| |
| |||||||
Log-Analyse und Auswertung: Bka interpol trojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.10.2013, 17:44
| #1 |
| |  Bka interpol trojaner Guten Abend bin neu hier und habe kaum ahnung. folgendes problem habe mir den BKA Interpol europol.. trojaner eingefangen. habe hier schon beiträge gelesen und schon den Farbar's recavery scan tool ausgefürt. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01
Ran by SYSTEM on MININT-3VPSEPM on 27-10-2013 16:38:14
Running from H:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2010-06-09] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM\...\Run: [WrtMon.exe] - C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [26448 2008-05-24] (NewSoft Technology Corporation)
HKLM\...\Run: [ISW] - [x]
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2009-07-13] (Microsoft Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe [263936 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [Camera Assistant Software] - C:\Program Files (x86)\Video Web Camera\traybar.exe [600688 2010-07-15] (Chicony)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CloneCDTray] - C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PMSpeed] - C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSpeed.EXE [112464 2009-12-04] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73392 2012-06-21] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-11] (Oracle Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe /default
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe /default
HKU\Elfi\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKU\Elfi\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKU\Elfi\...\Run: [Scan Buttons] - C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSB.EXE [202576 2009-12-09] (NewSoft Technology Corporation)
HKU\Elfi\...\Run: [EPSON BX525WD Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE /FU "C:\Windows\TEMP\E_SACF1.tmp" /EF "HKCU"
HKU\Elfi\...\Run: [PC Suite Tray] - "D:\Programme2\Nokia PC Suite 7\PCSuite.exe" -onlytray
HKU\Elfi\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\Elfi\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)
HKU\Elfi\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-02-12] (TomTom)
HKU\Elfi\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKU\Elfi\...\Winlogon: [Shell] cmd.exe [344576 2009-07-13] (Microsoft Corporation) <==== ATTENTION
HKU\Elfi\...\Command Processor: "C:\Users\Elfi\AppData\Local\QgolQOrJD\JJhO1vKNv8.exe" <===== ATTENTION!
==================== Services (Whitelisted) =================
S2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [868896 2010-06-11] (Acer Incorporated)
S2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [827520 2012-04-30] (Check Point Software Technologies)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [255744 2010-06-28] (NewTech Infosystems, Inc.)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2012-07-17] ()
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232 2010-01-28] (Acer Group)
S2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445880 2012-06-21] (Check Point Software Technologies LTD)
==================== Drivers (Whitelisted) ====================
S3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
S3 ElbyCDFL; C:\Windows\SysWow64\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [243200 2010-03-31] (Huawei Technologies Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2010-03-31] (Huawei Technologies Co., Ltd.)
S2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33672 2012-04-30] (Check Point Software Technologies)
S0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2012-01-09] (Kaspersky Lab ZAO)
S1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2012-01-09] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [485680 2012-01-09] (Kaspersky Lab)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-03-20] (RapidSolution Software AG)
S3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-03-20] (RapidSolution Software AG)
S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
S1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD)
S1 oezlvlyp; \??\C:\Windows\system32\drivers\oezlvlyp.sys [x]
========================== Drivers MD5 =======================
C:\Windows\system32\DRIVERS\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ACPI.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys DB9D6C6B2CD95A9CA414D045B627422E
C:\Windows\system32\DRIVERS\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\aliide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atipmdag.sys 52679612D742BF74CA1BA6AB86DDF431
C:\Windows\System32\DRIVERS\atikmpag.sys 414E0788920A8C856032BE2CBF29F984
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys ==> MD5 is legit
C:\Windows\System32\drivers\AmUStor.SYS 391887990CDAA83DE5C56C3FDE966DA1
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athrx.sys E642491F64E58CD5BC8FB8B347DCF65F
C:\Windows\System32\drivers\AtiHdmi.sys FB7602C5C508BE281368AAE0B61B51C6
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bcmwl664.sys 9E84A931DBEE0292E38ED672F6293A99
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 937BEB186A735ACA91D717044A49D17E
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys 0B3F6C8F93C5C25977EA5A8B2E656357
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ElbyCDFL.sys 9387A484D31209D7FC3F795A787294DB
C:\Windows\SysWow64\Drivers\ElbyCDFL.sys 9387A484D31209D7FC3F795A787294DB
C:\Windows\System32\Drivers\ElbyCDIO.sys A05FC7ECA0966EBB70E4D17B855A853B
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\errdev.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ewusbnet.sys 477BC304201197F4057090BD60AF1739
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\SysWOW64\FsUsbExDisk.SYS DDEE99DC54EFA20BD5A442CD733C4462
C:\Windows\System32\Drivers\Fs_Rec.sys D3E3F93D67821A2DB2B3D9FAC2DC2064
C:\Windows\System32\DRIVERS\fvevol.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys B6AC71AAA2B10848F57FC49D55A651AF
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ewusbmdm.sys 8F9B0FC4EC3A8194BD4CBC5ED3E7ABEB
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ewusbdev.sys B45B3647BA32749B94FA689175EC8C26
C:\Windows\system32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys ABBF174CB394F5C437410A788B7E404A
C:\Windows\system32\drivers\iaStorV.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\igdkmd64.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Impcd.sys 36FDF367A1DABFF903E2214023D71368
C:\Windows\System32\drivers\RTKVHD64.sys E8017F1662D9142F45CEAB694D013C00
C:\Windows\system32\DRIVERS\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\isapnp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\msiscsi.sys ==> MD5 is legit
C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys 1152F8BEB568F2F72F1C5C32A1F4E529
C:\Windows\System32\DRIVERS\k57nd60a.sys 12E27942DBB7C91880163634B0D8A776
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kl1.sys E656FE10D6D27794AFA08136685A69E8
C:\Windows\System32\DRIVERS\kl2.sys D865DD8B0448E3F963D68C04C532858F
C:\Windows\System32\DRIVERS\klif.sys 055790D38D7EC73AEF03E4AA7F67BA03
C:\Windows\System32\Drivers\ksecdd.sys 16C1B906FC5EAD84769F90B736B6BF0E
C:\Windows\System32\Drivers\ksecpkg.sys 0B711550C56444879D71C7DAABDA6C83
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1E62x64.sys 2AC603C3188C704CFCE353659AA7AD71
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mbam.sys 0BB97D43299910CBFBA59C461B99B910
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb10.sys F0067552F8F9B33D7C59403AB808A3CB
C:\Windows\System32\DRIVERS\mrxsmb20.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\msahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\NTIDrvr.sys 64DDD0DEE976302F4BD93E5EFCC2F013
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvstor.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 90061B1ACFE8CCAA5345750FFE08D8B8
C:\Windows\System32\DRIVERS\pccsmcfdx64.sys BC0018C2D29F655188A0ED3FA94FDB24
C:\Windows\System32\DRIVERS\pci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PxHlpa64.sys FBF4DB6D53585437E41A113300002A2B
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys 447DE7E3DEA39D422C1504F245B668B1
C:\Windows\System32\drivers\rdyboost.sys E5DC9BA9E439D6DBDD79F8CAACB5BF01
C:\Windows\System32\DRIVERS\rrnetcap.sys 2ABD2B3BA2EF0C3BA82284C2A5E28675
C:\Windows\System32\DRIVERS\rrnetcap.sys 2ABD2B3BA2EF0C3BA82284C2A5E28675
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv2.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srvnet.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssadbus.sys 52D6F40B50ECFC051979FEC68E74F0F8
C:\Windows\System32\DRIVERS\ssadmdfl.sys D6CFD3B2EABCF9327DE39C62BABFA1E3
C:\Windows\System32\DRIVERS\ssadmdm.sys 5EB01E6148742C3EC2185AC92F6D16FD
C:\Windows\System32\DRIVERS\ssudmdm.sys EA8F41484CCC5BA6A1455C2AD3D1BE3C
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys ED6D1424E5B0C21A57B28DD8508D6843
C:\Windows\System32\drivers\tbhsd.sys 4430E9B4C60AAB672D16E801BAD0555E
C:\Windows\System32\drivers\tcpip.sys 624C5B3AA4C99B3184BB922D9ECE3FF0
C:\Windows\System32\DRIVERS\tcpip.sys 624C5B3AA4C99B3184BB922D9ECE3FF0
C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 7518F7BCFD4B308ABC9192BACAF6C970
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\TurboB.sys 825E7A1F48FB8BCFBA27C178AAB4E275
