Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVU Trojaner Windows 7 32 bit (https://www.trojaner-board.de/136780-gvu-trojaner-windows-7-32-bit.html)

tpfkarb 17.06.2013 20:48
GVU Trojaner Windows 7 32 bit
 
Hallo zusammen,

habe mich eben erst angemeldet und schon ein wenig gelesen.......zuerst einmal bin ich sehr positiv überrascht....hier sind Könner am Werk:daumenhoc

Habe hier den Rechner meiner Schwester, den ich eigentlich neu aufsetzen könnte, aber ich brauche dringend erst ein paar Ordner gesichert(Onlinebanking, .pst usw.)
Habe nun die otl.txt erstellt:


Code:
OTL logfile created on: 6/17/2013 10:34:45 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 74.05 Mb Free Space | 74.05% Space Free | Partition Type: NTFS
Drive D: | 488.18 Gb Total Space | 433.99 Gb Free Space | 88.90% Space Free | Partition Type: NTFS
Drive E: | 488.28 Gb Total Space | 483.76 Gb Free Space | 99.08% Space Free | Partition Type: NTFS
Drive F: | 420.70 Gb Total Space | 411.01 Gb Free Space | 97.70% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto] --  -- (TuneUp.UtilitiesSvc)
SRV - [2013/06/11 15:49:27 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/21 08:48:10 | 000,699,680 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto] -- D:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 8.0 OnlineUpdate)
SRV - [2011/12/13 04:29:16 | 000,029,504 | ---- | M] (TuneUp Software) [Auto] -- D:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011/07/22 02:49:26 | 000,511,920 | ---- | M] (REINER SCT) [Auto] -- D:\Windows\System32\cjpcsc.exe -- (cjpcsc)
SRV - [2011/05/05 11:30:46 | 000,549,384 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto] -- D:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate)
SRV - [2011/04/16 20:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Auto] -- D:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe -- (NIS)
SRV - [2010/04/06 11:30:38 | 000,031,272 | ---- | M] () [On_Demand] -- D:\Windows\System32\AppleChargerSrv.exe -- (AppleChargerSrv)
SRV - [2010/01/18 22:31:26 | 000,072,304 | R--- | M] () [Auto] -- D:\Windows\System32\XSrvSetup.exe -- (JMB36X)
SRV - [2009/08/24 09:38:06 | 000,068,136 | ---- | M] () [Disabled] -- D:\Program Files\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2009/08/04 12:29:54 | 000,219,360 | ---- | M] (DeviceVM, Inc.) [Auto] -- D:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)
SRV - [2009/07/20 07:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- D:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (VGPU)
DRV - File not found [Kernel | On_Demand] --  -- (TuneUpUtilitiesDrv)
DRV - File not found [Kernel | On_Demand] --  -- (tsusbhub)
DRV - File not found [Kernel | On_Demand] --  -- (Synth3dVsc)
DRV - [2013/06/01 15:20:16 | 001,611,992 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/06/01 15:20:16 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVENG.SYS -- (NAVENG)
DRV - [2013/05/31 12:58:19 | 001,002,072 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2013/05/31 09:46:32 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130614.001\IDSvix86.sys -- (IDSVix86)
DRV - [2013/03/29 04:27:11 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2013/02/03 04:13:19 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand] -- D:\Windows\gdrv.sys -- (gdrv)
DRV - [2012/08/23 10:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2012/08/23 10:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2012/08/18 02:49:55 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/05/16 12:47:27 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011/04/20 21:37:49 | 000,299,640 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS -- (SymNetS)
DRV - [2011/03/30 23:00:09 | 000,516,216 | ---- | M] (Symantec Corporation) [File_System | On_Demand] -- D:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS -- (SRTSP)
DRV - [2011/03/30 23:00:09 | 000,050,168 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2011/03/29 06:08:08 | 000,028,144 | ---- | M] (REINER SCT) [Kernel | On_Demand] -- D:\Windows\System32\drivers\cjusb.sys -- (cjusb)
DRV - [2011/03/14 22:31:23 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | Boot] -- D:\Windows\System32\drivers\NIS\1207020.003\symefa.sys -- (SymEFA)
DRV - [2011/01/27 02:47:10 | 000,340,088 | ---- | M] (Symantec Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\NIS\1207020.003\symds.sys -- (SymDS)
DRV - [2011/01/27 01:07:05 | 000,136,312 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS -- (SymIRON)
DRV - [2011/01/09 13:02:01 | 000,281,760 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011/01/09 13:02:01 | 000,025,888 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/04/06 11:30:24 | 000,018,984 | ---- | M] () [Kernel | System] -- D:\Windows\System32\drivers\AppleCharger.sys -- (AppleCharger)
DRV - [2010/01/27 04:58:32 | 000,098,928 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- D:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2009/12/21 21:26:36 | 000,030,392 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- D:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)
DRV - [2009/11/20 07:15:18 | 000,137,728 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV - [2009/11/20 07:15:16 | 000,058,880 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)
