Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVU Trojaner Windows 7 32 bit (https://www.trojaner-board.de/136780-gvu-trojaner-windows-7-32-bit.html)

tpfkarb 17.06.2013 20:48
GVU Trojaner Windows 7 32 bit
 
Hallo zusammen,

habe mich eben erst angemeldet und schon ein wenig gelesen.......zuerst einmal bin ich sehr positiv überrascht....hier sind Könner am Werk:daumenhoc

Habe hier den Rechner meiner Schwester, den ich eigentlich neu aufsetzen könnte, aber ich brauche dringend erst ein paar Ordner gesichert(Onlinebanking, .pst usw.)
Habe nun die otl.txt erstellt:


Code:
OTL logfile created on: 6/17/2013 10:34:45 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files
Drive C: | 100.00 Mb Total Space | 74.05 Mb Free Space | 74.05% Space Free | Partition Type: NTFS
Drive D: | 488.18 Gb Total Space | 433.99 Gb Free Space | 88.90% Space Free | Partition Type: NTFS
Drive E: | 488.28 Gb Total Space | 483.76 Gb Free Space | 99.08% Space Free | Partition Type: NTFS
Drive F: | 420.70 Gb Total Space | 411.01 Gb Free Space | 97.70% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto] --  -- (TuneUp.UtilitiesSvc)
SRV - [2013/06/11 15:49:27 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/21 08:48:10 | 000,699,680 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto] -- D:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 8.0 OnlineUpdate)
SRV - [2011/12/13 04:29:16 | 000,029,504 | ---- | M] (TuneUp Software) [Auto] -- D:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011/07/22 02:49:26 | 000,511,920 | ---- | M] (REINER SCT) [Auto] -- D:\Windows\System32\cjpcsc.exe -- (cjpcsc)
SRV - [2011/05/05 11:30:46 | 000,549,384 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto] -- D:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate)
SRV - [2011/04/16 20:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Auto] -- D:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe -- (NIS)
SRV - [2010/04/06 11:30:38 | 000,031,272 | ---- | M] () [On_Demand] -- D:\Windows\System32\AppleChargerSrv.exe -- (AppleChargerSrv)
SRV - [2010/01/18 22:31:26 | 000,072,304 | R--- | M] () [Auto] -- D:\Windows\System32\XSrvSetup.exe -- (JMB36X)
SRV - [2009/08/24 09:38:06 | 000,068,136 | ---- | M] () [Disabled] -- D:\Program Files\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service)
SRV - [2009/08/04 12:29:54 | 000,219,360 | ---- | M] (DeviceVM, Inc.) [Auto] -- D:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe -- (BCUService)
SRV - [2009/07/20 07:28:10 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand] -- D:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (VGPU)
DRV - File not found [Kernel | On_Demand] --  -- (TuneUpUtilitiesDrv)
DRV - File not found [Kernel | On_Demand] --  -- (tsusbhub)
DRV - File not found [Kernel | On_Demand] --  -- (Synth3dVsc)
DRV - [2013/06/01 15:20:16 | 001,611,992 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVEX15.SYS -- (NAVEX15)
DRV - [2013/06/01 15:20:16 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVENG.SYS -- (NAVENG)
DRV - [2013/05/31 12:58:19 | 001,002,072 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2013/05/31 09:46:32 | 000,386,720 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130614.001\IDSvix86.sys -- (IDSVix86)
DRV - [2013/03/29 04:27:11 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2013/02/03 04:13:19 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand] -- D:\Windows\gdrv.sys -- (gdrv)
DRV - [2012/08/23 10:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2012/08/23 10:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2012/08/18 02:49:55 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/05/16 12:47:27 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011/04/20 21:37:49 | 000,299,640 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS -- (SymNetS)
DRV - [2011/03/30 23:00:09 | 000,516,216 | ---- | M] (Symantec Corporation) [File_System | On_Demand] -- D:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS -- (SRTSP)
DRV - [2011/03/30 23:00:09 | 000,050,168 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2011/03/29 06:08:08 | 000,028,144 | ---- | M] (REINER SCT) [Kernel | On_Demand] -- D:\Windows\System32\drivers\cjusb.sys -- (cjusb)
DRV - [2011/03/14 22:31:23 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | Boot] -- D:\Windows\System32\drivers\NIS\1207020.003\symefa.sys -- (SymEFA)
DRV - [2011/01/27 02:47:10 | 000,340,088 | ---- | M] (Symantec Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\NIS\1207020.003\symds.sys -- (SymDS)
DRV - [2011/01/27 01:07:05 | 000,136,312 | ---- | M] (Symantec Corporation) [Kernel | System] -- D:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS -- (SymIRON)
DRV - [2011/01/09 13:02:01 | 000,281,760 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2011/01/09 13:02:01 | 000,025,888 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/04/06 11:30:24 | 000,018,984 | ---- | M] () [Kernel | System] -- D:\Windows\System32\drivers\AppleCharger.sys -- (AppleCharger)
DRV - [2010/01/27 04:58:32 | 000,098,928 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- D:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2009/12/21 21:26:36 | 000,030,392 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- D:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)
DRV - [2009/11/20 07:15:18 | 000,137,728 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV - [2009/11/20 07:15:16 | 000,058,880 | ---- | M] (NEC Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)
