Malwarebytes 2013-10-15 19:06 - 2013-10-15 19:06 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-15 19:06 - 2013-10-15 19:06 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-10-15 19:06 - 2013-10-15 19:06 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-10-15 19:06 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-10-14 21:22 - 2013-10-14 21:22 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\QuickScan 2013-10-12 10:53 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-10-12 10:53 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-10-12 10:53 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-10-12 10:53 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-10-12 10:52 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-10-12 10:52 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-10-12 10:52 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-10-12 10:52 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-10-12 10:52 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-10-12 10:52 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-10-12 10:52 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-10-12 10:52 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-10-12 10:52 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-10-12 10:52 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-10-12 10:52 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-10-12 10:52 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-10-11 10:21 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-10-11 10:21 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-10-11 10:21 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2013-10-11 10:21 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2013-10-11 10:21 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-10-11 10:21 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-10-11 10:21 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2013-10-11 10:21 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2013-10-11 10:21 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-10-11 10:21 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2013-10-11 10:21 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2013-10-11 10:21 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-11 10:21 - 2013-07-12 12:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys 2013-10-11 10:21 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2013-10-11 10:21 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2013-10-11 10:21 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2013-10-11 10:21 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2013-10-11 10:21 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2013-10-11 10:21 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2013-10-11 10:21 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2013-10-11 10:21 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2013-10-11 10:21 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2013-10-11 10:21 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2013-10-11 10:21 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2013-10-11 10:21 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2013-10-11 10:21 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2013-10-07 22:45 - 2013-10-16 21:10 - 00000000 ____D C:\Users\Svenski\AppData\Local\Spotify 2013-10-07 22:45 - 2013-10-07 22:45 - 00001817 _____ C:\Users\Svenski\Desktop\Spotify.lnk 2013-10-07 22:45 - 2013-10-07 22:45 - 00001803 _____ C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2013-10-07 22:42 - 2013-10-16 22:11 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Spotify 2013-10-05 14:04 - 2013-10-05 14:04 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-09-28 16:17 - 2013-09-28 16:34 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\vlc 2013-09-28 16:17 - 2013-09-28 16:17 - 00001028 _____ C:\Users\Public\Desktop\VLC media player.lnk 2013-09-21 18:39 - 2013-09-21 18:39 - 00001556 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-09-21 18:39 - 2013-09-21 18:39 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2013-09-21 18:39 - 2013-09-21 18:39 - 00000000 ____D C:\Program Files\iPod ==================== One Month Modified Files and Folders ======= 2013-10-16 22:15 - 2013-10-16 22:15 - 00000000 ____D C:\FRST 2013-10-16 22:13 - 2010-02-26 16:01 - 01057875 _____ C:\Windows\WindowsUpdate.log 2013-10-16 22:11 - 2013-10-07 22:42 