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\system32\drivers\UBHelper.sys 2E22C1FD397A5A9FFEF55E9D1FC96C00
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 537A4E03D7103C12D42DFD8FFDB5BDC9
C:\Windows\system32\DRIVERS\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys FBB21EBE49F6D560DB37AC25FBC68E66
C:\Windows\System32\DRIVERS\usbhub.sys 6B7A8A99C4A459E73C286A6763EA24CC
C:\Windows\system32\drivers\usbohci.sys 8C88AA7617B4CBC2E4BED61D26B33A27
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS ==> MD5 is legit
C:\Windows\system32\drivers\usbuhci.sys 0B5B3B2DF3FD1709618ACFA50B8392B0
C:\Windows\System32\Drivers\usbvideo.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viaide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\volsnap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vsdatant.sys 239D8D72730226CD460BDC8CA0A23D43
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-27 16:34 - 2013-10-27 16:34 - 00000000 ____D C:\FRST
2013-10-27 06:50 - 2013-10-27 06:53 - 00000000 ____D C:\Users\Elfi\AppData\Local\QgolQOrJD
2013-10-27 06:50 - 2013-10-27 06:50 - 00322560 _____ C:\Users\Elfi\AppData\Roaming\GlOrX4Cx
2013-10-27 06:50 - 2013-10-27 06:50 - 00322560 _____ C:\Users\Elfi\AppData\Local\UtAvIgPqi
2013-10-27 06:50 - 2013-10-27 06:50 - 00322560 _____ C:\ProgramData\kMtQaOTz
2013-10-22 21:13 - 2013-10-22 21:19 - 00000000 ____D C:\Users\Elfi\Desktop\Neuer Ordner
2013-10-22 00:20 - 2013-10-27 07:13 - 00001803 _____ C:\Windows\setupact.log
2013-10-22 00:20 - 2013-10-22 00:20 - 00000000 _____ C:\Windows\setuperr.log
2013-10-08 00:04 - 2013-10-08 00:04 - 00000241 _____ C:\Windows\wininit.ini
2013-10-07 23:34 - 2013-10-07 23:57 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-10-07 23:33 - 2013-10-08 00:01 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\Systweak
2013-10-07 23:33 - 2013-10-07 23:33 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-10-07 23:33 - 2013-10-07 23:33 - 00000288 _____ C:\Windows\Tasks\DigitalSite.job
2013-10-07 23:33 - 2013-10-07 23:33 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\DigitalSite
2013-10-07 23:33 - 2013-07-22 06:07 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\System32\roboot64.exe
2013-10-07 23:31 - 2013-10-07 23:31 - 00749248 _____ C:\Users\Elfi\Downloads\ZipExtractorSetup.exe
==================== One Month Modified Files and Folders =======
2013-10-27 16:34 - 2013-10-27 16:34 - 00000000 ____D C:\FRST
2013-10-27 07:14 - 2012-04-17 07:28 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-27 07:14 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-27 07:13 - 2013-10-22 00:20 - 00001803 _____ C:\Windows\setupact.log
2013-10-27 07:11 - 2011-04-28 02:30 - 00000000 ____D C:\ProgramData\PC Suite
2013-10-27 06:53 - 2013-10-27 06:50 - 00000000 ____D C:\Users\Elfi\AppData\Local\QgolQOrJD
2013-10-27 06:50 - 2013-10-27 06:50 - 00322560 _____ C:\Users\Elfi\AppData\Roaming\GlOrX4Cx
2013-10-27 06:50 - 2013-10-27 06:50 - 00322560 _____ C:\Users\Elfi\AppData\Local\UtAvIgPqi
2013-10-27 06:50 - 2013-10-27 06:50 - 00322560 _____ C:\ProgramData\kMtQaOTz
2013-10-27 06:49 - 2010-11-01 17:32 - 00654400 _____ C:\Windows\System32\perfh007.dat
2013-10-27 06:49 - 2010-11-01 17:32 - 00130240 _____ C:\Windows\System32\perfc007.dat
2013-10-27 06:49 - 2009-07-13 21:13 - 01498568 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-27 06:46 - 2011-09-24 11:58 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\.oit
2013-10-27 03:20 - 2012-04-17 07:28 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-27 03:02 - 2012-07-17 21:49 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-26 23:54 - 2009-07-13 20:45 - 00017376 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-26 23:54 - 2009-07-13 20:45 - 00017376 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-26 23:51 - 2012-05-09 23:48 - 00000000 ____D C:\ProgramData\boost_interprocess
2013-10-22 21:19 - 2013-10-22 21:13 - 00000000 ____D C:\Users\Elfi\Desktop\Neuer Ordner
2013-10-22 00:20 - 2013-10-22 00:20 - 00000000 _____ C:\Windows\setuperr.log
2013-10-21 22:18 - 2012-07-14 10:39 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-10-20 10:15 - 2012-04-17 07:28 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-20 10:15 - 2012-04-17 07:28 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-17 23:06 - 2009-07-13 21:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-10 04:02 - 2012-07-17 21:49 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-10 04:02 - 2012-03-29 11:24 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-10 04:02 - 2011-06-10 12:40 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-08 00:04 - 2013-10-08 00:04 - 00000241 _____ C:\Windows\wininit.ini
2013-10-08 00:01 - 2013-10-07 23:33 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\Systweak
2013-10-07 23:57 - 2013-10-07 23:34 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-10-07 23:47 - 2013-05-24 10:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Xqtrfltzfvn
2013-10-07 23:47 - 2013-05-24 10:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Vjjhjw
2013-10-07 23:46 - 2013-05-24 10:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Mlllcaxmrfb
2013-10-07 23:46 - 2013-05-24 10:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Gqpnvqgr
2013-10-07 23:46 - 2013-05-24 10:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Dfiklyaxp
2013-10-07 23:41 - 2011-04-28 00:10 - 00000000 ____D C:\users\Elfi
2013-10-07 23:33 - 2013-10-07 23:33 - 00003230 _____ C:\Windows\System32\Tasks\DigitalSite
2013-10-07 23:33 - 2013-10-07 23:33 - 00000288 _____ C:\Windows\Tasks\DigitalSite.job
2013-10-07 23:33 - 2013-10-07 23:33 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\DigitalSite
2013-10-07 23:31 - 2013-10-07 23:31 - 00749248 _____ C:\Users\Elfi\Downloads\ZipExtractorSetup.exe
2013-10-04 03:48 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
ZeroAccess:
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000001.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000004.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\000000cb.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\00000004.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\1afb2d56
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\201d3dde
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1996258713-3965154596-4204642585-1000\$b8123e2bc4d6d19d3a139a9ec0c57ece
ZeroAccess:
C:\Users\Elfi\AppData\Local\396b2c07
C:\Users\Elfi\AppData\Local\396b2c07\@
C:\Users\Elfi\AppData\Local\396b2c07\U\80000000.$
C:\Users\Elfi\AppData\Local\396b2c07\U\800000cb.$
ZeroAccess:
C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}
C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@
Files to move or delete:
====================
C:\Users\Elfi\AppData\Local\QgolQOrJD\JJhO1vKNv8.exe
C:\ProgramData\agoir.bat
C:\ProgramData\agoir.pad
C:\ProgramData\agoir.reg
C:\Users\Elfi\taskmgr.exe
Some content of TEMP:
====================
C:\Users\Elfi\AppData\Local\Temp\F576.dll
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
1
Restore point made on: 2013-10-27 03:04:17
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=Y:
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {default}
resumeobject {a62c839c-e621-11df-9459-ad516ed94a21}
displayorder {default}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {a62c839c-e621-11df-9459-ad516ed94a21}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device ramdisk=[C:]\Recovery\a62c839e-e621-11df-9459-ad516ed94a21\Winre.wim,{a62c839f-e621-11df-9459-ad516ed94a21}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\a62c839e-e621-11df-9459-ad516ed94a21\Winre.wim,{a62c839f-e621-11df-9459-ad516ed94a21}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {a62c839c-e621-11df-9459-ad516ed94a21}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=Y:
path \boot\memtest.exe
description Windows Memory Diagnostic
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {a62c839f-e621-11df-9459-ad516ed94a21}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\a62c839e-e621-11df-9459-ad516ed94a21\boot.sdi
==================== Memory info ===========================
Percentage of memory in use: 18%
Total physical RAM: 3956.5 MB
Available physical RAM: 3243.38 MB
Total Pagefile: 3954.64 MB
Available Pagefile: 3242.64 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB
==================== Drives ================================
Drive c: (Packard Bell) (Fixed) (Total:52.61 GB) (Free:3.23 GB) NTFS
Drive e: (Lokaler Datenträger) (Fixed) (Total:400.36 GB) (Free:170.63 GB) NTFS
Drive f: (PQSERVICE) (Fixed) (Total:12.7 GB) (Free:1.24 GB) NTFS
Drive h: () (Removable) (Total:14.9 GB) (Free:14.84 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: EBD8EBD8)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=53 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=400 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 002C966D)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)
LastRegBack: 2013-10-21 11:21
==================== End Of Log ============================
|
|
27.10.2013, 18:07
| #2 |
| /// the machine /// TB-Ausbilder    | Bka interpol trojaner hi,
__________________Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\Elfi\...\Winlogon: [Shell] cmd.exe [344576 2009-07-13] (Microsoft Corporation) <==== ATTENTION
HKU\Elfi\...\Command Processor: "C:\Users\Elfi\AppData\Local\QgolQOrJD\JJhO1vKNv8.exe" <===== ATTENTION!