DRV - [2009/09/30 21:22:08 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand] -- D:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2009/07/13 20:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009/07/13 18:09:17 | 004,194,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\system32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/06/17 12:56:32 | 000,028,560 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2009/06/17 12:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/06/17 12:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/06/17 12:55:18 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2009/05/04 21:00:28 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot] -- D:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV - [2007/05/31 02:38:16 | 000,014,949 | ---- | M] (franson.biz) [Kernel | System] -- D:\Windows\System32\drivers\bizVSerialNT.sys -- (bizVSerial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\franke_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\franke_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\franke_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\franke_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\franke_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0:  File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: D:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: D:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Users\franke\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Users\franke\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2013/03/28 15:32:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 [2013/06/17 15:01:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/01/30 12:00:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/01/30 12:00:03 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - D:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - D:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\franke_ON_D\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [BCU] D:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [JMB36X IDE Setup] D:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] D:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Sweetpacks Communicator] D:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKU\franke_ON_D..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Users\franke\AppData\Local\Temp\ofi3jZF.exe (Mozilla Foundation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} hxxp://games.bigfishgames.com/de_dinerdashfloontheg/online/ddfotg.1.0.0.33.cab (CPlayFirstddfotgControl Object)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: Microsoft XML Parser for Java file:///C:/Windows/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\franke_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\System32\cmd.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - D:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O27 - HKLM IFEO\eslite.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O27 - HKLM IFEO\hpcustpartic.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O27 - HKLM IFEO\photoproduct.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O27 - HKLM IFEO\uninst.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/06/12 14:31:41 | 002,706,432 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\mshtml.tlb
[2013/06/12 14:31:41 | 000,391,168 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll
[2013/06/12 14:26:35 | 000,690,688 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript.dll
[2013/06/12 14:26:33 | 002,877,440 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript9.dll
[2013/06/12 14:26:33 | 000,061,440 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\iesetup.dll
[2013/06/12 14:26:33 | 000,039,424 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jsproxy.dll
[2013/06/12 14:26:32 | 000,493,056 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msfeeds.dll
[2013/06/12 14:26:32 | 000,109,056 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\iesysprep.dll
[2013/06/12 14:26:32 | 000,071,680 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\RegisterIEPKEYs.exe
[2013/06/12 14:26:32 | 000,042,496 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ie4uinit.exe
[2013/06/12 14:26:32 | 000,033,280 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\iernonce.dll
[2013/06/12 10:26:42 | 001,505,280 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\d3d11.dll
[2013/06/12 10:26:28 | 000,024,576 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\cryptdlg.dll
[2013/06/12 10:26:25 | 000,492,544 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\win32spl.dll
[2013/06/12 10:26:24 | 000,903,168 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\certutil.exe
[2013/06/12 10:26:24 | 000,043,008 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\certenc.dll
[2013/06/12 10:20:11 | 003,968,872 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntkrnlpa.exe
[2013/06/12 10:20:11 | 003,913,576 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntoskrnl.exe