DRV - [2009/09/30 21:22:08 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand] -- D:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2009/07/13 20:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009/07/13 18:09:17 | 004,194,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\system32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009/06/17 12:56:32 | 000,028,560 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2009/06/17 12:56:16 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2009/06/17 12:56:06 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2009/06/17 12:55:18 | 000,020,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2009/05/04 21:00:28 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot] -- D:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO)
DRV - [2007/05/31 02:38:16 | 000,014,949 | ---- | M] (franson.biz) [Kernel | System] -- D:\Windows\System32\drivers\bizVSerialNT.sys -- (bizVSerial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\franke_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\franke_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\franke_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\franke_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\franke_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0:  File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: D:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: D:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: D:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader:  File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Users\franke\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Users\franke\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2013/03/28 15:32:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 [2013/06/17 15:01:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/01/30 12:00:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/01/30 12:00:03 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - D:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - D:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - D:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\franke_ON_D\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - D:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [BCU] D:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe (DeviceVM, Inc.)
O4 - HKLM..\Run: [JMB36X IDE Setup] D:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] D:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Sweetpacks Communicator] D:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O4 - HKU\franke_ON_D..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Users\franke\AppData\Local\Temp\ofi3jZF.exe (Mozilla Foundation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} hxxp://games.bigfishgames.com/de_dinerdashfloontheg/online/ddfotg.1.0.0.33.cab (CPlayFirstddfotgControl Object)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab (Zylom Games Player)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: Microsoft XML Parser for Java file:///C:/Windows/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\franke_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\System32\cmd.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - D:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O27 - HKLM IFEO\eslite.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O27 - HKLM IFEO\hpcustpartic.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O27 - HKLM IFEO\photoproduct.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O27 - HKLM IFEO\uninst.exe: Debugger - "D:\Program Files\TUAutoReactivator32.exe" File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/06/12 14:31:41 | 002,706,432 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\mshtml.tlb
[2013/06/12 14:31:41 | 000,391,168 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll
[2013/06/12 14:26:35 | 000,690,688 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript.dll
[2013/06/12 14:26:33 | 002,877,440 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jscript9.dll
[2013/06/12 14:26:33 | 000,061,440 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\iesetup.dll
[2013/06/12 14:26:33 | 000,039,424 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\jsproxy.dll
[2013/06/12 14:26:32 | 000,493,056 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msfeeds.dll
[2013/06/12 14:26:32 | 000,109,056 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\iesysprep.dll
[2013/06/12 14:26:32 | 000,071,680 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\RegisterIEPKEYs.exe
[2013/06/12 14:26:32 | 000,042,496 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ie4uinit.exe
[2013/06/12 14:26:32 | 000,033,280 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\iernonce.dll
[2013/06/12 10:26:42 | 001,505,280 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\d3d11.dll
[2013/06/12 10:26:28 | 000,024,576 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\cryptdlg.dll
[2013/06/12 10:26:25 | 000,492,544 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\win32spl.dll
[2013/06/12 10:26:24 | 000,903,168 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\certutil.exe
[2013/06/12 10:26:24 | 000,043,008 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\certenc.dll
[2013/06/12 10:20:11 | 003,968,872 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntkrnlpa.exe
[2013/06/12 10:20:11 | 003,913,576 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntoskrnl.exe