S1 oezlvlyp; \??\C:\Windows\system32\drivers\oezlvlyp.sys [x]
C:\Windows\system32\drivers\oezlvlyp.sys
ZeroAccess:
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000001.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000004.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\000000cb.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\00000004.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\1afb2d56
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\201d3dde
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1996258713-3965154596-4204642585-1000\$b8123e2bc4d6d19d3a139a9ec0c57ece
ZeroAccess:
C:\Users\Elfi\AppData\Local\396b2c07
C:\Users\Elfi\AppData\Local\396b2c07\@
C:\Users\Elfi\AppData\Local\396b2c07\U\80000000.$
C:\Users\Elfi\AppData\Local\396b2c07\U\800000cb.$
ZeroAccess:
C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}
C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@
C:\Users\Elfi\AppData\Local\QgolQOrJD\JJhO1vKNv8.exe
C:\ProgramData\agoir.bat
C:\ProgramData\agoir.pad
C:\ProgramData\agoir.reg
C:\Users\Elfi\taskmgr.exe
C:\Users\Elfi\AppData\Local\Temp\F576.dll
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Rechner normal starten.
__________________ |
|
27.10.2013, 18:17
| #3 |
| | Bka interpol trojaner FIXLOG:
__________________Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-10-2013 01
Ran by SYSTEM at 2013-10-27 16:14:48 Run:1
Running from H:\
Boot Mode: Recovery
==============================================
Content of fixlist:
*****************
HKU\Elfi\...\Winlogon: [Shell] cmd.exe [344576 2009-07-13] (Microsoft Corporation) <==== ATTENTION
HKU\Elfi\...\Command Processor: "C:\Users\Elfi\AppData\Local\QgolQOrJD\JJhO1vKNv8.exe" <===== ATTENTION!
S1 oezlvlyp; \??\C:\Windows\system32\drivers\oezlvlyp.sys [x]
C:\Windows\system32\drivers\oezlvlyp.sys
ZeroAccess:
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000001.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000004.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\000000cb.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\00000004.@
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\1afb2d56
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\201d3dde
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1996258713-3965154596-4204642585-1000\$b8123e2bc4d6d19d3a139a9ec0c57ece
ZeroAccess:
C:\Users\Elfi\AppData\Local\396b2c07
C:\Users\Elfi\AppData\Local\396b2c07\@
C:\Users\Elfi\AppData\Local\396b2c07\U\80000000.$
C:\Users\Elfi\AppData\Local\396b2c07\U\800000cb.$
ZeroAccess:
C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}
C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@
C:\Users\Elfi\AppData\Local\QgolQOrJD\JJhO1vKNv8.exe
C:\ProgramData\agoir.bat
C:\ProgramData\agoir.pad
C:\ProgramData\agoir.reg
C:\Users\Elfi\taskmgr.exe
C:\Users\Elfi\AppData\Local\Temp\F576.dll
*****************
HKU\Elfi\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\Elfi\Software\Microsoft\Command Processor\\AutoRun => Value not found.
oezlvlyp => Service deleted successfully.
"C:\Windows\system32\drivers\oezlvlyp.sys" => File/Directory not found.
C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece} => Moved successfully.
"C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@" => File/Directory not found.
"C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000001.@" => File/Directory not found.
"C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000004.@" => File/Directory not found.
"C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\000000cb.@" => File/Directory not found.
"C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\00000004.@" => File/Directory not found.
"C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\1afb2d56" => File/Directory not found.
"C:\Windows\Installer\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\L\201d3dde" => File/Directory not found.
C:\$Recycle.Bin\S-1-5-21-1996258713-3965154596-4204642585-1000\$b8123e2bc4d6d19d3a139a9ec0c57ece => Moved successfully.
C:\Users\Elfi\AppData\Local\396b2c07 => Moved successfully.
"C:\Users\Elfi\AppData\Local\396b2c07\@" => File/Directory not found.
"C:\Users\Elfi\AppData\Local\396b2c07\U\80000000.$" => File/Directory not found.
"C:\Users\Elfi\AppData\Local\396b2c07\U\800000cb.$" => File/Directory not found.
C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece} => Moved successfully.
"C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\@" => File/Directory not found.
"C:\Users\Elfi\AppData\Local\QgolQOrJD\JJhO1vKNv8.exe" => File/Directory not found.
C:\ProgramData\agoir.bat => Moved successfully.
C:\ProgramData\agoir.pad => Moved successfully.
C:\ProgramData\agoir.reg => Moved successfully.
C:\Users\Elfi\taskmgr.exe => Moved successfully.
"C:\Users\Elfi\AppData\Local\Temp\F576.dll" => File/Directory not found.
==== End of Fixlog ====
|
|
27.10.2013, 19:18
| #4 |
| /// the machine /// TB-Ausbilder | Bka interpol trojaner Startet der Rechner normal? Wenn ja dann ab jetzt alles im normalen Modus: Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.10.2013, 20:26
| #5 |
| | Bka interpol trojaner Malware: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.27.05 Windows 7 x64 NTFS Internet Explorer 9.0.8112.16421 Elfi :: WONDERLAND [Administrator] 27.10.2013 20:02:13 mbam-log-2013-10-27 (20-02-13).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 201492 Laufzeit: 6 Minute(n), 1 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Elfi\AppData\Local\Temp\F576.tmp (Trojan.FakeMS.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elfi\Downloads\ZipExtractorSetup.exe (PUP.Optional.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) ADW: Code:
ATTFilter # AdwCleaner v3.010 - Bericht erstellt am 27/10/2013 um 19:57:54
# Updated 20/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium (64 bits)
# Benutzername : Elfi - WONDERLAND
# Gestartet von : C:\Users\Elfi\Downloads\adwcleaner (1).exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\myfree codec
Ordner Gelöscht : C:\Program Files (x86)\myfree codec
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Users\Elfi\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Elfi\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Ordner Gelöscht : C:\Users\Elfi\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\Elfi\AppData\Roaming\Systweak
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Windows\Tasks\digitalsite.job
Datei Gelöscht : C:\Windows\System32\Tasks\digitalsite
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nokia-pc-suite_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_nokia-pc-suite_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5C3B5DAA-0AFF-4808-90FB-0F2F2D760E36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD501041-8EBE-11CE-8183-00AA00577DA2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Myfree Codec
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Myfree Codec
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyFreeCodec
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16446
-\\ Google Chrome v
[ Datei : C:\Users\Elfi\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [4743 octets] - [27/10/2013 19:56:39]
AdwCleaner[S0].txt - [4253 octets] - [27/10/2013 19:57:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4313 octets] ##########
FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-10-2013
Ran by Elfi (administrator) on WONDERLAND on 27-10-2013 20:18:28
Running from C:\Users\Elfi\Downloads
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Acer Group) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(NewSoft Technology Corporation) C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\Pmsb.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Nokia) D:\Programme2\Nokia PC Suite 7\PCSuite.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Chicony) C:\Program Files (x86)\Video Web Camera\traybar.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(NewSoft Technology Corporation) C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSpeed.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-29] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2010-06-10] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM\...\Run: [WrtMon.exe] - C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe [26448 2008-05-24] (NewSoft Technology Corporation)
HKLM\...\Run: [ISW] - [x]
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1271168 2012-03-26] (Microsoft Corporation)
HKCU\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKCU\...\Run: [Scan Buttons] - C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\Pmsb.exe [202576 2009-12-09] (NewSoft Technology Corporation)
HKCU\...\Run: [EPSON BX525WD Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE /FU "C:\Windows\TEMP\E_SACF1.tmp" /EF "HKCU"
HKCU\...\Run: [PC Suite Tray] - D:\Programme2\Nokia PC Suite 7\PCSuite.exe [1508408 2011-12-16] (Nokia)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-02-12] (TomTom)
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKCU\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\n. ATTENTION! ====> ZeroAccess?
HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION!
MountPoints2: {1303922f-7275-11e0-a406-70f1a1f79664} - F:\AutoRun.exe
MountPoints2: {1df21799-719d-11e0-bfb1-70f1a1f79664} - E:\AutoRun.exe
MountPoints2: {1df217c0-719d-11e0-bfb1-70f1a1f79664} - F:\AutoRun.exe
MountPoints2: {5d9ee513-95d2-11e0-a472-70f1a1f79664} - F:\AutoRun.exe
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe [263936 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-11] (Dritek System Inc.)
HKLM-x32\...\Run: [Camera Assistant Software] - C:\Program Files (x86)\Video Web Camera\traybar.exe [600688 2010-07-15] (Chicony)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CloneCDTray] - C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PMSpeed] - C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSpeed.exe [112464 2009-12-04] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe /default
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe /default
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E23EFB82-491D-4243-873D-642FDEDA979A} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=CC0D8507-0589-4F81-989A-CA8644C829D5&apn_sauid=7F2F8CAD-6903-4850-9816-069F6CB486D3&
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: HKLM-x32 {1C11B948-582A-433F-A98D-A8C4D5CC64F2} hxxp://www.kps-virtualplanner.de/kpsvp/Core/Player/2020PlayerAX_Win32.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Winsock: Catalog5 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 02 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog5-x64 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 02 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Tcpip\Parameters: [DhcpNameServer] 83.169.186.161 83.169.186.225
Tcpip\..\Interfaces\{26CC559B-4BA6-48F2-B060-E64B6AE99056}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{CD5344C1-61DC-41E7-AB58-F39D5F4448CA}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{F5B711C0-3AA2-447E-9ED5-B3219C4F4774}: [NameServer]193.189.244.225 193.189.244.206
Chrome:
=======
CHR HomePage: "homepage": "hxxp://www.google.com/",
CHR RestoreOnStartup: "hxxp://www.google.com/"
==================== Services (Whitelisted) =================
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [868896 2010-06-11] (Acer Incorporated)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [12600 2012-03-26] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [291696 2012-03-26] (Microsoft Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [255744 2010-06-28] (NewTech Infosystems, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2012-07-17] ()
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group)
==================== Drivers (Whitelisted) ====================
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWow64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [243200 2010-03-31] (Huawei Technologies Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2010-03-31] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [203888 2012-03-20] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [98688 2012-03-20] (Microsoft Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-03-20] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-03-20] (RapidSolution Software AG)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-28 01:34 - 2013-10-28 01:34 - 00000000 ____D C:\FRST
2013-10-27 20:18 - 2013-10-27 20:18 - 01956376 _____ (Farbar) C:\Users\Elfi\Downloads\FRST64.exe
2013-10-27 20:14 - 2013-10-27 20:15 - 01033335 _____ (Thisisu) C:\Users\Elfi\Downloads\JRT (1).exe
2013-10-27 20:05 - 2013-10-27 20:05 - 00000000 ____D C:\Windows\ERUNT
2013-10-27 20:01 - 2013-10-27 20:01 - 00004409 _____ C:\Users\Elfi\Desktop\AdwCleaner[S0].txt
2013-10-27 19:54 - 2013-10-27 19:54 - 01033335 _____ (Thisisu) C:\Users\Elfi\Downloads\JRT.exe
2013-10-27 19:53 - 2013-10-27 19:57 - 00000000 ____D C:\AdwCleaner
2013-10-27 19:52 - 2013-10-27 19:53 - 01060070 _____ C:\Users\Elfi\Downloads\adwcleaner (1).exe
2013-10-27 19:52 - 2013-10-27 19:52 - 01060070 _____ C:\Users\Elfi\Downloads\adwcleaner.exe
2013-10-27 17:24 - 2013-10-27 17:25 - 00004549 _____ C:\Windows\WindowsUpdate.log
2013-10-27 17:24 - 2013-10-27 17:24 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-10-27 17:14 - 2013-10-27 20:09 - 00010564 _____ C:\Windows\PFRO.log
2013-10-27 17:14 - 2013-10-27 20:09 - 00000168 _____ C:\Windows\setupact.log
2013-10-27 17:14 - 2013-10-27 17:14 - 00000000 _____ C:\Windows\setuperr.log
2013-10-27 16:21 - 2013-10-27 16:21 - 00003408 ____N C:\bootsqm.dat
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Roaming\GlOrX4Cx
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Local\UtAvIgPqi
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\ProgramData\kMtQaOTz
2013-10-23 06:13 - 2013-10-23 06:19 - 00000000 ____D C:\Users\Elfi\Desktop\Neuer Ordner
2013-10-08 09:04 - 2013-10-08 09:04 - 00000241 _____ C:\Windows\wininit.ini
==================== One Month Modified Files and Folders =======
2013-10-28 02:06 - 2011-06-03 07:46 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\vlc
2013-10-28 02:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-10-28 02:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-10-28 01:34 - 2013-10-28 01:34 - 00000000 ____D C:\FRST
2013-10-27 20:18 - 2013-10-27 20:18 - 01956376 _____ (Farbar) C:\Users\Elfi\Downloads\FRST64.exe
2013-10-27 20:18 - 2010-11-02 02:32 - 00656528 _____ C:\Windows\system32\perfh007.dat
2013-10-27 20:18 - 2010-11-02 02:32 - 00131268 _____ C:\Windows\system32\perfc007.dat
2013-10-27 20:18 - 2009-07-14 06:13 - 01505216 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-27 20:17 - 2009-07-14 05:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-27 20:17 - 2009-07-14 05:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-27 20:15 - 2013-10-27 20:14 - 01033335 _____ (Thisisu) C:\Users\Elfi\Downloads\JRT (1).exe
2013-10-27 20:11 - 2011-09-24 20:58 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\.oit
2013-10-27 20:10 - 2012-04-17 16:28 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-27 20:10 - 2012-04-17 16:28 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-27 20:09 - 2013-10-27 17:14 - 00010564 _____ C:\Windows\PFRO.log
2013-10-27 20:09 - 2013-10-27 17:14 - 00000168 _____ C:\Windows\setupact.log
2013-10-27 20:09 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-27 20:05 - 2013-10-27 20:05 - 00000000 ____D C:\Windows\ERUNT
2013-10-27 20:05 - 2012-04-17 16:28 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-27 20:05 - 2012-04-17 16:28 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-27 20:02 - 2012-07-18 06:49 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-27 20:01 - 2013-10-27 20:01 - 00004409 _____ C:\Users\Elfi\Desktop\AdwCleaner[S0].txt
2013-10-27 19:57 - 2013-10-27 19:53 - 00000000 ____D C:\AdwCleaner
2013-10-27 19:57 - 2012-07-11 17:16 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\CheckPoint
2013-10-27 19:54 - 2013-10-27 19:54 - 01033335 _____ (Thisisu) C:\Users\Elfi\Downloads\JRT.exe
2013-10-27 19:53 - 2013-10-27 19:52 - 01060070 _____ C:\Users\Elfi\Downloads\adwcleaner (1).exe
2013-10-27 19:52 - 2013-10-27 19:52 - 01060070 _____ C:\Users\Elfi\Downloads\adwcleaner.exe
2013-10-27 17:25 - 2013-10-27 17:24 - 00004549 _____ C:\Windows\WindowsUpdate.log
2013-10-27 17:24 - 2013-10-27 17:24 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-10-27 17:24 - 2012-07-12 20:18 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-27 17:24 - 2011-06-03 07:09 - 00001912 _____ C:\Windows\epplauncher.mif