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/06/17 15:18:19 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2013/06/17 15:07:05 | 000,014,192 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/17 15:07:05 | 000,014,192 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/17 15:06:01 | 000,668,692 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2013/06/17 15:06:01 | 000,620,284 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2013/06/17 15:06:01 | 000,134,540 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2013/06/17 15:06:01 | 000,110,472 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2013/06/17 15:01:46 | 000,001,094 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/17 15:00:59 | 2614,517,760 | -HS- | M] () -- D:\hiberfil.sys
[2013/06/17 14:50:58 | 000,000,000 | -H-- | M] () -- D:\Windows\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2013/06/15 04:47:00 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/15 04:37:00 | 000,001,098 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/15 00:19:58 | 000,163,055 | ---- | M] () -- D:\Users\franke\AppData\Roaming\2433f433
[2013/06/15 00:19:58 | 000,163,048 | ---- | M] () -- D:\Users\franke\AppData\Local\2433f433
[2013/06/15 00:19:58 | 000,163,006 | ---- | M] () -- D:\ProgramData\2433f433
[2013/06/11 15:49:26 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 15:49:26 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/06/08 07:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll
[2013/06/08 07:13:19 | 002,706,432 | ---- | M] (Microsoft Corporation) -- D:\Windows\System32\mshtml.tlb
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/06/17 14:50:58 | 000,000,000 | -H-- | C] () -- D:\Windows\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2013/06/15 00:19:58 | 000,163,055 | ---- | C] () -- D:\Users\franke\AppData\Roaming\2433f433
[2013/06/15 00:19:58 | 000,163,048 | ---- | C] () -- D:\Users\franke\AppData\Local\2433f433
[2013/06/15 00:19:58 | 000,163,006 | ---- | C] () -- D:\ProgramData\2433f433
[2011/12/02 14:14:17 | 000,036,892 | ---- | C] () -- D:\Windows\System32\bassmod.dll
[2011/07/17 10:37:11 | 000,000,934 | ---- | C] () -- D:\Windows\wiso.ini
[2011/04/25 11:10:46 | 000,001,360 | ---- | C] () -- D:\Windows\hpwmdl20.dat.temp
[2011/04/25 09:49:27 | 000,080,896 | ---- | C] () -- D:\Windows\System32\RDVGHelper.exe
[2011/04/25 09:49:14 | 000,252,928 | ---- | C] () -- D:\Windows\System32\DShowRdpFilter.dll
[2011/04/25 09:48:34 | 000,066,048 | ---- | C] () -- D:\Windows\System32\PrintBrmUi.exe
[2011/03/19 10:42:20 | 000,006,550 | ---- | C] () -- D:\Windows\jautoexp.dat
[2011/01/18 14:08:55 | 000,001,940 | ---- | C] () -- D:\Users\franke\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/09 12:37:33 | 000,281,760 | ---- | C] () -- D:\Windows\System32\drivers\atksgt.sys
[2011/01/09 12:37:32 | 000,025,888 | ---- | C] () -- D:\Windows\System32\drivers\lirsgt.sys
[2010/11/12 16:07:52 | 000,000,573 | ---- | C] () -- D:\Windows\hbcikrnl.ini
[2010/11/12 16:07:38 | 000,167,936 | ---- | C] () -- D:\Windows\System32\SerialXP.dll
[2010/11/12 16:07:38 | 000,027,648 | ---- | C] () -- D:\Windows\System32\win32com.dll
[2010/11/10 16:52:05 | 000,007,641 | ---- | C] () -- D:\Users\franke\AppData\Local\resmon.resmoncfg
[2010/11/10 15:40:51 | 000,031,272 | ---- | C] () -- D:\Windows\System32\AppleChargerSrv.exe
[2010/11/10 15:40:51 | 000,018,984 | ---- | C] () -- D:\Windows\System32\drivers\AppleCharger.sys
[2010/11/10 15:39:31 | 000,072,304 | R--- | C] () -- D:\Windows\System32\XSrvSetup.exe
[2010/11/10 15:38:51 | 000,080,416 | ---- | C] () -- D:\Windows\System32\RtNicProp32.dll
[2010/11/10 15:32:07 | 000,000,010 | ---- | C] () -- D:\Windows\GSetup.ini
[2010/11/10 15:17:29 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin
[2010/11/10 15:17:29 | 000,000,000 | ---- | C] () -- D:\Windows\System32\atiicdxx.dat
[2009/09/30 06:05:48 | 000,290,816 | ---- | C] () -- D:\Windows\System32\nsldap32v60.dll
[2009/08/27 03:04:12 | 000,207,400 | R--- | C] () -- D:\Windows\GSetup.exe
[2009/07/14 04:47:43 | 000,668,692 | ---- | C] () -- D:\Windows\System32\perfh007.dat
[2009/07/14 04:47:43 | 000,295,922 | ---- | C] () -- D:\Windows\System32\perfi007.dat
[2009/07/14 04:47:43 | 000,134,540 | ---- | C] () -- D:\Windows\System32\perfc007.dat
[2009/07/14 04:47:43 | 000,038,104 | ---- | C] () -- D:\Windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,413,056 | ---- | C] () -- D:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,620,284 | ---- | C] () -- D:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- D:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,110,472 | ---- | C] () -- D:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- D:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- D:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- D:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- D:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\System32\mlang.dat
[2008/10/30 12:00:22 | 000,048,640 | ---- | C] () -- D:\Windows\System32\nsldapssl32v60.dll
[2008/10/30 11:59:24 | 000,025,088 | ---- | C] () -- D:\Windows\System32\nsldappr32v60.dll
[2004/12/14 11:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\System32\nsldapssl32v50.dll
[2004/12/14 11:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\System32\nsldappr32v50.dll
[2004/12/14 11:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\System32\nsldap32v50.dll
 