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/06/17 15:18:19 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2013/06/17 15:07:05 | 000,014,192 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/17 15:07:05 | 000,014,192 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/17 15:06:01 | 000,668,692 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2013/06/17 15:06:01 | 000,620,284 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2013/06/17 15:06:01 | 000,134,540 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2013/06/17 15:06:01 | 000,110,472 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2013/06/17 15:01:46 | 000,001,094 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/06/17 15:00:59 | 2614,517,760 | -HS- | M] () -- D:\hiberfil.sys
[2013/06/17 14:50:58 | 000,000,000 | -H-- | M] () -- D:\Windows\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2013/06/15 04:47:00 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job
[2013/06/15 04:37:00 | 000,001,098 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/06/15 00:19:58 | 000,163,055 | ---- | M] () -- D:\Users\franke\AppData\Roaming\2433f433
[2013/06/15 00:19:58 | 000,163,048 | ---- | M] () -- D:\Users\franke\AppData\Local\2433f433
[2013/06/15 00:19:58 | 000,163,006 | ---- | M] () -- D:\ProgramData\2433f433
[2013/06/11 15:49:26 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerApp.exe
[2013/06/11 15:49:26 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\System32\FlashPlayerCPLApp.cpl
[2013/06/08 07:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll
[2013/06/08 07:13:19 | 002,706,432 | ---- | M] (Microsoft Corporation) -- D:\Windows\System32\mshtml.tlb
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/06/17 14:50:58 | 000,000,000 | -H-- | C] () -- D:\Windows\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2013/06/15 00:19:58 | 000,163,055 | ---- | C] () -- D:\Users\franke\AppData\Roaming\2433f433
[2013/06/15 00:19:58 | 000,163,048 | ---- | C] () -- D:\Users\franke\AppData\Local\2433f433
[2013/06/15 00:19:58 | 000,163,006 | ---- | C] () -- D:\ProgramData\2433f433
[2011/12/02 14:14:17 | 000,036,892 | ---- | C] () -- D:\Windows\System32\bassmod.dll
[2011/07/17 10:37:11 | 000,000,934 | ---- | C] () -- D:\Windows\wiso.ini
[2011/04/25 11:10:46 | 000,001,360 | ---- | C] () -- D:\Windows\hpwmdl20.dat.temp
[2011/04/25 09:49:27 | 000,080,896 | ---- | C] () -- D:\Windows\System32\RDVGHelper.exe
[2011/04/25 09:49:14 | 000,252,928 | ---- | C] () -- D:\Windows\System32\DShowRdpFilter.dll
[2011/04/25 09:48:34 | 000,066,048 | ---- | C] () -- D:\Windows\System32\PrintBrmUi.exe
[2011/03/19 10:42:20 | 000,006,550 | ---- | C] () -- D:\Windows\jautoexp.dat
[2011/01/18 14:08:55 | 000,001,940 | ---- | C] () -- D:\Users\franke\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/01/09 12:37:33 | 000,281,760 | ---- | C] () -- D:\Windows\System32\drivers\atksgt.sys
[2011/01/09 12:37:32 | 000,025,888 | ---- | C] () -- D:\Windows\System32\drivers\lirsgt.sys
[2010/11/12 16:07:52 | 000,000,573 | ---- | C] () -- D:\Windows\hbcikrnl.ini
[2010/11/12 16:07:38 | 000,167,936 | ---- | C] () -- D:\Windows\System32\SerialXP.dll
[2010/11/12 16:07:38 | 000,027,648 | ---- | C] () -- D:\Windows\System32\win32com.dll
[2010/11/10 16:52:05 | 000,007,641 | ---- | C] () -- D:\Users\franke\AppData\Local\resmon.resmoncfg
[2010/11/10 15:40:51 | 000,031,272 | ---- | C] () -- D:\Windows\System32\AppleChargerSrv.exe
[2010/11/10 15:40:51 | 000,018,984 | ---- | C] () -- D:\Windows\System32\drivers\AppleCharger.sys
[2010/11/10 15:39:31 | 000,072,304 | R--- | C] () -- D:\Windows\System32\XSrvSetup.exe
[2010/11/10 15:38:51 | 000,080,416 | ---- | C] () -- D:\Windows\System32\RtNicProp32.dll
[2010/11/10 15:32:07 | 000,000,010 | ---- | C] () -- D:\Windows\GSetup.ini
[2010/11/10 15:17:29 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin
[2010/11/10 15:17:29 | 000,000,000 | ---- | C] () -- D:\Windows\System32\atiicdxx.dat
[2009/09/30 06:05:48 | 000,290,816 | ---- | C] () -- D:\Windows\System32\nsldap32v60.dll
[2009/08/27 03:04:12 | 000,207,400 | R--- | C] () -- D:\Windows\GSetup.exe
[2009/07/14 04:47:43 | 000,668,692 | ---- | C] () -- D:\Windows\System32\perfh007.dat
[2009/07/14 04:47:43 | 000,295,922 | ---- | C] () -- D:\Windows\System32\perfi007.dat
[2009/07/14 04:47:43 | 000,134,540 | ---- | C] () -- D:\Windows\System32\perfc007.dat
[2009/07/14 04:47:43 | 000,038,104 | ---- | C] () -- D:\Windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,413,056 | ---- | C] () -- D:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,620,284 | ---- | C] () -- D:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- D:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,110,472 | ---- | C] () -- D:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- D:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- D:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- D:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- D:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\System32\mlang.dat
[2008/10/30 12:00:22 | 000,048,640 | ---- | C] () -- D:\Windows\System32\nsldapssl32v60.dll
[2008/10/30 11:59:24 | 000,025,088 | ---- | C] () -- D:\Windows\System32\nsldappr32v60.dll
[2004/12/14 11:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\System32\nsldapssl32v50.dll
[2004/12/14 11:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\System32\nsldappr32v50.dll
[2004/12/14 11:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\System32\nsldap32v50.dll
 