2013-10-27 17:24 - 2011-04-28 11:36 - 01527738 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-27 17:14 - 2013-10-27 17:14 - 00000000 _____ C:\Windows\setuperr.log
2013-10-27 17:14 - 2012-07-11 17:16 - 00000000 ____D C:\Program Files\CheckPoint
2013-10-27 17:12 - 2012-07-11 17:14 - 00000000 ____D C:\ProgramData\CheckPoint
2013-10-27 17:07 - 2012-07-14 19:39 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-10-27 16:21 - 2013-10-27 16:21 - 00003408 ____N C:\bootsqm.dat
2013-10-27 16:20 - 2011-04-28 09:10 - 00000000 ____D C:\Users\Elfi
2013-10-27 16:11 - 2011-04-28 11:30 - 00000000 ____D C:\ProgramData\PC Suite
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Roaming\GlOrX4Cx
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Local\UtAvIgPqi
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\ProgramData\kMtQaOTz
2013-10-23 06:19 - 2013-10-23 06:13 - 00000000 ____D C:\Users\Elfi\Desktop\Neuer Ordner
2013-10-18 08:06 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-10 13:02 - 2012-07-18 06:49 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-10 13:02 - 2012-03-29 20:24 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-10 13:02 - 2011-06-10 21:40 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-08 09:04 - 2013-10-08 09:04 - 00000241 _____ C:\Windows\wininit.ini
2013-10-08 08:57 - 2011-04-28 09:11 - 00000000 ___RD C:\Users\Elfi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-08 08:47 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Xqtrfltzfvn
2013-10-08 08:47 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Vjjhjw
2013-10-08 08:46 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Mlllcaxmrfb
2013-10-08 08:46 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Gqpnvqgr
2013-10-08 08:46 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Dfiklyaxp
2013-10-04 12:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
Some content of TEMP:
====================
C:\Users\Elfi\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-21 20:21
==================== End Of Log ============================
--- --- --- ADDITION: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-10-2013
Ran by Elfi at 2013-10-27 20:19:24
Running from C:\Users\Elfi\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Microsoft Security Essentials (Disabled - Up to date) {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Disabled - Up to date) {2C040BB5-2B06-7275-5A21-2B969A740B4B}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (x32)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Photoshop Elements 8.0 (x32 Version: 8.0)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Alcor Micro USB Card Reader (x32 Version: 1.9.17.06019)
Anno 1701 (x32 Version: 1.02)
Ashampoo Burning Studio 10.0.1 (x32 Version: 10.0.1)
ATI Catalyst Install Manager (Version: 3.0.758.0)
Audials (x32 Version: 9.1.13600.0)
Backup Manager Basic (x32 Version: 2.0.0.68)
Broadcom Gigabit NetLink Controller (Version: 14.2.4.2)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Full New (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Light (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0122.858.16002)
Catalyst Control Center InstallProxy (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Localization All (x32 Version: 2010.0122.858.16002)
CCC Help Chinese Standard (x32 Version: 2010.0122.0857.16002)
CCC Help Chinese Traditional (x32 Version: 2010.0122.0857.16002)
CCC Help Czech (x32 Version: 2010.0122.0857.16002)
CCC Help Danish (x32 Version: 2010.0122.0857.16002)
CCC Help Dutch (x32 Version: 2010.0122.0857.16002)
CCC Help English (x32 Version: 2010.0122.0857.16002)
CCC Help Finnish (x32 Version: 2010.0122.0857.16002)
CCC Help French (x32 Version: 2010.0122.0857.16002)
CCC Help German (x32 Version: 2010.0122.0857.16002)
CCC Help Greek (x32 Version: 2010.0122.0857.16002)
CCC Help Hungarian (x32 Version: 2010.0122.0857.16002)
CCC Help Italian (x32 Version: 2010.0122.0857.16002)
CCC Help Japanese (x32 Version: 2010.0122.0857.16002)
CCC Help Korean (x32 Version: 2010.0122.0857.16002)
CCC Help Norwegian (x32 Version: 2010.0122.0857.16002)
CCC Help Polish (x32 Version: 2010.0122.0857.16002)
CCC Help Portuguese (x32 Version: 2010.0122.0857.16002)
CCC Help Russian (x32 Version: 2010.0122.0857.16002)
CCC Help Spanish (x32 Version: 2010.0122.0857.16002)
CCC Help Swedish (x32 Version: 2010.0122.0857.16002)
CCC Help Thai (x32 Version: 2010.0122.0857.16002)
CCC Help Turkish (x32 Version: 2010.0122.0857.16002)
ccc-core-static (x32 Version: 2010.0122.858.16002)
ccc-utility64 (Version: 2010.0122.858.16002)
CCleaner (Version: 3.20)
CloneCD (x32)
Druckerdeinstallation für EPSON BX525WD Series
ElsterFormular (x32 Version: 14.1.20130301)
EPSON BX525WD Series Handbuch (x32)
EPSON BX525WD Series Netzwerk-Handbuch (x32)
Epson Easy Photo Print 2 (x32 Version: 2.2.3.0)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000)
Epson Event Manager (x32 Version: 2.40.0001)
EPSON Scan (x32)
EpsonNet Setup 3.3 (x32 Version: 3.3a)
Far Cry 2 (x32 Version: 1.03.00)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
Guitar Explorer 1.0 (x32)
Identity Card (x32 Version: 1.00.3003)
ImagXpress (x32 Version: 7.0.74.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Rapid Storage Technology (x32 Version: 9.6.0.1014)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.00.01.1002)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
JNLP (HKCU)
Launch Manager (x32 Version: 4.0.14)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Media Player Codec Pack 4.1.9 (x32 Version: 4.1.9)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Security Client (Version: 4.0.1526.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 4.0.1526.0)
Microsoft Silverlight (x32 Version: 4.1.10329.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Mobile Partner (x32 Version: 16.001.06.01.500)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
neroxml (x32 Version: 1.0.0)
Nokia Connectivity Cable Driver (x32 Version: 7.1.69.0)
Nokia PC Suite (x32 Version: 7.1.180.46)
Opera 12.12 (x32 Version: 12.12.1707)
Packard Bell InfoCentre (x32 Version: 3.02.3000)
Packard Bell MyBackup (x32 Version: 2.0.0.68)
Packard Bell Power Management (x32 Version: 5.00.3005)
Packard Bell Recovery Management (x32 Version: 4.05.3013)
Packard Bell Updater (x32 Version: 1.02.3001)
PC Connectivity Solution (x32 Version: 11.5.22.0)
Presto! PageManager 9.00.11 SE (x32 Version: 9.00.11)
PunkBuster Services (x32 Version: 0.986)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6167)
Samsung Kies (x32 Version: 2.6.0.13091_9)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.27.0)
Skype™ 4.1 (x32 Version: 4.1.179)
Spybot - Search & Destroy (x32 Version: 1.6.2)
Synaptics Pointing Device Driver (Version: 14.0.6.0)
TeamViewer 6 (x32 Version: 6.0.10511)
TomTom HOME (x32 Version: 2.9.4)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2)
Überwachungstool für die Intel® Turbo-Boost-Technik (Version: 1.0.186.6)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687267) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Video Web Camera (x32 Version: 1.7.139.715)
VLC media player 1.1.9 (x32 Version: 1.1.9)
Welcome Center (x32 Version: 1.02.3004)
Windows-Treiberpaket - Nokia Modem (02/25/2011 4.7) (Version: 02/25/2011 4.7)
Windows-Treiberpaket - Nokia Modem (02/25/2011 7.01.0.9) (Version: 02/25/2011 7.01.0.9)
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
==================== Restore Points =========================
27-10-2013 18:35:46 Windows-Sicherung
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {5859DEDE-CB9F-4285-BD0C-684B69D28B55} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-17] (Google Inc.)