========== LOP Check ==========
 
[2011/10/08 08:42:38 | 000,000,000 | ---D | M] -- D:\ProgramData\Alawar
[2011/01/01 17:00:46 | 000,000,000 | ---D | M] -- D:\ProgramData\AlawarSouthpoint
[2011/07/16 18:02:56 | 000,000,000 | ---D | M] -- D:\ProgramData\aliasworlds
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2011/09/02 16:16:24 | 000,000,000 | ---D | M] -- D:\ProgramData\Big Fish Games
[2013/06/01 15:36:56 | 000,000,000 | ---D | M] -- D:\ProgramData\Buhl Data Service GmbH
[2011/03/26 17:25:47 | 000,000,000 | ---D | M] -- D:\ProgramData\CannyGames
[2011/09/18 13:44:35 | 000,000,000 | ---D | M] -- D:\ProgramData\Cateia Games
[2011/02/05 14:19:33 | 000,000,000 | ---D | M] -- D:\ProgramData\CrioGames
[2011/07/31 14:21:30 | 000,000,000 | ---D | M] -- D:\ProgramData\CropBusters
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2011/11/05 19:10:28 | 000,000,000 | ---D | M] -- D:\ProgramData\Desktop Gaming
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/09/14 17:31:30 | 000,000,000 | ---D | M] -- D:\ProgramData\Far Mills
[2010/11/21 14:48:36 | 000,000,000 | ---D | M] -- D:\ProgramData\Farm Fishes
[2011/02/26 13:19:50 | 000,000,000 | ---D | M] -- D:\ProgramData\FarmFrenzy_Rome
[2011/09/22 18:30:26 | 000,000,000 | ---D | M] -- D:\ProgramData\FarmFrenzy_Vikings
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2011/09/09 12:13:34 | 000,000,000 | ---D | M] -- D:\ProgramData\Fugazo
[2011/02/15 17:04:11 | 000,000,000 | ---D | M] -- D:\ProgramData\Funny Bear Studio
[2010/11/12 19:54:20 | 000,000,000 | ---D | M] -- D:\ProgramData\GameHouse
[2011/02/24 17:53:52 | 000,000,000 | ---D | M] -- D:\ProgramData\GamePlastic
[2011/09/08 17:28:44 | 000,000,000 | ---D | M] -- D:\ProgramData\Green Clover Games
[2011/12/11 14:19:22 | 000,000,000 | ---D | M] -- D:\ProgramData\Grey Alien Games
[2011/08/07 14:52:36 | 000,000,000 | ---D | M] -- D:\ProgramData\HipSoft
[2011/03/26 16:19:17 | 000,000,000 | ---D | M] -- D:\ProgramData\Kingdom
[2011/03/22 15:34:29 | 000,000,000 | ---D | M] -- D:\ProgramData\MumboJumbo
[2011/02/05 11:27:32 | 000,000,000 | ---D | M] -- D:\ProgramData\Nevosoft-Breeze
[2011/01/08 18:04:32 | 000,000,000 | ---D | M] -- D:\ProgramData\Oberon Media
[2011/03/11 17:28:51 | 000,000,000 | ---D | M] -- D:\ProgramData\Particles
[2011/09/18 15:06:38 | 000,000,000 | ---D | M] -- D:\ProgramData\PlayFirst
[2011/11/19 18:46:37 | 000,000,000 | ---D | M] -- D:\ProgramData\PlayfulAge
[2011/12/12 13:10:29 | 000,000,000 | ---D | M] -- D:\ProgramData\Playrix Entertainment
[2011/09/10 15:33:46 | 000,000,000 | ---D | M] -- D:\ProgramData\PopCap Games
[2010/11/12 16:07:38 | 000,000,000 | ---D | M] -- D:\ProgramData\REINER SCT
[2011/10/19 17:05:34 | 000,000,000 | ---D | M] -- D:\ProgramData\RescueFrenzy
[2011/07/30 12:48:02 | 000,000,000 | ---D | M] -- D:\ProgramData\rionix
[2010/12/07 16:46:24 | 000,000,000 | ---D | M] -- D:\ProgramData\Rumbic Studio
[2011/11/23 19:33:34 | 000,000,000 | ---D | M] -- D:\ProgramData\Solidshield
[2010/11/11 16:57:27 | 000,000,000 | ---D | M] -- D:\ProgramData\StarMoney 7.0
[2012/04/01 11:58:33 | 000,000,000 | ---D | M] -- D:\ProgramData\StarMoney 8.0
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2013/01/13 12:35:26 | 000,000,000 | ---D | M] -- D:\ProgramData\SweetIM
[2013/06/14 18:06:58 | 000,000,000 | ---D | M] -- D:\ProgramData\TEMP
[2011/01/09 11:42:13 | 000,000,000 | ---D | M] -- D:\ProgramData\TuneUp Software
[2011/10/19 07:50:55 | 000,000,000 | ---D | M] -- D:\ProgramData\VirtualFarm2
[2011/11/06 19:30:30 | 000,000,000 | ---D | M] -- D:\ProgramData\Visan
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2011/01/09 11:40:28 | 000,000,000 | -HSD | M] -- D:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2010/11/12 17:10:57 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/04/26 10:40:21 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:99AC3203
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:38FF076E
@Alternate Data Stream - 233 bytes -> D:\ProgramData\TEMP:DD95E6D9
@Alternate Data Stream - 218 bytes -> D:\ProgramData\TEMP:29C0641D
@Alternate Data Stream - 213 bytes -> D:\ProgramData\TEMP:6C049F97
@Alternate Data Stream - 212 bytes -> D:\ProgramData\TEMP:E5BA9ADD
@Alternate Data Stream - 199 bytes -> D:\ProgramData\TEMP:1A4BF204
@Alternate Data Stream - 190 bytes -> D:\ProgramData\TEMP:8247A199
@Alternate Data Stream - 18 bytes -> D:\Users\franke:zylomtr{00013KEU-UKQE-K6V0-2PHI-2B2UA19M6VV4}
@Alternate Data Stream - 16 bytes -> D:\Users\franke:zylomtr{000HQ7FF-AD7A-3FG2-LKCU-2AJQPJA4AVHE}
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:884C7316
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:2D3CB929
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:FD38E906
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:3B07E6F4
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:10873493
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:D882BE37
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:2ABB51D4
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:140AD176
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:E6B1AD87
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:8DD36B71
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:A5CD91DF
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:14D29229
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:7EABF26C
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:193CB03B
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:701B92FB
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:4B244549
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:C43C957E
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:160ADF0B
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:9CF728A6
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:6EA64886
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:03D08225
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:751D6870
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:07C99568
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:073139EC
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:F3591DDB
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:20EB6823
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:7425C891
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:5C0940F1
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:2E9900EE
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:0915A718
@Alternate Data Stream - 136 bytes -> D:\ProgramData\TEMP:92D91D7E
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:C3D26A8A
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:4149A170
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:00AA4B31
@Alternate Data Stream - 134 bytes -> D:\ProgramData\TEMP:EE7AAC75
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:E21433CE
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:B722BCE5
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:A01F3A87
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 130 bytes -> D:\ProgramData\TEMP:6423D635
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:D01ACC06
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:9D03192E
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:C946EBB2
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:BC1F7CAE
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:D576A536
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:16A4620C
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:9DB67071
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:2D1AE3BE
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:1B3549F2
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:CD6DF7CC
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:C3AD9507
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:56C66609
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:00811B66
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:F1F936DF
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:BD8010FE
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:063969F8
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:CFF6B3FF
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:9290C91C
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:A7B70C4E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:6C031E3E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:4A966CC2
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:2216A431
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:E99D1D3C
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:A1023D41
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:B285A50E
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:AE9351E0
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:149327FE
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:00258EE7
@Alternate Data Stream - 119 bytes -> D:\ProgramData\TEMP:104A718B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:46A2F27B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:2ADF9928
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:169E7AC5
@Alternate Data Stream - 104 bytes -> D:\ProgramData\TEMP:1A8BB29B
< End of report >
Vielen Dank im Voraus