========== LOP Check ==========
 
[2011/10/08 08:42:38 | 000,000,000 | ---D | M] -- D:\ProgramData\Alawar
[2011/01/01 17:00:46 | 000,000,000 | ---D | M] -- D:\ProgramData\AlawarSouthpoint
[2011/07/16 18:02:56 | 000,000,000 | ---D | M] -- D:\ProgramData\aliasworlds
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2011/09/02 16:16:24 | 000,000,000 | ---D | M] -- D:\ProgramData\Big Fish Games
[2013/06/01 15:36:56 | 000,000,000 | ---D | M] -- D:\ProgramData\Buhl Data Service GmbH
[2011/03/26 17:25:47 | 000,000,000 | ---D | M] -- D:\ProgramData\CannyGames
[2011/09/18 13:44:35 | 000,000,000 | ---D | M] -- D:\ProgramData\Cateia Games
[2011/02/05 14:19:33 | 000,000,000 | ---D | M] -- D:\ProgramData\CrioGames
[2011/07/31 14:21:30 | 000,000,000 | ---D | M] -- D:\ProgramData\CropBusters
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2011/11/05 19:10:28 | 000,000,000 | ---D | M] -- D:\ProgramData\Desktop Gaming
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/09/14 17:31:30 | 000,000,000 | ---D | M] -- D:\ProgramData\Far Mills
[2010/11/21 14:48:36 | 000,000,000 | ---D | M] -- D:\ProgramData\Farm Fishes
[2011/02/26 13:19:50 | 000,000,000 | ---D | M] -- D:\ProgramData\FarmFrenzy_Rome
[2011/09/22 18:30:26 | 000,000,000 | ---D | M] -- D:\ProgramData\FarmFrenzy_Vikings
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2011/09/09 12:13:34 | 000,000,000 | ---D | M] -- D:\ProgramData\Fugazo
[2011/02/15 17:04:11 | 000,000,000 | ---D | M] -- D:\ProgramData\Funny Bear Studio
[2010/11/12 19:54:20 | 000,000,000 | ---D | M] -- D:\ProgramData\GameHouse
[2011/02/24 17:53:52 | 000,000,000 | ---D | M] -- D:\ProgramData\GamePlastic
[2011/09/08 17:28:44 | 000,000,000 | ---D | M] -- D:\ProgramData\Green Clover Games
[2011/12/11 14:19:22 | 000,000,000 | ---D | M] -- D:\ProgramData\Grey Alien Games
[2011/08/07 14:52:36 | 000,000,000 | ---D | M] -- D:\ProgramData\HipSoft
[2011/03/26 16:19:17 | 000,000,000 | ---D | M] -- D:\ProgramData\Kingdom
[2011/03/22 15:34:29 | 000,000,000 | ---D | M] -- D:\ProgramData\MumboJumbo
[2011/02/05 11:27:32 | 000,000,000 | ---D | M] -- D:\ProgramData\Nevosoft-Breeze
[2011/01/08 18:04:32 | 000,000,000 | ---D | M] -- D:\ProgramData\Oberon Media
[2011/03/11 17:28:51 | 000,000,000 | ---D | M] -- D:\ProgramData\Particles
[2011/09/18 15:06:38 | 000,000,000 | ---D | M] -- D:\ProgramData\PlayFirst
[2011/11/19 18:46:37 | 000,000,000 | ---D | M] -- D:\ProgramData\PlayfulAge
[2011/12/12 13:10:29 | 000,000,000 | ---D | M] -- D:\ProgramData\Playrix Entertainment
[2011/09/10 15:33:46 | 000,000,000 | ---D | M] -- D:\ProgramData\PopCap Games
[2010/11/12 16:07:38 | 000,000,000 | ---D | M] -- D:\ProgramData\REINER SCT
[2011/10/19 17:05:34 | 000,000,000 | ---D | M] -- D:\ProgramData\RescueFrenzy
[2011/07/30 12:48:02 | 000,000,000 | ---D | M] -- D:\ProgramData\rionix
[2010/12/07 16:46:24 | 000,000,000 | ---D | M] -- D:\ProgramData\Rumbic Studio
[2011/11/23 19:33:34 | 000,000,000 | ---D | M] -- D:\ProgramData\Solidshield
[2010/11/11 16:57:27 | 000,000,000 | ---D | M] -- D:\ProgramData\StarMoney 7.0
[2012/04/01 11:58:33 | 000,000,000 | ---D | M] -- D:\ProgramData\StarMoney 8.0
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2013/01/13 12:35:26 | 000,000,000 | ---D | M] -- D:\ProgramData\SweetIM
[2013/06/14 18:06:58 | 000,000,000 | ---D | M] -- D:\ProgramData\TEMP
[2011/01/09 11:42:13 | 000,000,000 | ---D | M] -- D:\ProgramData\TuneUp Software
[2011/10/19 07:50:55 | 000,000,000 | ---D | M] -- D:\ProgramData\VirtualFarm2
[2011/11/06 19:30:30 | 000,000,000 | ---D | M] -- D:\ProgramData\Visan
[2010/11/10 15:22:11 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2011/01/09 11:40:28 | 000,000,000 | -HSD | M] -- D:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2010/11/12 17:10:57 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/04/26 10:40:21 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:99AC3203
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:38FF076E
@Alternate Data Stream - 233 bytes -> D:\ProgramData\TEMP:DD95E6D9
@Alternate Data Stream - 218 bytes -> D:\ProgramData\TEMP:29C0641D
@Alternate Data Stream - 213 bytes -> D:\ProgramData\TEMP:6C049F97
@Alternate Data Stream - 212 bytes -> D:\ProgramData\TEMP:E5BA9ADD
@Alternate Data Stream - 199 bytes -> D:\ProgramData\TEMP:1A4BF204
@Alternate Data Stream - 190 bytes -> D:\ProgramData\TEMP:8247A199
@Alternate Data Stream - 18 bytes -> D:\Users\franke:zylomtr{00013KEU-UKQE-K6V0-2PHI-2B2UA19M6VV4}
@Alternate Data Stream - 16 bytes -> D:\Users\franke:zylomtr{000HQ7FF-AD7A-3FG2-LKCU-2AJQPJA4AVHE}
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:884C7316
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:2D3CB929
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:FD38E906
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:3B07E6F4
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:10873493
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:D882BE37
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:2ABB51D4
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:140AD176
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:E6B1AD87
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:8DD36B71
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:A5CD91DF
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:14D29229
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:7EABF26C
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:193CB03B
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:701B92FB
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:4B244549
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:C43C957E
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:160ADF0B
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:9CF728A6
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:6EA64886
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:03D08225
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:751D6870
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:07C99568
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:073139EC
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:F3591DDB
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:20EB6823
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:7425C891
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:5C0940F1
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:2E9900EE
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:0915A718
@Alternate Data Stream - 136 bytes -> D:\ProgramData\TEMP:92D91D7E
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:C3D26A8A
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:4149A170
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:00AA4B31
@Alternate Data Stream - 134 bytes -> D:\ProgramData\TEMP:EE7AAC75
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:E21433CE
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:B722BCE5
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:A01F3A87
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 130 bytes -> D:\ProgramData\TEMP:6423D635
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:D01ACC06
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:9D03192E
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:C946EBB2
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:BC1F7CAE
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:D576A536
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:16A4620C
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:9DB67071
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:2D1AE3BE
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:1B3549F2
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:CD6DF7CC
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:C3AD9507
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:56C66609
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:00811B66
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:F1F936DF
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:BD8010FE
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:063969F8
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:CFF6B3FF
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:9290C91C
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:A7B70C4E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:6C031E3E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:4A966CC2
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:2216A431
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:E99D1D3C
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:A1023D41
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:B285A50E
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:AE9351E0
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:149327FE
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:00258EE7
@Alternate Data Stream - 119 bytes -> D:\ProgramData\TEMP:104A718B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:46A2F27B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:2ADF9928
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:169E7AC5
@Alternate Data Stream - 104 bytes -> D:\ProgramData\TEMP:1A8BB29B
< End of report >
Vielen Dank im Voraus