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Spotify 2013-10-16 22:11 - 2012-09-14 16:52 - 00000000 ___RD C:\Users\Svenski\Mediencenter 2013-10-16 22:10 - 2013-10-16 21:48 - 00000000 ____D C:\Program Files\MyPC Backup 2013-10-16 22:10 - 2013-10-16 21:47 - 00000912 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job 2013-10-16 22:09 - 2013-10-16 21:56 - 00000300 _____ C:\Windows\Tasks\MetaCrawler.job 2013-10-16 22:09 - 2013-10-16 21:48 - 00000268 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job 2013-10-16 22:09 - 2013-10-16 21:47 - 00000300 _____ C:\Windows\Tasks\DigitalSite.job 2013-10-16 22:09 - 2013-10-16 21:47 - 00000276 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job 2013-10-16 22:09 - 2010-02-26 17:23 - 00055844 _____ C:\Windows\PFRO.log 2013-10-16 22:09 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-16 22:09 - 2009-07-14 06:39 - 00071845 _____ C:\Windows\setupact.log 2013-10-16 22:08 - 2013-10-16 22:06 - 00000020 _____ C:\Users\Svenski\defogger_reenable 2013-10-16 22:06 - 2010-02-26 16:08 - 00000000 ____D C:\Users\Svenski 2013-10-16 22:02 - 2013-10-16 22:02 - 00000000 ____D C:\Users\Svenski\Documents\PC Speed Maximizer 2013-10-16 22:02 - 2013-10-16 22:02 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\PC Speed Maximizer 2013-10-16 21:57 - 2013-10-16 21:57 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam 2013-10-16 21:57 - 2013-10-16 21:56 - 00000000 ____D C:\Program Files\Wajam 2013-10-16 21:57 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\BonanzaDeals 2013-10-16 21:56 - 2013-10-16 21:56 - 00001079 _____ C:\Users\Svenski\Desktop\PC Speed Maximizer.lnk 2013-10-16 21:56 - 2013-10-16 21:56 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\MetaCrawler 2013-10-16 21:56 - 2013-10-16 21:56 - 00000000 ____D C:\Program Files\PC Speed Maximizer 2013-10-16 21:56 - 2013-10-16 21:56 - 00000000 ____D C:\Program Files\metaCrawler 2013-10-16 21:56 - 2013-10-16 21:47 - 00001072 _____ C:\Users\Public\Desktop\Open It!.lnk 2013-10-16 21:52 - 2013-10-16 21:47 - 00000916 _____ C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job 2013-10-16 21:48 - 2013-10-16 21:48 - 00001163 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk 2013-10-16 21:48 - 2013-10-16 21:48 - 00001049 _____ C:\Users\Svenski\Desktop\MyPC Backup.lnk 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\ProgramData\Systweak 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\ProgramData\BitGuard 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\Program Files\Doko-Toolbar 2013-10-16 21:48 - 2013-10-16 21:48 - 00000000 ____D C:\Program Files\Advanced System Protector 2013-10-16 21:48 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Systweak 2013-10-16 21:48 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\Whilokii 2013-10-16 21:47 - 2013-10-16 21:47 - 00001012 _____ C:\Users\Public\Desktop\RegClean Pro.lnk 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BonanzaDeals 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\DigitalSite 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\BabSolution 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\0D0S1L2Z1P1B 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Local\Google 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Users\Svenski\AppData\Local\BonanzaDealsLive 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\ProgramData\BonanzaDealsLive 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\ProgramData\Babylon 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\RegClean Pro 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\OpenIt 2013-10-16 21:47 - 2013-10-16 21:47 - 00000000 ____D C:\Program Files\BonanzaDealsLive 2013-10-16 21:26 - 2012-04-28 12:16 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-16 21:15 - 2009-07-14 06:34 - 00016000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-16 21:15 - 2009-07-14 06:34 - 00016000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-16 21:10 - 2013-10-07 22:45 - 00000000 ____D C:\Users\Svenski\AppData\Local\Spotify 2013-10-16 21:10 - 2012-09-14 16:51 - 00001149 _____ C:\Users\Svenski\Desktop\Mediencenter.lnk 2013-10-16 21:10 - 2012-09-14 16:51 - 00001135 _____ C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mediencenter.lnk 2013-10-15 20:01 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Globalization 2013-10-15 19:33 - 2013-03-25 11:48 - 00000000 ____D C:\Program Files\DVDvideoSoft_2.0 2013-10-15 19:30 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET 2013-10-15 