Gruss tpfkarb

schrauber 17.06.2013 20:56

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
:OTL
O4 - HKU\franke_ON_D..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Users\franke\AppData\Local\Temp\ofi3jZF.exe (Mozilla Foundation)
O20 - HKU\franke_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\System32\cmd.exe (Microsoft Corporation)
[2013/06/15 00:19:58 | 000,163,055 | ---- | M] () -- D:\Users\franke\AppData\Roaming\2433f433
[2013/06/15 00:19:58 | 000,163,048 | ---- | M] () -- D:\Users\franke\AppData\Local\2433f433
[2013/06/15 00:19:58 | 000,163,006 | ---- | M] () -- D:\ProgramData\2433f433
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:99AC3203
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:38FF076E
@Alternate Data Stream - 233 bytes -> D:\ProgramData\TEMP:DD95E6D9
@Alternate Data Stream - 218 bytes -> D:\ProgramData\TEMP:29C0641D
@Alternate Data Stream - 213 bytes -> D:\ProgramData\TEMP:6C049F97
@Alternate Data Stream - 212 bytes -> D:\ProgramData\TEMP:E5BA9ADD
@Alternate Data Stream - 199 bytes -> D:\ProgramData\TEMP:1A4BF204
@Alternate Data Stream - 190 bytes -> D:\ProgramData\TEMP:8247A199
@Alternate Data Stream - 18 bytes -> D:\Users\franke:zylomtr{00013KEU-UKQE-K6V0-2PHI-2B2UA19M6VV4}
@Alternate Data Stream - 16 bytes -> D:\Users\franke:zylomtr{000HQ7FF-AD7A-3FG2-LKCU-2AJQPJA4AVHE}
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:884C7316
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:2D3CB929
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:FD38E906
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:3B07E6F4
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:10873493
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:D882BE37
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:2ABB51D4
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:140AD176
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:E6B1AD87
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:8DD36B71
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:A5CD91DF
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:14D29229
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:7EABF26C
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:193CB03B
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:701B92FB
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:4B244549
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:C43C957E
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:160ADF0B
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:9CF728A6
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:6EA64886
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:03D08225
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:751D6870
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:07C99568
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:073139EC
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:F3591DDB
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:20EB6823
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:7425C891
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:5C0940F1
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:2E9900EE
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:0915A718
@Alternate Data Stream - 136 bytes -> D:\ProgramData\TEMP:92D91D7E
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:C3D26A8A
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:4149A170
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:00AA4B31
@Alternate Data Stream - 134 bytes -> D:\ProgramData\TEMP:EE7AAC75
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:E21433CE
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:B722BCE5
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:A01F3A87
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 130 bytes -> D:\ProgramData\TEMP:6423D635
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:D01ACC06
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:9D03192E
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:C946EBB2
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:BC1F7CAE
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:D576A536
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:16A4620C
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:9DB67071
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:2D1AE3BE
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:1B3549F2
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:CD6DF7CC
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:C3AD9507
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:56C66609
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:00811B66
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:F1F936DF
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:BD8010FE
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:063969F8
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:CFF6B3FF
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:9290C91C
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:A7B70C4E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:6C031E3E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:4A966CC2
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:2216A431
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:E99D1D3C
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:A1023D41
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:B285A50E
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:AE9351E0
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:149327FE
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:00258EE7
@Alternate Data Stream - 119 bytes -> D:\ProgramData\TEMP:104A718B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:46A2F27B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:2ADF9928
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:169E7AC5
@Alternate Data Stream - 104 bytes -> D:\ProgramData\TEMP:1A8BB29B
:Commands
[emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


Rebooten, freuen ;)

tpfkarb 17.06.2013 21:31
Hallo Schrauber,

habe die Schritte so nachvollzogen, sah auch gut aus....aber nach dem Neustart immer noch der Sperrbildschirm.....hier das Ergebnis des Fix:

Code:
========== OTL ==========
Registry value HKEY_USERS\franke_ON_D\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx deleted successfully.
D:\Users\franke\AppData\Local\Temp\ofi3jZF.exe moved successfully.
Registry value HKEY_USERS\franke_ON_D\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:cmd.exe deleted successfully.
D:\Windows\System32\cmd.exe moved successfully.
D:\Users\franke\AppData\Roaming\2433f433 moved successfully.
D:\Users\franke\AppData\Local\2433f433 moved successfully.
D:\ProgramData\2433f433 moved successfully.
ADS D:\ProgramData\TEMP:99AC3203 deleted successfully.
ADS D:\ProgramData\TEMP:38FF076E deleted successfully.
ADS D:\ProgramData\TEMP:DD95E6D9 deleted successfully.
ADS D:\ProgramData\TEMP:29C0641D deleted successfully.
ADS D:\ProgramData\TEMP:6C049F97 deleted successfully.
ADS D:\ProgramData\TEMP:E5BA9ADD deleted successfully.
ADS D:\ProgramData\TEMP:1A4BF204 deleted successfully.
ADS D:\ProgramData\TEMP:8247A199 deleted successfully.
ADS D:\Users\franke:zylomtr{00013KEU-UKQE-K6V0-2PHI-2B2UA19M6VV4} deleted successfully.
ADS D:\Users\franke:zylomtr{000HQ7FF-AD7A-3FG2-LKCU-2AJQPJA4AVHE} deleted successfully.
ADS D:\ProgramData\TEMP:884C7316 deleted successfully.
ADS D:\ProgramData\TEMP:2D3CB929 deleted successfully.
ADS D:\ProgramData\TEMP:FD38E906 deleted successfully.
ADS D:\ProgramData\TEMP:3B07E6F4 deleted successfully.
ADS D:\ProgramData\TEMP:10873493 deleted successfully.
ADS D:\ProgramData\TEMP:D882BE37 deleted successfully.
ADS D:\ProgramData\TEMP:2ABB51D4 deleted successfully.
ADS D:\ProgramData\TEMP:140AD176 deleted successfully.
ADS D:\ProgramData\TEMP:E6B1AD87 deleted successfully.
ADS D:\ProgramData\TEMP:8DD36B71 deleted successfully.
ADS D:\ProgramData\TEMP:A5CD91DF deleted successfully.
ADS D:\ProgramData\TEMP:14D29229 deleted successfully.
ADS D:\ProgramData\TEMP:7EABF26C deleted successfully.
ADS D:\ProgramData\TEMP:193CB03B deleted successfully.
ADS D:\ProgramData\TEMP:701B92FB deleted successfully.
ADS D:\ProgramData\TEMP:4B244549 deleted successfully.
ADS D:\ProgramData\TEMP:C43C957E deleted successfully.
ADS D:\ProgramData\TEMP:160ADF0B deleted successfully.
ADS D:\ProgramData\TEMP:9CF728A6 deleted successfully.
ADS D:\ProgramData\TEMP:6EA64886 deleted successfully.
ADS D:\ProgramData\TEMP:03D08225 deleted successfully.
ADS D:\ProgramData\TEMP:751D6870 deleted successfully.
ADS D:\ProgramData\TEMP:07C99568 deleted successfully.
ADS D:\ProgramData\TEMP:073139EC deleted successfully.
ADS D:\ProgramData\TEMP:F3591DDB deleted successfully.
ADS D:\ProgramData\TEMP:20EB6823 deleted successfully.
ADS D:\ProgramData\TEMP:0988A428 deleted successfully.
ADS D:\ProgramData\TEMP:7425C891 deleted successfully.
ADS D:\ProgramData\TEMP:5C0940F1 deleted successfully.
ADS D:\ProgramData\TEMP:2E9900EE deleted successfully.
ADS D:\ProgramData\TEMP:0915A718 deleted successfully.
ADS D:\ProgramData\TEMP:92D91D7E deleted successfully.
ADS D:\ProgramData\TEMP:C3D26A8A deleted successfully.
ADS D:\ProgramData\TEMP:4149A170 deleted successfully.
ADS D:\ProgramData\TEMP:00AA4B31 deleted successfully.
ADS D:\ProgramData\TEMP:EE7AAC75 deleted successfully.
ADS D:\ProgramData\TEMP:E21433CE deleted successfully.
ADS D:\ProgramData\TEMP:B722BCE5 deleted successfully.
ADS D:\ProgramData\TEMP:A01F3A87 deleted successfully.
ADS D:\ProgramData\TEMP:93226FE3 deleted successfully.
ADS D:\ProgramData\TEMP:6423D635 deleted successfully.
ADS D:\ProgramData\TEMP:D01ACC06 deleted successfully.
ADS D:\ProgramData\TEMP:9D03192E deleted successfully.
ADS D:\ProgramData\TEMP:C946EBB2 deleted successfully.
ADS D:\ProgramData\TEMP:BC1F7CAE deleted successfully.
ADS D:\ProgramData\TEMP:D576A536 deleted successfully.
ADS D:\ProgramData\TEMP:16A4620C deleted successfully.
ADS D:\ProgramData\TEMP:9DB67071 deleted successfully.
ADS D:\ProgramData\TEMP:2D1AE3BE deleted successfully.
ADS D:\ProgramData\TEMP:1B3549F2 deleted successfully.
ADS D:\ProgramData\TEMP:CD6DF7CC deleted successfully.
ADS D:\ProgramData\TEMP:C3AD9507 deleted successfully.
ADS D:\ProgramData\TEMP:56C66609 deleted successfully.
ADS D:\ProgramData\TEMP:00811B66 deleted successfully.
ADS D:\ProgramData\TEMP:F1F936DF deleted successfully.
ADS D:\ProgramData\TEMP:BD8010FE deleted successfully.
ADS D:\ProgramData\TEMP:063969F8 deleted successfully.
ADS D:\ProgramData\TEMP:CFF6B3FF deleted successfully.
ADS D:\ProgramData\TEMP:9290C91C deleted successfully.
ADS D:\ProgramData\TEMP:A7B70C4E deleted successfully.
ADS D:\ProgramData\TEMP:6C031E3E deleted successfully.
ADS D:\ProgramData\TEMP:4A966CC2 deleted successfully.
ADS D:\ProgramData\TEMP:2216A431 deleted successfully.
ADS D:\ProgramData\TEMP:E99D1D3C deleted successfully.
ADS D:\ProgramData\TEMP:A1023D41 deleted successfully.
ADS D:\ProgramData\TEMP:B285A50E deleted successfully.
ADS D:\ProgramData\TEMP:AE9351E0 deleted successfully.
ADS D:\ProgramData\TEMP:149327FE deleted successfully.
ADS D:\ProgramData\TEMP:00258EE7 deleted successfully.
ADS D:\ProgramData\TEMP:104A718B deleted successfully.
ADS D:\ProgramData\TEMP:46A2F27B deleted successfully.
ADS D:\ProgramData\TEMP:2ADF9928 deleted successfully.
ADS D:\ProgramData\TEMP:169E7AC5 deleted successfully.
ADS D:\ProgramData\TEMP:1A8BB29B deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
 
User: franke
->Temp folder emptied: 180224405 bytes
->Temporary Internet Files folder emptied: 1387884072 bytes
->Java cache emptied: 28537355 bytes
->Google Chrome cache emptied: 388362472 bytes
->Flash cache emptied: 987008402 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17021487 bytes
 
Total Files Cleaned = 2,851.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 06172013_231312

schrauber 18.06.2013 06:50
What? du willst mich ärgern :)
[indent]
Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

tpfkarb 18.06.2013 07:19
Guten Morgen Schrauber,

werde ich heute nachmittag probieren....