Gruss tpfkarb

schrauber 17.06.2013 20:56

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
:OTL
O4 - HKU\franke_ON_D..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Users\franke\AppData\Local\Temp\ofi3jZF.exe (Mozilla Foundation)
O20 - HKU\franke_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\System32\cmd.exe (Microsoft Corporation)
[2013/06/15 00:19:58 | 000,163,055 | ---- | M] () -- D:\Users\franke\AppData\Roaming\2433f433
[2013/06/15 00:19:58 | 000,163,048 | ---- | M] () -- D:\Users\franke\AppData\Local\2433f433
[2013/06/15 00:19:58 | 000,163,006 | ---- | M] () -- D:\ProgramData\2433f433
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:99AC3203
@Alternate Data Stream - 236 bytes -> D:\ProgramData\TEMP:38FF076E
@Alternate Data Stream - 233 bytes -> D:\ProgramData\TEMP:DD95E6D9
@Alternate Data Stream - 218 bytes -> D:\ProgramData\TEMP:29C0641D
@Alternate Data Stream - 213 bytes -> D:\ProgramData\TEMP:6C049F97
@Alternate Data Stream - 212 bytes -> D:\ProgramData\TEMP:E5BA9ADD
@Alternate Data Stream - 199 bytes -> D:\ProgramData\TEMP:1A4BF204
@Alternate Data Stream - 190 bytes -> D:\ProgramData\TEMP:8247A199
@Alternate Data Stream - 18 bytes -> D:\Users\franke:zylomtr{00013KEU-UKQE-K6V0-2PHI-2B2UA19M6VV4}
@Alternate Data Stream - 16 bytes -> D:\Users\franke:zylomtr{000HQ7FF-AD7A-3FG2-LKCU-2AJQPJA4AVHE}
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:884C7316
@Alternate Data Stream - 149 bytes -> D:\ProgramData\TEMP:2D3CB929
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:FD38E906
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:3B07E6F4
@Alternate Data Stream - 148 bytes -> D:\ProgramData\TEMP:10873493
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:D882BE37
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:2ABB51D4
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:140AD176
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:E6B1AD87
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:8DD36B71
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:A5CD91DF
@Alternate Data Stream - 145 bytes -> D:\ProgramData\TEMP:14D29229
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:7EABF26C
@Alternate Data Stream - 143 bytes -> D:\ProgramData\TEMP:193CB03B
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:701B92FB
@Alternate Data Stream - 142 bytes -> D:\ProgramData\TEMP:4B244549
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:C43C957E
@Alternate Data Stream - 141 bytes -> D:\ProgramData\TEMP:160ADF0B
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:9CF728A6
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:6EA64886
@Alternate Data Stream - 140 bytes -> D:\ProgramData\TEMP:03D08225
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:751D6870
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:07C99568
@Alternate Data Stream - 139 bytes -> D:\ProgramData\TEMP:073139EC
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:F3591DDB
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:20EB6823
@Alternate Data Stream - 138 bytes -> D:\ProgramData\TEMP:0988A428
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:7425C891
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:5C0940F1
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:2E9900EE
@Alternate Data Stream - 137 bytes -> D:\ProgramData\TEMP:0915A718
@Alternate Data Stream - 136 bytes -> D:\ProgramData\TEMP:92D91D7E
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:C3D26A8A
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:4149A170
@Alternate Data Stream - 135 bytes -> D:\ProgramData\TEMP:00AA4B31
@Alternate Data Stream - 134 bytes -> D:\ProgramData\TEMP:EE7AAC75
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:E21433CE
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:B722BCE5
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:A01F3A87
@Alternate Data Stream - 131 bytes -> D:\ProgramData\TEMP:93226FE3
@Alternate Data Stream - 130 bytes -> D:\ProgramData\TEMP:6423D635
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:D01ACC06
@Alternate Data Stream - 129 bytes -> D:\ProgramData\TEMP:9D03192E
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:C946EBB2
@Alternate Data Stream - 128 bytes -> D:\ProgramData\TEMP:BC1F7CAE
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:D576A536
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:16A4620C
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:9DB67071
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:2D1AE3BE
@Alternate Data Stream - 126 bytes -> D:\ProgramData\TEMP:1B3549F2
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:CD6DF7CC
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:C3AD9507
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:56C66609
@Alternate Data Stream - 125 bytes -> D:\ProgramData\TEMP:00811B66
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:F1F936DF
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:BD8010FE
@Alternate Data Stream - 124 bytes -> D:\ProgramData\TEMP:063969F8
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:CFF6B3FF
@Alternate Data Stream - 123 bytes -> D:\ProgramData\TEMP:9290C91C
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:A7B70C4E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:6C031E3E
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:4A966CC2
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:2216A431
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:E99D1D3C
@Alternate Data Stream - 121 bytes -> D:\ProgramData\TEMP:A1023D41
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:B285A50E
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:AE9351E0
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:149327FE
@Alternate Data Stream - 120 bytes -> D:\ProgramData\TEMP:00258EE7
@Alternate Data Stream - 119 bytes -> D:\ProgramData\TEMP:104A718B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:46A2F27B
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:2ADF9928
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:169E7AC5
@Alternate Data Stream - 104 bytes -> D:\ProgramData\TEMP:1A8BB29B
:Commands
[emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread


Rebooten, freuen ;)

tpfkarb 17.06.2013 21:31
Hallo Schrauber,

habe die Schritte so nachvollzogen, sah auch gut aus....aber nach dem Neustart immer noch der Sperrbildschirm.....hier das Ergebnis des Fix:

Code:
========== OTL ==========
Registry value HKEY_USERS\franke_ON_D\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx deleted successfully.
D:\Users\franke\AppData\Local\Temp\ofi3jZF.exe moved successfully.
Registry value HKEY_USERS\franke_ON_D\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:cmd.exe deleted successfully.
D:\Windows\System32\cmd.exe moved successfully.
D:\Users\franke\AppData\Roaming\2433f433 moved successfully.
D:\Users\franke\AppData\Local\2433f433 moved successfully.
D:\ProgramData\2433f433 moved successfully.
ADS D:\ProgramData\TEMP:99AC3203 deleted successfully.
ADS D:\ProgramData\TEMP:38FF076E deleted successfully.
ADS D:\ProgramData\TEMP:DD95E6D9 deleted successfully.
ADS D:\ProgramData\TEMP:29C0641D deleted successfully.
ADS D:\ProgramData\TEMP:6C049F97 deleted successfully.
ADS D:\ProgramData\TEMP:E5BA9ADD deleted successfully.
ADS D:\ProgramData\TEMP:1A4BF204 deleted successfully.
ADS D:\ProgramData\TEMP:8247A199 deleted successfully.
ADS D:\Users\franke:zylomtr{00013KEU-UKQE-K6V0-2PHI-2B2UA19M6VV4} deleted successfully.
ADS D:\Users\franke:zylomtr{000HQ7FF-AD7A-3FG2-LKCU-2AJQPJA4AVHE} deleted successfully.
ADS D:\ProgramData\TEMP:884C7316 deleted successfully.
ADS D:\ProgramData\TEMP:2D3CB929 deleted successfully.
ADS D:\ProgramData\TEMP:FD38E906 deleted successfully.
ADS D:\ProgramData\TEMP:3B07E6F4 deleted successfully.
ADS D:\ProgramData\TEMP:10873493 deleted successfully.
ADS D:\ProgramData\TEMP:D882BE37 deleted successfully.
ADS D:\ProgramData\TEMP:2ABB51D4 deleted successfully.
ADS D:\ProgramData\TEMP:140AD176 deleted successfully.
ADS D:\ProgramData\TEMP:E6B1AD87 deleted successfully.
ADS D:\ProgramData\TEMP:8DD36B71 deleted successfully.
ADS D:\ProgramData\TEMP:A5CD91DF deleted successfully.
ADS D:\ProgramData\TEMP:14D29229 deleted successfully.
ADS D:\ProgramData\TEMP:7EABF26C deleted successfully.
ADS D:\ProgramData\TEMP:193CB03B deleted successfully.
ADS D:\ProgramData\TEMP:701B92FB deleted successfully.
ADS D:\ProgramData\TEMP:4B244549 deleted successfully.
ADS D:\ProgramData\TEMP:C43C957E deleted successfully.
ADS D:\ProgramData\TEMP:160ADF0B deleted successfully.
ADS D:\ProgramData\TEMP:9CF728A6 deleted successfully.
ADS D:\ProgramData\TEMP:6EA64886 deleted successfully.
ADS D:\ProgramData\TEMP:03D08225 deleted successfully.
ADS D:\ProgramData\TEMP:751D6870 deleted successfully.
ADS D:\ProgramData\TEMP:07C99568 deleted successfully.
ADS D:\ProgramData\TEMP:073139EC deleted successfully.
ADS D:\ProgramData\TEMP:F3591DDB deleted successfully.
ADS D:\ProgramData\TEMP:20EB6823 deleted successfully.
ADS D:\ProgramData\TEMP:0988A428 deleted successfully.
ADS D:\ProgramData\TEMP:7425C891 deleted successfully.
ADS D:\ProgramData\TEMP:5C0940F1 deleted successfully.
ADS D:\ProgramData\TEMP:2E9900EE deleted successfully.
ADS D:\ProgramData\TEMP:0915A718 deleted successfully.
ADS D:\ProgramData\TEMP:92D91D7E deleted successfully.
ADS D:\ProgramData\TEMP:C3D26A8A deleted successfully.
ADS D:\ProgramData\TEMP:4149A170 deleted successfully.
ADS D:\ProgramData\TEMP:00AA4B31 deleted successfully.
ADS D:\ProgramData\TEMP:EE7AAC75 deleted successfully.
ADS D:\ProgramData\TEMP:E21433CE deleted successfully.
ADS D:\ProgramData\TEMP:B722BCE5 deleted successfully.
ADS D:\ProgramData\TEMP:A01F3A87 deleted successfully.
ADS D:\ProgramData\TEMP:93226FE3 deleted successfully.
ADS D:\ProgramData\TEMP:6423D635 deleted successfully.
ADS D:\ProgramData\TEMP:D01ACC06 deleted successfully.
ADS D:\ProgramData\TEMP:9D03192E deleted successfully.
ADS D:\ProgramData\TEMP:C946EBB2 deleted successfully.
ADS D:\ProgramData\TEMP:BC1F7CAE deleted successfully.
ADS D:\ProgramData\TEMP:D576A536 deleted successfully.
ADS D:\ProgramData\TEMP:16A4620C deleted successfully.
ADS D:\ProgramData\TEMP:9DB67071 deleted successfully.
ADS D:\ProgramData\TEMP:2D1AE3BE deleted successfully.
ADS D:\ProgramData\TEMP:1B3549F2 deleted successfully.
ADS D:\ProgramData\TEMP:CD6DF7CC deleted successfully.
ADS D:\ProgramData\TEMP:C3AD9507 deleted successfully.
ADS D:\ProgramData\TEMP:56C66609 deleted successfully.
ADS D:\ProgramData\TEMP:00811B66 deleted successfully.
ADS D:\ProgramData\TEMP:F1F936DF deleted successfully.
ADS D:\ProgramData\TEMP:BD8010FE deleted successfully.
ADS D:\ProgramData\TEMP:063969F8 deleted successfully.
ADS D:\ProgramData\TEMP:CFF6B3FF deleted successfully.
ADS D:\ProgramData\TEMP:9290C91C deleted successfully.
ADS D:\ProgramData\TEMP:A7B70C4E deleted successfully.
ADS D:\ProgramData\TEMP:6C031E3E deleted successfully.
ADS D:\ProgramData\TEMP:4A966CC2 deleted successfully.
ADS D:\ProgramData\TEMP:2216A431 deleted successfully.
ADS D:\ProgramData\TEMP:E99D1D3C deleted successfully.
ADS D:\ProgramData\TEMP:A1023D41 deleted successfully.
ADS D:\ProgramData\TEMP:B285A50E deleted successfully.
ADS D:\ProgramData\TEMP:AE9351E0 deleted successfully.
ADS D:\ProgramData\TEMP:149327FE deleted successfully.
ADS D:\ProgramData\TEMP:00258EE7 deleted successfully.
ADS D:\ProgramData\TEMP:104A718B deleted successfully.
ADS D:\ProgramData\TEMP:46A2F27B deleted successfully.
ADS D:\ProgramData\TEMP:2ADF9928 deleted successfully.
ADS D:\ProgramData\TEMP:169E7AC5 deleted successfully.
ADS D:\ProgramData\TEMP:1A8BB29B deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
 