19:07 - 2013-10-15 19:07 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Malwarebytes 2013-10-15 19:06 - 2013-10-15 19:06 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-15 19:06 - 2013-10-15 19:06 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-10-15 19:06 - 2013-10-15 19:06 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-10-14 21:22 - 2013-10-14 21:22 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\QuickScan 2013-10-14 19:39 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE 2013-10-12 15:56 - 2013-05-06 12:28 - 00010439 _____ C:\Users\Svenski\Documents\v1home_offline.mht 2013-10-12 15:25 - 2010-02-26 16:11 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-12 15:18 - 2009-07-14 06:33 - 00311480 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-12 10:55 - 2013-08-10 13:38 - 00000000 ____D C:\Windows\system32\MRT 2013-10-12 10:53 - 2010-03-06 14:29 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-10-11 10:26 - 2012-04-28 12:16 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-10-11 10:26 - 2011-05-13 22:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2013-10-10 14:24 - 2012-06-08 09:55 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-10-07 22:45 - 2013-10-07 22:45 - 00001817 _____ C:\Users\Svenski\Desktop\Spotify.lnk 2013-10-07 22:45 - 2013-10-07 22:45 - 00001803 _____ C:\Users\Svenski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2013-10-07 22:12 - 2010-02-26 16:12 - 00000000 ____D C:\Users\Svenski\AppData\Local\Mozilla 2013-10-05 14:04 - 2013-10-05 14:04 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-09-28 16:34 - 2013-09-28 16:17 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\vlc 2013-09-28 16:17 - 2013-09-28 16:17 - 00001028 _____ C:\Users\Public\Desktop\VLC media player.lnk 2013-09-23 01:28 - 2013-10-12 10:52 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-09-23 01:28 - 2013-10-12 10:52 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-09-23 01:28 - 2013-10-12 10:52 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-09-23 01:27 - 2013-10-12 10:53 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-09-23 01:27 - 2013-10-12 10:53 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-09-23 01:27 - 2013-10-12 10:53 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-09-23 01:27 - 2013-10-12 10:52 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-09-22 20:25 - 2012-12-27 14:11 - 00000789 _____ C:\Users\Svenski\AppData\Local\cookies.ini 2013-09-21 19:20 - 2010-04-21 20:11 - 00000000 ____D C:\Users\Svenski\AppData\Roaming\Apple Computer 2013-09-21 19:19 - 2010-03-06 18:39 - 00000000 ____D C:\Users\Svenski\AppData\Local\Apple 2013-09-21 19:17 - 2010-04-21 20:11 - 00000000 ____D C:\Users\Svenski\AppData\Local\Apple Computer 2013-09-21 18:39 - 2013-09-21 18:39 - 00001556 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-09-21 18:39 - 2013-09-21 18:39 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2013-09-21 18:39 - 2013-09-21 18:39 - 00000000 ____D C:\Program Files\iPod 2013-09-21 18:39 - 2010-03-06 18:38 - 00000000 ____D C:\Program Files\Common Files\Apple 2013-09-21 05:30 - 2013-10-12 10:53 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-09-21 04:39 - 2013-10-12 10:52 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe Some content of TEMP: ==================== C:\Users\Svenski\AppData\Local\Temp\BackupSetup.exe C:\Users\Svenski\AppData\Local\Temp\Mediencenter_3.8.9799.6.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-11 12:01 ==================== End Of Log ============================ Addition: Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013 Ran by Svenski at 2013-10-16 22:16:11 Running from A:\ Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Norton 360 Online (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Norton 360 Online (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton 360 Online (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} ==================== Installed Programs ====================== 7-Zip 9.20 Adobe AIR (Version: 2.6.0.19120) Adobe Flash Player 11 ActiveX (Version: 11.9.900.117) Adobe Flash Player 11 Plugin (Version: 11.9.900.117) Adobe Reader 9.5.2 - Deutsch (Version: 9.5.2) Advanced System Protector (Version: 2.1.1000.10905) Apple Application Support (Version: 2.3.6) Apple Mobile Device Support (Version: 7.0.0.117) Apple Software Update (Version: 2.1.3.127) Bonanza Deals (remove only) (Version: 5.0.1.0) Bonjour (Version: 3.0.0.10) D3DX10 (Version: 