Danke bis hierhin....

Gruss tpfkarb

schrauber 18.06.2013 12:12
alles klar :)

tpfkarb 18.06.2013 18:56
so hier nun der scan:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-06-2013 02
Ran by SYSTEM on 18-06-2013 21:49:45
Running from H:\
Windows 7 Ultimate (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe" [346320 2009-08-04] (DeviceVM, Inc.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: []  [x]
HKLM\...\Run: [Sweetpacks Communicator] C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe                                                                                                                                                                                                        [295728 2012-02-26] (SweetIM Technologies Ltd.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKU\franke\...\Winlogon: [Shell]
HKU\franke\...\Command Processor: "C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe" <===== ATTENTION!
IMEO\eslite.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\hpcustpartic.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\photoproduct.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\uninst.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S2 BCUService; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [219360 2009-08-04] (DeviceVM, Inc.)
S2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
S4 ES lite Service; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
S2 JMB36X; C:\Windows\System32\XSrvSetup.exe [72304 2010-01-19] ()
S2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll [262584 2011-04-01] (Symantec Corporation)
S2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [549384 2011-05-05] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 TuneUp.UtilitiesSvc; "D:\Program Files\TuneUpUtilitiesService32.exe" [x]

==================== Drivers (Whitelisted) ====================

S1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18984 2010-04-06] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-09] ()
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
S1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-10-01] (Avanquest Software)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-03-29] (Symantec Corporation)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-02-03] (Windows (R) 2000 DDK provider)
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130614.001\IDSvix86.sys [386720 2013-05-31] (Symantec Corporation)
S0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-09] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37392 2009-06-17] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVENG.SYS [93272 2013-06-01] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVEX15.SYS [1611992 2013-06-01] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2011-05-16] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 TuneUpUtilitiesDrv; \??\D:\Program Files\TuneUpUtilitiesDriver32.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:28 - 2013-06-18 03:35 - 00076068 ____A C:\OTL.Txt
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-12 19:31 - 2013-06-08 12:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 19:31 - 2013-06-08 12:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 19:26 - 2013-05-17 02:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 19:26 - 2013-05-17 02:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 19:26 - 2013-05-14 09:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 15:26 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 15:26 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 15:26 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 15:26 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 15:26 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 15:26 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 15:20 - 2013-05-06 06:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 15:20 - 2013-05-06 06:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 15:20 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 15:14 - 2013-05-08 06:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

==================== One Month Modified Files and Folders ========

2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 20:46 - 2011-09-02 20:51 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-18 20:46 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-18 20:46 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-18 20:46 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-18 20:45 - 2013-02-04 15:59 - 00012469 ____A C:\Windows\setupact.log
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:35 - 2013-06-18 03:28 - 00076068 ____A C:\OTL.Txt
2013-06-18 03:26 - 2010-11-10 20:29 - 00000000 ___AD C:\users\franke
2013-06-17 20:18 - 2010-11-10 20:22 - 01565583 ____A C:\Windows\WindowsUpdate.log
2013-06-17 20:06 - 2010-11-10 20:42 - 00005210 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-15 09:47 - 2012-07-19 21:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-15 09:37 - 2011-09-02 20:51 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-15 04:00 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 18:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-06-13 16:43 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-12 23:42 - 2011-07-17 15:37 - 00001188 ____A C:\Users\franke\AppData\Local\crc32list11.txt
2013-06-12 19:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-12 19:32 - 2010-11-11 19:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 19:27 - 2009-10-14 03:21 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 14:51 - 2012-04-01 16:56 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-06-11 20:49 - 2012-07-19 21:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 20:49 - 2011-09-25 17:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 12:42 - 2013-06-12 19:31 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 12:13 - 2013-06-12 19:31 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 17:36 - 2011-07-17 15:37 - 00000000 ____D C:\Users\franke\Documents\Mein Steuer-Sparbuch Heute
2013-06-01 20:36 - 2011-07-17 15:29 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-05-01 00:11:01
Restore point made on: 2013-05-11 20:28:11
Restore point made on: 2013-05-15 22:31:46
Restore point made on: 2013-06-02 12:15:44
Restore point made on: 2013-06-10 20:09:07
Restore point made on: 2013-06-12 19:26:12
Restore point made on: 2013-06-15 00:05:42

==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 4092.54 MB
Available physical RAM: 3554.83 MB
Total Pagefile: 4090.81 MB
Available Pagefile: 3547.88 MB
Total Virtual: 2047.88 MB
Available Virtual: 1918.17 MB

==================== Drives ================================

Drive c: (windows) (Fixed) (Total:488.18 GB) (Free:436.82 GB) NTFS
Drive e: (programme) (Fixed) (Total:488.28 GB) (Free:483.76 GB) NTFS
Drive f: (daten) (Fixed) (Total:420.7 GB) (Free:411.01 GB) NTFS
Drive g: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS
Drive h: (******) (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: FB48AFF2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=421 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-06-13 18:03

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 18.06.2013 19:01
Aber jetzt :)

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKU\franke\...\Winlogon: [Shell]
HKU\franke\...\Command Processor: "C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe" <===== ATTENTION!
C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

tpfkarb 18.06.2013 19:08
so hier der erneute scan...