User: franke
->Temp folder emptied: 180224405 bytes
->Temporary Internet Files folder emptied: 1387884072 bytes
->Java cache emptied: 28537355 bytes
->Google Chrome cache emptied: 388362472 bytes
->Flash cache emptied: 987008402 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17021487 bytes
 
Total Files Cleaned = 2,851.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 06172013_231312

schrauber 18.06.2013 06:50
What? du willst mich ärgern :)
[indent]
Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

tpfkarb 18.06.2013 07:19
Guten Morgen Schrauber,

werde ich heute nachmittag probieren....

Danke bis hierhin....

Gruss tpfkarb

schrauber 18.06.2013 12:12
alles klar :)

tpfkarb 18.06.2013 18:56
so hier nun der scan:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-06-2013 02
Ran by SYSTEM on 18-06-2013 21:49:45
Running from H:\
Windows 7 Ultimate (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe" [346320 2009-08-04] (DeviceVM, Inc.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: []  [x]
HKLM\...\Run: [Sweetpacks Communicator] C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe                                                                                                                                                                                                        [295728 2012-02-26] (SweetIM Technologies Ltd.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKU\franke\...\Winlogon: [Shell]
HKU\franke\...\Command Processor: "C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe" <===== ATTENTION!
IMEO\eslite.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\hpcustpartic.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\photoproduct.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\uninst.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S2 BCUService; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [219360 2009-08-04] (DeviceVM, Inc.)
S2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
S4 ES lite Service; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
S2 JMB36X; C:\Windows\System32\XSrvSetup.exe [72304 2010-01-19] ()
S2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll [262584 2011-04-01] (Symantec Corporation)
S2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [549384 2011-05-05] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 TuneUp.UtilitiesSvc; "D:\Program Files\TuneUpUtilitiesService32.exe" [x]

==================== Drivers (Whitelisted) ====================

S1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18984 2010-04-06] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-09] ()
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
S1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-10-01] (Avanquest Software)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-03-29] (Symantec Corporation)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-02-03] (Windows (R) 2000 DDK provider)
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130614.001\IDSvix86.sys [386720 2013-05-31] (Symantec Corporation)
S0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-09] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37392 2009-06-17] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVENG.SYS [93272 2013-06-01] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVEX15.SYS [1611992 2013-06-01] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2011-05-16] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 TuneUpUtilitiesDrv; \??\D:\Program Files\TuneUpUtilitiesDriver32.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:28 - 2013-06-18 03:35 - 00076068 ____A C:\OTL.Txt
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-12 19:31 - 2013-06-08 12:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 19:31 - 2013-06-08 12:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 19:26 - 2013-05-17 02:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 19:26 - 2013-05-17 02:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 19:26 - 2013-05-14 09:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 15:26 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 15:26 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 15:26 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 15:26 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 15:26 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 15:26 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 15:20 - 2013-05-06 06:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 15:20 - 2013-05-06 06:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 15:20 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 15:14 - 2013-05-08 06:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

==================== One Month Modified Files and Folders ========

2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 20:46 - 2011-09-02 20:51 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-18 20:46 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-18 20:46 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-18 20:46 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-18 20:45 - 2013-02-04 15:59 - 00012469 ____A C:\Windows\setupact.log
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:35 - 2013-06-18 03:28 - 00076068 ____A C:\OTL.Txt
2013-06-18 03:26 - 2010-11-10 20:29 - 00000000 ___AD C:\users\franke
2013-06-17 20:18 - 2010-11-10 20:22 - 01565583 ____A C:\Windows\WindowsUpdate.log
2013-06-17 20:06 - 2010-11-10 20:42 - 00005210 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-15 09:47 - 2012-07-19 21:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-15 09:37 - 2011-09-02 20:51 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-15 04:00 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 18:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-06-13 16:43 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-12 23:42 - 2011-07-17 15:37 - 00001188 ____A C:\Users\franke\AppData\Local\crc32list11.txt
2013-06-12 19:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-12 19:32 - 2010-11-11 19:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 19:27 - 2009-10-14 03:21 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 14:51 - 2012-04-01 16:56 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-06-11 20:49 - 2012-07-19 21:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 20:49 - 2011-09-25 17:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 12:42 - 2013-06-12 19:31 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 12:13 - 2013-06-12 19:31 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 17:36 - 2011-07-17 15:37 - 00000000 ____D C:\Users\franke\Documents\Mein Steuer-Sparbuch Heute
2013-06-01 20:36 - 2011-07-17 15:29 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-05-01 00:11:01
Restore point made on: 2013-05-11 20:28:11
Restore point made on: 2013-05-15 22:31:46
Restore point made on: 2013-06-02 12:15:44
Restore point made on: 2013-06-10 20:09:07
Restore point made on: 2013-06-12 19:26:12
Restore point made on: 2013-06-15 00:05:42