15.4.2368.0902) DHTML Editing Component (Version: 6.02.0001) dLAN Cockpit (Version: 3.2.28) Doko Chrome Toolbar Doko toolbar (Version: 1.8.26.9) DVDvideoSoft 2.0 Toolbar (Version: 6.11.2.6) EaseUS Partition Master 9.2.2 Fotogalerie (Version: 16.4.3505.0912) Free Studio version 2013 (Version: 6.1.0.320) Google Update Helper (Version: 1.3.23.0) Hattrick Organizer (remove only) iCloud (Version: 3.0.2.163) iTunes (Version: 11.1.0.126) Java 7 Update 25 (Version: 7.0.250) Java Auto Updater (Version: 2.1.9.5) Java(TM) 6 Update 21 (Version: 6.0.210) JMicron JMB38X Flash Media Controller (Version: 1.00.10.04) K-Lite Codec Pack 7.6.0 (Full) (Version: 7.6.0) Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Mediencenter 3.8.9799.6 (HKCU Version: 3.8.9799.6) Mein CEWE FOTOBUCH (Version: 4.8.6) metaCrawler Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6012.5000) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Movie Maker (Version: 16.4.3505.0912) Mozilla Firefox 24.0 (x86 de) (Version: 24.0) Mozilla Maintenance Service (Version: 24.0) Mozilla Thunderbird 12.0.1 (x86 de) (Version: 12.0.1) MSVCRT (Version: 15.4.2862.0708) MSVCRT110 (Version: 16.4.1108.0727) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) MyPC Backup (Version: ) Norton 360 (Version: 6.4.1.14) NVIDIA Display Control Panel (Version: 6.14.11.9745) NVIDIA Drivers (Version: 1.10.59.37) Open It! (Version: 1.1.1) OpenOffice.org 3.2 (Version: 3.2.9502) Pando Media Booster (Version: 2.3.5.2) PC Speed Maximizer v3.2 (Version: 3.2) Photo Gallery (Version: 16.4.3505.0912) PokerStars.net PrintKey2000 PVSonyDll (Version: 1.00.0001) QuickTime (Version: 7.74.80.86) RegClean Pro (Version: 6.21) SopCast 3.2.8 (Version: 3.2.8) Spotify (HKCU Version: 0.9.4.185.g7545a404) Total Commander (Remove or Repair) (Version: 7.55a) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3) Update for Zip Extractor V1 Home 2.0 (Version: 2.02.55) VLC media player 2.0.8 (Version: 2.0.8) VTech Download Agent Library (Version: 1.00.0000) VTech Download Manager Wajam (Version: 2.02) Whilokii 1.0.0 (Version: 1.0.0) Windows Live Communications Platform (Version: 16.4.3505.0912) Windows Live Essentials (Version: 16.4.3505.0912) Windows Live Family Safety (Version: 16.4.3505.0912) Windows Live ID Sign-in Assistant (Version: 7.250.4311.0) Windows Live Installer (Version: 16.4.3505.0912) Windows Live Photo Common (Version: 16.4.3505.0912) Windows Live PIMT Platform (Version: 16.4.3505.0912) Windows Live SOXE (Version: 16.4.3505.0912) Windows Live SOXE Definitions (Version: 16.4.3505.0912) Windows Live UX Platform (Version: 16.4.3505.0912) Windows Live UX Platform Language Pack (Version: 16.4.3505.0912) WinPcap 4.1.2 (Version: 4.1.0.2001) Zip Extractor Packages ==================== Restore Points ========================= 16-10-2013 19:49:48 RegClean Pro Mi, Okt 16, 13 21:49 ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {082D07A3-7E72-4CA2-BDF8-74D1B38EEF31} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\6.4.1.14\SymErr.exe [2012-02-04] (Symantec Corporation) Task: {145ED1CE-2E48-4BE6-868B-96E96BE6DC0E} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\6.4.1.14\WSCStub.exe [2013-02-02] (Symantec Corporation) Task: {2F164306-CA80-49AF-9078-EE4678788A5E} - System32\Tasks\MetaCrawler => C:\Users\Svenski\AppData\Roaming\METACR~1\UPDATE~1\UPDATE~1.EXE [2013-04-12] () Task: {31336696-A08C-44D7-8CA7-A97D8DDBA07C} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-16] (BonanzaDeals) Task: {3DF8F4DA-6AD8-4A9D-BE2E-4D9E422958B4} - System32\Tasks\RegClean Pro => C:\Program Files\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) Task: {40EAC140-6B56-4522-96C1-37812E20684F} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) Task: {462C094A-2079-4584-BAE9-90EBB3CCBA3E} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation) Task: {478B8F1F-DB2A-4EA8-B5A2-4F6314636C46} - System32\Tasks\BonanzaDealsUpdate => C:\Program Task: {47B539FE-2835-4644-8CB5-B70E8DE1198E} - System32\Tasks\DigitalSite => C:\Users\Svenski\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE [2013-04-12] () Task: {4C1AC3AE-0479-41C3-B219-C40AFDC60B47} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files\RegClean Pro\RegCleanPro.exe [2013-07-22] (Systweak Inc) Task: {5F1B9F97-EE6E-4806-B1C1-82EBA9E40BCB} - System32\Tasks\{B50CF895-988C-42C2-83AB-DF412163D1D2} => C:\Program Files\Skype\Phone\Skype.exe Task: {92253B2A-1C71-4553-A9D3-978DA5358954} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-07-11] (Adobe