Task: {6C2139B1-14A3-48F7-AA95-8E3A35E04466} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-06-22] (Piriform Ltd)
Task: {72859296-50E6-47D2-B8FC-799B0C20F651} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {78885800-A5F2-4746-A80F-568DB5460C22} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {DEC044F2-B17C-44A8-A5C7-007BE32DAE84} - \DigitalSite No Task File
Task: {FC6B857A-18DA-40D2-A466-0EB74A5E2A0C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-17] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-01-07 14:42 - 2010-01-07 14:42 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-11-01 17:43 - 2010-11-01 17:43 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-06-28 23:20 - 2010-06-28 23:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\sqlite3.dll
2010-06-28 23:12 - 2010-06-28 23:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\ACE.dll
2011-09-24 20:54 - 2009-07-08 13:23 - 00057344 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PerformOcr.dll
2011-09-24 20:54 - 2009-12-04 16:21 - 00057344 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMISM.dll
2011-09-24 20:54 - 2009-11-20 12:20 - 00147456 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMCommon.dll
2011-09-24 20:54 - 2008-08-25 16:19 - 00069632 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PHooKDlg.dll
2011-09-24 20:54 - 2007-03-30 09:24 - 00104528 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\Qem.dll
2011-09-24 20:54 - 2009-12-08 09:51 - 00151552 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\ScanModule.dll
2011-09-24 20:54 - 2009-09-02 08:25 - 00098304 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\CategoryManager.dll
2011-09-24 20:54 - 2009-11-27 16:50 - 00135168 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSet.dll
2011-09-24 20:54 - 2009-12-18 18:10 - 00086016 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSave.dll
2011-09-24 20:54 - 2009-10-16 14:04 - 00614400 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMDB_N.dll
2011-09-24 20:54 - 2009-08-06 09:22 - 00421888 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\FT.dll
2011-09-24 20:54 - 2009-12-18 15:12 - 00061440 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMINSO.dll
2011-09-24 20:54 - 2009-09-09 13:44 - 00151552 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMANO.dll
2011-09-24 20:54 - 2007-03-30 08:49 - 00104528 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\ComClass.dll
2011-09-24 20:54 - 2007-12-20 13:37 - 00176128 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\DocCate.dll
2011-09-24 20:54 - 2009-12-07 12:55 - 00253952 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMScnSet.dll
2011-09-24 20:54 - 2009-11-26 16:49 - 00081920 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\NetFun2k.dll
2011-12-16 10:05 - 2011-12-16 10:05 - 02302008 _____ () D:\Programme2\Nokia PC Suite 7\QtCore4.dll
2011-12-16 10:05 - 2011-12-16 10:05 - 08197176 _____ () D:\Programme2\Nokia PC Suite 7\QtGui4.dll
2011-12-16 10:05 - 2011-12-16 10:05 - 00345656 _____ () D:\Programme2\Nokia PC Suite 7\QtXml4.dll
2011-12-16 10:05 - 2011-12-16 10:05 - 00202296 _____ () D:\Programme2\Nokia PC Suite 7\imageformats\qjpeg4.dll
2011-12-16 10:05 - 2011-12-16 10:05 - 00027704 _____ () D:\Programme2\Nokia PC Suite 7\imageformats\qsvg4.dll
2011-12-16 10:05 - 2011-12-16 10:05 - 00282168 _____ () D:\Programme2\Nokia PC Suite 7\QtSvg4.dll
2010-11-02 02:22 - 2009-05-20 23:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll
2011-09-24 20:54 - 2008-11-17 13:56 - 00102400 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\nsSign.dll
2011-09-24 20:54 - 2009-12-07 10:07 - 00352256 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMTree.dll
2011-09-24 20:54 - 2008-12-12 15:52 - 00106496 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMProp.dll
2011-09-24 20:54 - 2007-08-31 16:51 - 00040960 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMVoice.dll
2011-09-24 20:54 - 2008-12-12 16:00 - 00073728 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\OutlookVBA.dll
2011-09-24 20:54 - 2009-11-27 16:38 - 00331776 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMAppBar.dll
2011-09-24 20:54 - 2009-12-04 16:21 - 04567040 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMView.dll
2011-09-24 20:54 - 2007-03-30 09:01 - 00038992 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\NsOEMKey.dll
2011-09-24 20:54 - 2009-11-11 16:21 - 00450560 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMPageVW.dll
2011-09-24 20:54 - 2009-11-11 16:20 - 00098304 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMDocVW.dll
2011-09-24 20:54 - 2009-06-26 08:03 - 00086016 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMApSet.dll
2011-09-24 20:54 - 2009-11-20 10:30 - 01032192 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\SlideBarDLL.dll
2011-09-24 20:54 - 2009-12-04 16:20 - 00323584 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMAnoSet.dll
2011-09-24 20:54 - 2009-11-09 17:35 - 00184320 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMImgVW.dll
2011-09-24 20:54 - 2008-08-25 15:16 - 00040960 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMIEVW.dll
2011-09-24 20:54 - 2009-07-14 12:25 - 00040960 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMPDFView.dll
2011-09-24 20:54 - 2009-10-22 16:50 - 00065536 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMStatus.dll
2011-09-24 20:54 - 2007-03-30 08:57 - 00034896 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\Import.dll
2011-09-24 20:54 - 2008-04-24 09:46 - 00086016 _____ () C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMImageSplitter.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/27/2013 07:54:26 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.
System Error:
Falscher Parameter.
.
Error: (10/27/2013 07:54:26 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.
System Error:
Falscher Parameter.
.
Error: (10/27/2013 07:54:21 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.
System Error:
Falscher Parameter.
.
Error: (10/27/2013 07:35:46 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.
System Error:
Falscher Parameter.
.
Error: (10/27/2013 07:35:46 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.
System Error:
Falscher Parameter.
.
Error: (10/27/2013 05:15:18 PM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (10/27/2013 05:15:18 PM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (10/27/2013 05:15:18 PM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (10/27/2013 05:15:18 PM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Error: (10/27/2013 05:15:18 PM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
System errors:
=============
Error: (10/27/2013 08:09:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SBSD Security Center Service" ist von folgendem Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.
Error: (10/27/2013 08:09:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" ist vom Dienst "Basisfiltermodul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%5
Error: (10/27/2013 08:09:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Basisfiltermodul" wurde mit folgendem Fehler beendet:
%%5
Error: (10/27/2013 07:59:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SBSD Security Center Service" ist von folgendem Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert.