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-06-2013 02
Ran by SYSTEM at 2013-06-18 22:06:40 Run:1
Running from H:\
Boot Mode: Recovery

==============================================

HKU\franke\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\franke\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe => File/Directory not found.

==== End of Fixlog ====

schrauber 19.06.2013 06:58
Kannst booten?

tpfkarb 19.06.2013 07:48
Guten Morgen
Da ich eure forenregeln sehr ernst nehme und du nichts von booten geschrieben hast. .......
Ich werde heute abend booten. ...:-)

schrauber 19.06.2013 08:22
LOL, ja nee booten darfste ruhig :)

tpfkarb 19.06.2013 19:07
Hallo schrauber,

booten ja......aber immer noch der Sperrbildschirm....

schrauber 19.06.2013 19:53
Dann darfste jetzt ein frisches FRST Scanlog aus der Recovery posten :)

tpfkarb 19.06.2013 20:31
So hoffe ist richtig


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-06-2013 02
Ran by SYSTEM on 20-06-2013 00:25:31
Running from H:\
Windows 7 Ultimate (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe" [346320 2009-08-04] (DeviceVM, Inc.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: []  [x]
HKLM\...\Run: [Sweetpacks Communicator] C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe                                                                                                                                                                                                        [295728 2012-02-26] (SweetIM Technologies Ltd.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
IMEO\eslite.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\hpcustpartic.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\photoproduct.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\uninst.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S2 BCUService; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [219360 2009-08-04] (DeviceVM, Inc.)
S2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
S4 ES lite Service; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
S2 JMB36X; C:\Windows\System32\XSrvSetup.exe [72304 2010-01-19] ()
S2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll [262584 2011-04-01] (Symantec Corporation)
S2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [549384 2011-05-05] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 TuneUp.UtilitiesSvc; "D:\Program Files\TuneUpUtilitiesService32.exe" [x]

==================== Drivers (Whitelisted) ====================

S1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18984 2010-04-06] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-09] ()
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
S1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-10-01] (Avanquest Software)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-03-29] (Symantec Corporation)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-02-03] (Windows (R) 2000 DDK provider)
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130614.001\IDSvix86.sys [386720 2013-05-31] (Symantec Corporation)
S0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-09] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37392 2009-06-17] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVENG.SYS [93272 2013-06-01] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVEX15.SYS [1611992 2013-06-01] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2011-05-16] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 TuneUpUtilitiesDrv; \??\D:\Program Files\TuneUpUtilitiesDriver32.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:28 - 2013-06-18 03:35 - 00076068 ____A C:\OTL.Txt
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-12 19:31 - 2013-06-08 12:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 19:31 - 2013-06-08 12:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 19:26 - 2013-05-17 02:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 19:26 - 2013-05-17 02:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 19:26 - 2013-05-14 09:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 15:26 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 15:26 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 15:26 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 15:26 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 15:26 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 15:26 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 15:20 - 2013-05-06 06:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 15:20 - 2013-05-06 06:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 15:20 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 15:14 - 2013-05-08 06:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

==================== One Month Modified Files and Folders ========

2013-06-19 22:13 - 2010-11-10 20:22 - 01571378 ____A C:\Windows\WindowsUpdate.log
2013-06-19 21:47 - 2012-07-19 21:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-19 21:37 - 2011-09-02 20:51 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-19 21:10 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-19 21:10 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-19 21:09 - 2010-11-10 20:42 - 00005210 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-19 21:05 - 2013-02-04 15:59 - 00012525 ____A C:\Windows\setupact.log
2013-06-19 21:05 - 2011-09-02 20:51 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-19 21:05 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:35 - 2013-06-18 03:28 - 00076068 ____A C:\OTL.Txt
2013-06-18 03:26 - 2010-11-10 20:29 - 00000000 ___AD C:\users\franke
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-15 04:00 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 18:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-06-13 16:43 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-12 23:42 - 2011-07-17 15:37 - 00001188 ____A C:\Users\franke\AppData\Local\crc32list11.txt
2013-06-12 19:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-12 19:32 - 2010-11-11 19:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 19:27 - 2009-10-14 03:21 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 14:51 - 2012-04-01 16:56 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-06-11 20:49 - 2012-07-19 21:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 20:49 - 2011-09-25 17:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 12:42 - 2013-06-12 19:31 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 12:13 - 2013-06-12 19:31 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 17:36 - 2011-07-17 15:37 - 00000000 ____D C:\Users\franke\Documents\Mein Steuer-Sparbuch Heute
2013-06-01 20:36 - 2011-07-17 15:29 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-05-01 00:11:01
Restore point made on: 2013-05-11 20:28:11
Restore point made on: 2013-05-15 22:31:46
Restore point made on: 2013-06-02 12:15:44
Restore point made on: 2013-06-10 20:09:07
Restore point made on: 2013-06-12 19:26:12
Restore point made on: 2013-06-15 00:05:42

==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 4092.54 MB
Available physical RAM: 3551.39 MB
Total Pagefile: 4090.81 MB
Available Pagefile: 3545.68 MB
Total Virtual: 2047.88 MB
Available Virtual: 1919.07 MB

==================== Drives ================================

Drive c: (windows) (Fixed) (Total:488.18 GB) (Free:436.38 GB) NTFS
Drive e: (programme) (Fixed) (Total:488.28 GB) (Free:483.76 GB) NTFS
Drive f: (daten) (Fixed) (Total:420.7 GB) (Free:411.01 GB) NTFS
Drive g: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS
Drive h: (GEHLEN) (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: FB48AFF2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=421 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-06-13 18:03

==================== End Of Log ============================
--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:22 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131