Systems Incorporated) Task: {954322C2-0D52-496E-A74B-4A5908455603} - System32\Tasks\EPUpdater => C:\Users\Svenski\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [2013-09-01] () Task: {98EAB1AD-200A-4DE4-A57F-93FC99837255} - System32\Tasks\Advanced System Protector_startup => C:\Program Files\Advanced System Protector\AdvancedSystemProtector.exe [2013-05-24] (Systweak) Task: {ADDB94A0-6AB7-43BB-ACC4-A58FED7D20FA} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\6.4.1.14\SymErr.exe [2012-02-04] (Symantec Corporation) Task: {B969330C-3114-434F-A304-1AA2AFECA342} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-11] (Adobe Systems Incorporated) Task: {BD91EFCF-BC36-41EF-BC92-09F7A94D315E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {C214ECC4-462F-4217-A0D4-37FA9BBAA5DD} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-10-16] (BonanzaDeals) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job => C:\Program Files\BonanzaDealsLive\Update\BonanzaDealsLive.exe Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Svenski\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE Task: C:\Windows\Tasks\MetaCrawler.job => C:\Users\Svenski\AppData\Roaming\METACR~1\UPDATE~1\UPDATE~1.EXE Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files\RegClean Pro\RegCleanPro.exe Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files\RegClean Pro\RegCleanPro.exe ==================== Loaded Modules (whitelisted) ============= 2013-10-16 21:48 - 2012-07-25 12:03 - 00886272 _____ () C:\Program Files\Advanced System Protector\System.Data.SQLite.dll 2013-10-16 21:48 - 2013-05-24 13:13 - 01730928 _____ () C:\Program Files\Advanced System Protector\aspsys.dll 2012-07-05 03:27 - 2010-06-24 03:16 - 02150400 _____ () C:\Program Files\VTech\DownloadManager\System\QtCore4.dll 2012-07-05 03:27 - 2010-07-13 15:07 - 07826432 _____ () C:\Program Files\VTech\DownloadManager\System\QtGui4.dll 2012-07-05 03:27 - 2010-06-02 04:29 - 00934912 _____ () C:\Program Files\VTech\DownloadManager\System\QtNetwork4.dll 2012-07-05 03:27 - 2010-06-02 04:28 - 00335360 _____ () C:\Program Files\VTech\DownloadManager\System\QtXml4.dll 2013-06-24 11:36 - 2012-08-06 11:54 - 09843640 _____ () C:\Program Files\VTech\DownloadManager\System\QtWebKit4.dll 2012-07-05 03:27 - 2010-06-02 04:56 - 00232960 _____ () C:\Program Files\VTech\DownloadManager\System\phonon4.dll 2012-07-05 03:27 - 2010-06-02 04:54 - 02530816 _____ () C:\Program Files\VTech\DownloadManager\System\QtXmlPatterns4.dll 2012-07-05 03:27 - 2010-07-05 11:19 - 00116736 _____ () C:\Program Files\VTech\DownloadManager\System\QtSolutions_SOAP-2.7.dll 2012-07-05 03:27 - 2010-11-11 11:24 - 00028160 _____ () C:\Program Files\VTech\DownloadManager\System\DACommCenter.dll 2013-06-24 11:36 - 2010-06-02 07:05 - 00025600 _____ () C:\Program Files\VTech\DownloadManager\System\imageformats\qgif4.dll 2013-06-24 11:36 - 2010-06-02 07:05 - 00119808 _____ () C:\Program Files\VTech\DownloadManager\System\imageformats\qjpeg4.dll 2011-11-02 00:26 - 2011-11-02 00:26 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2011-11-02 00:26 - 2011-11-02 00:26 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll 2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll 2013-09-20 00:37 - 2013-09-20 00:37 - 00012288 _____ () C:\Program Files\MyPC Backup\GetText.dll 2013-09-20 00:32 - 2013-09-20 00:32 - 00904704 _____ () C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll 2010-05-04 15:36 - 2010-05-04 15:36 - 00970752 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll 2013-10-05 14:04 - 2013-10-05 14:04 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll 2013-10-11 10:26 - 2013-10-11 10:26 - 16233864 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/16/2013 09:49:47 PM) (Source: VSS) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert . Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess. Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {3c9b00bd-35ff-43fc-abf1-4d4577bd74b1} Error: (10/12/2013 02:19:01 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 3257551 Error: (10/12/2013 02:19:01 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 3257551 Error: (10/12/2013 02:19:01 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/12/2013 01:24:50 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 6256 Error: (10/12/2013 01:24:50 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 6256 Error: (10/12/2013 01:24:50 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/12/2013 01:23:21 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 11217 Error: (10/12/2013 01:23:21 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 11217 Error: (10/12/2013 01:23:21 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second System errors: ============= Error: (10/16/2013 10:11:54 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UPnP-Gerätehost" ist vom Dienst "SSDP-Suche" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (10/16/2013 10:11:54 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UPnP-Gerätehost" ist vom Dienst "SSDP-Suche" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (10/16/2013 10:11:53 PM) (Source: WMPNetworkSvc) (User: ) Description: WMPNetworkSvc0x80070422 Error: (10/16/2013 10:11:11 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: %%-2140993535 Error: (10/16/2013 10:11:11 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2140993535 Error: (10/16/2013 10:11:11 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2140993535 Error: (10/16/2013 10:11:11 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: %%-2140993535 Error: (10/16/2013 10:11:11 PM) (Source: PNRPSvc) (User: ) Description: 0x80630801 Error: (10/16/2013 10:11:11 PM) (Source: PNRPSvc) (User: ) Description: 0x80630801 Error: (10/16/2013 10:11:05 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "UPnP-Gerätehost" ist vom Dienst "SSDP-Suche" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Microsoft Office Sessions: ========================= Error: (10/16/2013 09:49:47 PM) (Source: VSS)(User: ) Description: 0x80070005, Zugriff verweigert Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {3c9b00bd-35ff-43fc-abf1-4d4577bd74b1} Error: (10/12/2013 02:19:01 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 3257551 Error: (10/12/2013 02:19:01 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 3257551 Error: (10/12/2013 02:19:01 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/12/2013 01:24:50 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 6256 Error: (10/12/2013 01:24:50 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 6256 Error: (10/12/2013 01:24:50 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (10/12/2013 01:23:21 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 11217 Error: (10/12/2013 01:23:21 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 11217 Error: (10/12/2013 01:23:21 AM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second ==================== Memory info =========================== Percentage of memory in use: 48% Total physical RAM: 3066.87 MB Available physical RAM: 1581.5 MB Total Pagefile: 5654.94 MB Available Pagefile: 4028.64 MB Total Virtual: 2047.88 MB Available Virtual: 1898.29 MB ==================== Drives ================================ Drive a: (Volume) (Fixed) (Total:235.59 GB) (Free:155.7 GB) NTFS Drive b: (Volume) (Fixed) (Total:297.99 GB) (Free:203.31 GB) NTFS Drive c: () (Fixed) (Total:48.83 GB) (Free:0.8 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 298 GB) (Disk ID: BEFAC89F) Partition 1: (Not Active) - (Size=49 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=236 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 50A5B170) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Logfiles GMER: GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-10-17 06:28:43 Windows 6.1.7601 Service Pack 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 Hitachi_HTS543232L9A300 rev.FB4OC40C 298,09GB Running: gmer_2.1.19163(1).exe; Driver: C:\Users\Svenski\AppData\Local\Temp\kflirfog.sys ---- System - GMER 2.1 ---- SSDT 8685BD68 ZwAlpcConnectPort SSDT 8687E870 ZwLoadDriver ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 82E7EA15 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82EB8212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text ntkrnlpa.exe!KeRemoveQueueEx + 10FF 82EBF494 4 Bytes [68, BD, 85, 86] .text ntkrnlpa.exe!KeRemoveQueueEx + 1313 82EBF6A8 4 Bytes CALL B7CD7D34 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF6 0x34 0x2D 0x3D ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF6 0x34 0x2D 0x3D ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk1\DR1 unknown MBR code ---- EOF - GMER 2.1 ---- Ich bin kein Experte in diesen Sachen, daher erhoffe ich mir, das ich mit den Dingen, die ich bereits veranlasst habe, mein Rechner wieder sauber ist. Ich habe wenig Lust, den PC komplett neu aufzusetzen. Für Rückmeldungen bin ich dankbar, Gruß, Svenski74 |
Baum-Darstellung