Error: (10/27/2013 07:59:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" ist vom Dienst "Basisfiltermodul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%5
Error: (10/27/2013 07:59:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Basisfiltermodul" wurde mit folgendem Fehler beendet:
%%5
Error: (10/27/2013 07:38:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" ist vom Dienst "Basisfiltermodul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%5
Error: (10/27/2013 07:38:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Basisfiltermodul" wurde mit folgendem Fehler beendet:
%%5
Error: (10/27/2013 07:36:49 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" ist vom Dienst "Basisfiltermodul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%5
Error: (10/27/2013 07:36:49 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Basisfiltermodul" wurde mit folgendem Fehler beendet:
%%5
Microsoft Office Sessions:
=========================
Error: (07/16/2012 07:11:13 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 13 seconds with 0 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2013-10-27 17:04:53.927
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-27 11:34:15.665
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-27 11:02:46.145
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-27 10:12:38.507
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-27 09:00:49.427
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-27 08:55:16.410
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-26 20:42:53.846
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-26 20:20:41.493
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-26 19:39:44.514
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-10-26 19:04:28.773
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 40%
Total physical RAM: 3956.5 MB
Available physical RAM: 2359.9 MB
Total Pagefile: 7911.14 MB
Available Pagefile: 5987.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Packard Bell) (Fixed) (Total:52.61 GB) (Free:4.53 GB) NTFS
Drive d: (Lokaler Datenträger) (Fixed) (Total:400.36 GB) (Free:169.67 GB) NTFS
Drive f: () (Removable) (Total:14.9 GB) (Free:14.84 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: EBD8EBD8)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=53 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=400 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 002C966D)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)
==================== End Of Log ============================
Hoffe der rest hilft. DANK DANK echt super geholfen |
|
28.10.2013, 10:45
| #6 |
| /// the machine /// TB-Ausbilder | Bka interpol trojanerESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Bka interpol trojaner |
|
28.10.2013, 19:37
| #7 |
| | Bka interpol trojaner ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ec0f09a37e8d1c4aa2494eae3dfb95e7
# engine=15664
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-28 05:45:06
# local_time=2013-10-28 06:45:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=5892 16777213 88 94 94857 50713254 0 0
# scanned=203454
# found=25
# cleaned=0
# scan_time=8147
sh=FE77CC58F9EE07C5B230E4959EFC878E977684D7 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\agoir.bat"
sh=28EB3267C784FA3B5CD802A4CBBE97D44E2E968A ft=1 fh=a03b0792ddabd0d4 vn="Win64/Sirefef.AI trojan" ac=I fn="C:\FRST\Quarantine\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\00000004.@"
sh=CDDC67ED60EA87D84B23050CC722FC7829C1D7EA ft=1 fh=07c9eb5dcd6e4a95 vn="Win64/Sirefef.AI trojan" ac=I fn="C:\FRST\Quarantine\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\U\000000cb.@"
sh=75B409EA6BA538FEE587C97B238DCA93B3BD0359 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Elfi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\208b456-16bac559"
sh=A0E3B88FA210515B54FA9E1E23B4E23482E7AD87 ft=0 fh=0000000000000000 vn="Java/Agent.EI trojan" ac=I fn="C:\Users\Elfi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\1af16d9c-6be3eba7"
sh=94B8BD8BBA2AE98B13E9D7472B12EDAF2ADC80D1 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.AT trojan" ac=I fn="C:\Users\Elfi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\9072563-784565d2"
sh=7C59C6766944284532618AAA262F6107C73E9E33 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Elfi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\70ccc47a-5417fb86"
sh=74F75DB8B4E04554EC4E2CDFF3F3F3A05CA9D054 ft=1 fh=693517a3acd48c6b vn="multiple threats" ac=I fn="D:\Wallpapers\46837.exe"
sh=C200A213BCFE41376F22D417D9364A24130DF08D ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2012-07-02 151501\Backup Files 2012-07-02 151501\Backup files 2.zip"
sh=9EB0C1923669972149C8E17CB4853DCCB5F884B4 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2012-07-16 074636\Backup Files 2012-07-16 074636\Backup files 2.zip"
sh=0334E30D3FD68E179AB59AFB1053D2F2D7651181 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2012-11-05 084801\Backup Files 2012-11-05 084801\Backup files 2.zip"
sh=DA153BE9527500F572D76099DA921A6A17062DCE ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-03-17 190001\Backup Files 2013-03-17 190001\Backup files 2.zip"
sh=69360885B624917CCE4222DFE5A2B7A9E3C02A9B ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-03-17 190001\Backup Files 2013-03-17 190001\Backup files 3.zip"
sh=BE55212506E4288E839B410DD9A7B8BCE076937E ft=0 fh=0000000000000000 vn="a variant of Win32/Kryptik.AZUR trojan" ac=I fn="D:\WONDERLAND\Backup Set 2013-03-17 190001\Backup Files 2013-04-28 213907\Backup files 1.zip"
sh=0A3045C817F84C4F1F955D9C79269915E101DE25 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-03-17 190001\Backup Files 2013-05-12 195946\Backup files 1.zip"
sh=1ADAFEA3EB4A85FEEF6EA977D930F4918BC96384 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-03-17 190001\Backup Files 2013-05-20 220100\Backup files 1.zip"
sh=08B44C6FB06B3950BC71F80B4D70E8E46A9FB294 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-03-17 190001\Backup Files 2013-05-27 115651\Backup files 1.zip"
sh=F6CCD7231BFDB26BAAAE5C7CDF8F5287798F28D0 ft=0 fh=0000000000000000 vn="a variant of Win32/Kryptik.BBXR trojan" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-06-10 061118\Backup files 1.zip"
sh=E1B27EA72445841BD8F099C1621913806927865D ft=0 fh=0000000000000000 vn="a variant of Win32/Kryptik.BBXR trojan" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-06-10 061118\Backup files 2.zip"
sh=F47C7D61E46E51F64DE441F4F5594F901A85C4C6 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-06-10 061118\Backup files 5.zip"
sh=81F75A0E3B9369637BDF1CFC12F65AD960796C1E ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2013-1493.FY trojan" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-08-03 170042\Backup files 1.zip"
sh=DAAD2D6D512039502FB5036DC75D3B0A47FABE8A ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-08-12 132445\Backup files 1.zip"
sh=F8D9D6E89E650FFFB45A789711C3225C89FB67E8 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-08-18 201404\Backup files 1.zip"
sh=9E51A706718A17066FA4B06DDE9FD37AD077D573 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-09-15 190001\Backup files 1.zip"
sh=1230615BF3E1C6FB03AEBBE40C03C47C33324B88 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="D:\WONDERLAND\Backup Set 2013-06-10 061118\Backup Files 2013-10-20 193310\Backup files 1.zip"
SecurityCheck: Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows 7 x64 (UAC is enabled) Out of date service pack!! Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! Microsoft Security Essentials (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 25 Java version out of Date! Adobe Flash Player 11.9.900.117 Adobe Reader 10.1.7 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-10-2013
Ran by Elfi (administrator) on WONDERLAND on 28-10-2013 19:36:21
Running from C:\Users\Elfi\Desktop
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Acer Group) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(NewSoft Technology Corporation) C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(NewSoft Technology Corporation) C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\Pmsb.exe
(Nokia) D:\Programme2\Nokia PC Suite 7\PCSuite.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Chicony) C:\Program Files (x86)\Video Web Camera\traybar.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(NewSoft Technology Corporation) C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSpeed.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-06-10] (Alcor Micro Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-29] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [206208 2010-06-10] ()
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM\...\Run: [WrtMon.exe] - C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe [26448 2008-05-24] (NewSoft Technology Corporation)
HKLM\...\Run: [ISW] - [x]
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1271168 2012-03-26] (Microsoft Corporation)
HKCU\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKCU\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKCU\...\Run: [Scan Buttons] - C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\Pmsb.exe [202576 2009-12-09] (NewSoft Technology Corporation)
HKCU\...\Run: [EPSON BX525WD Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGAU.EXE /FU "C:\Windows\TEMP\E_SACF1.tmp" /EF "HKCU"
HKCU\...\Run: [PC Suite Tray] - D:\Programme2\Nokia PC Suite 7\PCSuite.exe [1508408 2011-12-16] (Nokia)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564528 2013-09-04] (Samsung)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-02-12] (TomTom)
HKCU\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-09-04] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKCU\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\n. ATTENTION! ====> ZeroAccess?
HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION!
MountPoints2: {1303922f-7275-11e0-a406-70f1a1f79664} - F:\AutoRun.exe
MountPoints2: {1df21799-719d-11e0-bfb1-70f1a1f79664} - E:\AutoRun.exe
MountPoints2: {1df217c0-719d-11e0-bfb1-70f1a1f79664} - F:\AutoRun.exe
MountPoints2: {5d9ee513-95d2-11e0-a472-70f1a1f79664} - F:\AutoRun.exe
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe [263936 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-11] (Dritek System Inc.)
HKLM-x32\...\Run: [Camera Assistant Software] - C:\Program Files (x86)\Video Web Camera\traybar.exe [600688 2010-07-15] (Chicony)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CloneCDTray] - C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PMSpeed] - C:\Program Files (x86)\NewSoft\Presto! PageManager 9 for EP\PMSpeed.exe [112464 2009-12-04] (NewSoft Technology Corporation)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe /default
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe /default
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {E23EFB82-491D-4243-873D-642FDEDA979A} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=CC0D8507-0589-4F81-989A-CA8644C829D5&apn_sauid=7F2F8CAD-6903-4850-9816-069F6CB486D3&
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab
DPF: HKLM-x32 {1C11B948-582A-433F-A98D-A8C4D5CC64F2} hxxp://www.kps-virtualplanner.de/kpsvp/Core/Player/2020PlayerAX_Win32.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Winsock: Catalog5 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 02 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog5-x64 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 02 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Tcpip\Parameters: [DhcpNameServer] 83.169.186.161 83.169.186.225
Tcpip\..\Interfaces\{26CC559B-4BA6-48F2-B060-E64B6AE99056}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{CD5344C1-61DC-41E7-AB58-F39D5F4448CA}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{F5B711C0-3AA2-447E-9ED5-B3219C4F4774}: [NameServer]193.189.244.225 193.189.244.206
Chrome:
=======
CHR HomePage: "homepage": "hxxp://www.google.com/",
CHR RestoreOnStartup: "hxxp://www.google.com/"
==================== Services (Whitelisted) =================
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [868896 2010-06-11] (Acer Incorporated)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [12600 2012-03-26] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [291696 2012-03-26] (Microsoft Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [255744 2010-06-28] (NewTech Infosystems, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2012-07-17] ()
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group)
==================== Drivers (Whitelisted) ====================
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWow64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [243200 2010-03-31] (Huawei Technologies Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-03-20] ()
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2010-03-31] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [203888 2012-03-20] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [98688 2012-03-20] (Microsoft Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-03-20] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2012-03-20] (RapidSolution Software AG)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-28 19:36 - 2013-10-28 19:36 - 01956538 _____ (Farbar) C:\Users\Elfi\Desktop\FRST64.exe
2013-10-28 18:59 - 2013-10-28 18:59 - 00891167 _____ C:\Users\Elfi\Desktop\SecurityCheck.exe
2013-10-28 16:22 - 2013-10-28 16:22 - 00000000 ____D C:\ProgramData\boost_interprocess
2013-10-28 01:34 - 2013-10-28 01:34 - 00000000 ____D C:\FRST
2013-10-27 20:19 - 2013-10-27 20:20 - 00023518 _____ C:\Users\Elfi\Downloads\FRST.txt
2013-10-27 20:19 - 2013-10-27 20:19 - 00026754 _____ C:\Users\Elfi\Downloads\Addition.txt
2013-10-27 20:18 - 2013-10-27 20:18 - 01956376 _____ (Farbar) C:\Users\Elfi\Downloads\FRST64.exe
2013-10-27 20:05 - 2013-10-27 20:05 - 00000000 ____D C:\Windows\ERUNT
2013-10-27 19:54 - 2013-10-27 19:54 - 01033335 _____ (Thisisu) C:\Users\Elfi\Downloads\JRT.exe
2013-10-27 19:53 - 2013-10-27 19:57 - 00000000 ____D C:\AdwCleaner
2013-10-27 19:52 - 2013-10-27 19:52 - 01060070 _____ C:\Users\Elfi\Downloads\adwcleaner.exe
2013-10-27 17:24 - 2013-10-27 17:25 - 00004549 _____ C:\Windows\WindowsUpdate.log
2013-10-27 17:24 - 2013-10-27 17:24 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-10-27 17:14 - 2013-10-28 16:40 - 00000336 _____ C:\Windows\setupact.log
2013-10-27 17:14 - 2013-10-27 20:09 - 00010564 _____ C:\Windows\PFRO.log
2013-10-27 17:14 - 2013-10-27 17:14 - 00000000 _____ C:\Windows\setuperr.log
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Roaming\GlOrX4Cx
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Local\UtAvIgPqi
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\ProgramData\kMtQaOTz
2013-10-23 06:13 - 2013-10-28 08:15 - 00000000 ____D C:\Users\Elfi\Desktop\Neuer Ordner
2013-10-08 09:04 - 2013-10-08 09:04 - 00000241 _____ C:\Windows\wininit.ini
==================== One Month Modified Files and Folders =======
2013-10-28 19:36 - 2013-10-28 19:36 - 01956538 _____ (Farbar) C:\Users\Elfi\Desktop\FRST64.exe
2013-10-28 19:10 - 2012-04-17 16:28 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-28 19:02 - 2012-07-18 06:49 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-28 18:59 - 2013-10-28 18:59 - 00891167 _____ C:\Users\Elfi\Desktop\SecurityCheck.exe
2013-10-28 16:40 - 2013-10-27 17:14 - 00000336 _____ C:\Windows\setupact.log
2013-10-28 16:28 - 2010-11-02 02:32 - 00656528 _____ C:\Windows\system32\perfh007.dat
2013-10-28 16:28 - 2010-11-02 02:32 - 00131268 _____ C:\Windows\system32\perfc007.dat
2013-10-28 16:28 - 2009-07-14 06:13 - 01505216 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-28 16:22 - 2013-10-28 16:22 - 00000000 ____D C:\ProgramData\boost_interprocess
2013-10-28 16:03 - 2009-07-14 05:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-28 16:03 - 2009-07-14 05:45 - 00017376 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-28 16:01 - 2011-09-24 20:58 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\.oit
2013-10-28 16:00 - 2012-04-17 16:28 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-28 15:55 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-28 08:15 - 2013-10-23 06:13 - 00000000 ____D C:\Users\Elfi\Desktop\Neuer Ordner
2013-10-28 02:06 - 2011-06-03 07:46 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\vlc
2013-10-28 02:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-10-28 02:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2013-10-28 01:34 - 2013-10-28 01:34 - 00000000 ____D C:\FRST
2013-10-27 20:20 - 2013-10-27 20:19 - 00023518 _____ C:\Users\Elfi\Downloads\FRST.txt
2013-10-27 20:19 - 2013-10-27 20:19 - 00026754 _____ C:\Users\Elfi\Downloads\Addition.txt
2013-10-27 20:18 - 2013-10-27 20:18 - 01956376 _____ (Farbar) C:\Users\Elfi\Downloads\FRST64.exe
2013-10-27 20:09 - 2013-10-27 17:14 - 00010564 _____ C:\Windows\PFRO.log
2013-10-27 20:05 - 2013-10-27 20:05 - 00000000 ____D C:\Windows\ERUNT
2013-10-27 20:05 - 2012-04-17 16:28 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-27 20:05 - 2012-04-17 16:28 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-27 19:57 - 2013-10-27 19:53 - 00000000 ____D C:\AdwCleaner
2013-10-27 19:57 - 2012-07-11 17:16 - 00000000 ____D C:\Users\Elfi\AppData\Roaming\CheckPoint
2013-10-27 19:54 - 2013-10-27 19:54 - 01033335 _____ (Thisisu) C:\Users\Elfi\Downloads\JRT.exe
2013-10-27 19:52 - 2013-10-27 19:52 - 01060070 _____ C:\Users\Elfi\Downloads\adwcleaner.exe
2013-10-27 17:25 - 2013-10-27 17:24 - 00004549 _____ C:\Windows\WindowsUpdate.log
2013-10-27 17:24 - 2013-10-27 17:24 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-10-27 17:24 - 2012-07-12 20:18 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-27 17:24 - 2011-06-03 07:09 - 00001912 _____ C:\Windows\epplauncher.mif
2013-10-27 17:24 - 2011-04-28 11:36 - 01527738 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-27 17:14 - 2013-10-27 17:14 - 00000000 _____ C:\Windows\setuperr.log
2013-10-27 17:14 - 2012-07-11 17:16 - 00000000 ____D C:\Program Files\CheckPoint
2013-10-27 17:12 - 2012-07-11 17:14 - 00000000 ____D C:\ProgramData\CheckPoint
2013-10-27 17:07 - 2012-07-14 19:39 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-10-27 16:20 - 2011-04-28 09:10 - 00000000 ____D C:\Users\Elfi
2013-10-27 16:11 - 2011-04-28 11:30 - 00000000 ____D C:\ProgramData\PC Suite
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Roaming\GlOrX4Cx
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\Users\Elfi\AppData\Local\UtAvIgPqi
2013-10-27 15:50 - 2013-10-27 15:50 - 00322560 _____ C:\ProgramData\kMtQaOTz
2013-10-18 08:06 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-10 13:02 - 2012-07-18 06:49 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-10 13:02 - 2012-03-29 20:24 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-10 13:02 - 2011-06-10 21:40 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-08 09:04 - 2013-10-08 09:04 - 00000241 _____ C:\Windows\wininit.ini
2013-10-08 08:57 - 2011-04-28 09:11 - 00000000 ___RD C:\Users\Elfi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-08 08:47 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Xqtrfltzfvn
2013-10-08 08:47 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Vjjhjw
2013-10-08 08:46 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Mlllcaxmrfb
2013-10-08 08:46 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Gqpnvqgr
2013-10-08 08:46 - 2013-05-24 19:14 - 00000000 ___HD C:\Users\Elfi\AppData\Roaming\Dfiklyaxp
2013-10-04 12:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
Some content of TEMP:
====================
C:\Users\Elfi\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-21 20:21
==================== End Of Log ============================
--- --- --- |
|
29.10.2013, 09:59
| #8 |
| /// the machine /// TB-Ausbilder | Bka interpol trojaner Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Java, Adobe und Windows updaten. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter D:\Wallpapers\46837.exe
HKCU\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Elfi\AppData\Local\{b8123e2b-c4d6-d19d-3a13-9a9ec0c57ece}\n. ATTENTION! ====> ZeroAccess?
HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION!
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Downloade dir bitte  Farbar Service Scanner
Poste bitte den Inhalt hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