==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 4092.54 MB
Available physical RAM: 3554.83 MB
Total Pagefile: 4090.81 MB
Available Pagefile: 3547.88 MB
Total Virtual: 2047.88 MB
Available Virtual: 1918.17 MB

==================== Drives ================================

Drive c: (windows) (Fixed) (Total:488.18 GB) (Free:436.82 GB) NTFS
Drive e: (programme) (Fixed) (Total:488.28 GB) (Free:483.76 GB) NTFS
Drive f: (daten) (Fixed) (Total:420.7 GB) (Free:411.01 GB) NTFS
Drive g: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS
Drive h: (******) (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: FB48AFF2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=421 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-06-13 18:03

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 18.06.2013 19:01
Aber jetzt :)

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKU\franke\...\Winlogon: [Shell]
HKU\franke\...\Command Processor: "C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe" <===== ATTENTION!
C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

tpfkarb 18.06.2013 19:08
so hier der erneute scan...

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-06-2013 02
Ran by SYSTEM at 2013-06-18 22:06:40 Run:1
Running from H:\
Boot Mode: Recovery

==============================================

HKU\franke\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\franke\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\franke\AppData\Local\Temp\ofi3jZF.exe => File/Directory not found.

==== End of Fixlog ====

schrauber 19.06.2013 06:58
Kannst booten?

tpfkarb 19.06.2013 07:48
Guten Morgen
Da ich eure forenregeln sehr ernst nehme und du nichts von booten geschrieben hast. .......
Ich werde heute abend booten. ...:-)

schrauber 19.06.2013 08:22
LOL, ja nee booten darfste ruhig :)

tpfkarb 19.06.2013 19:07
Hallo schrauber,

booten ja......aber immer noch der Sperrbildschirm....

schrauber 19.06.2013 19:53
Dann darfste jetzt ein frisches FRST Scanlog aus der Recovery posten :)

tpfkarb 19.06.2013 20:31
So hoffe ist richtig


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-06-2013 02
Ran by SYSTEM on 20-06-2013 00:25:31
Running from H:\
Windows 7 Ultimate (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe" [346320 2009-08-04] (DeviceVM, Inc.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: []  [x]
HKLM\...\Run: [Sweetpacks Communicator] C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe                                                                                                                                                                                                        [295728 2012-02-26] (SweetIM Technologies Ltd.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
IMEO\eslite.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\hpcustpartic.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\photoproduct.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\uninst.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S2 BCUService; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [219360 2009-08-04] (DeviceVM, Inc.)
S2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
S4 ES lite Service; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
S2 JMB36X; C:\Windows\System32\XSrvSetup.exe [72304 2010-01-19] ()
S2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll [262584 2011-04-01] (Symantec Corporation)
S2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [549384 2011-05-05] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 TuneUp.UtilitiesSvc; "D:\Program Files\TuneUpUtilitiesService32.exe" [x]

==================== Drivers (Whitelisted) ====================

S1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18984 2010-04-06] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-09] ()
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
S1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-10-01] (Avanquest Software)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-03-29] (Symantec Corporation)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-02-03] (Windows (R) 2000 DDK provider)
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130614.001\IDSvix86.sys [386720 2013-05-31] (Symantec Corporation)
S0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-09] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37392 2009-06-17] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVENG.SYS [93272 2013-06-01] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130614.023\NAVEX15.SYS [1611992 2013-06-01] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2011-05-16] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 TuneUpUtilitiesDrv; \??\D:\Program Files\TuneUpUtilitiesDriver32.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:28 - 2013-06-18 03:35 - 00076068 ____A C:\OTL.Txt
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-12 19:31 - 2013-06-08 12:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 19:31 - 2013-06-08 12:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 19:31 - 2013-06-08 12:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 19:26 - 2013-05-17 02:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 19:26 - 2013-05-17 02:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 19:26 - 2013-05-17 02:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 19:26 - 2013-05-14 09:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 15:26 - 2013-05-13 05:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 15:26 - 2013-05-13 05:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 15:26 - 2013-05-13 04:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 15:26 - 2013-05-13 04:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 15:26 - 2013-05-10 04:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 15:26 - 2013-04-26 05:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 15:26 - 2013-04-26 00:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 15:20 - 2013-05-06 06:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 15:20 - 2013-05-06 06:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 15:20 - 2013-04-17 08:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 15:14 - 2013-05-08 06:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

==================== One Month Modified Files and Folders ========

2013-06-19 22:13 - 2010-11-10 20:22 - 01571378 ____A C:\Windows\WindowsUpdate.log
2013-06-19 21:47 - 2012-07-19 21:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-19 21:37 - 2011-09-02 20:51 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-19 21:10 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-19 21:10 - 2009-07-14 05:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-19 21:09 - 2010-11-10 20:42 - 00005210 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-19 21:05 - 2013-02-04 15:59 - 00012525 ____A C:\Windows\setupact.log
2013-06-19 21:05 - 2011-09-02 20:51 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-19 21:05 - 2009-07-14 05:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-18 21:49 - 2013-06-18 21:49 - 00000000 ____D C:\FRST
2013-06-18 04:13 - 2013-06-18 04:13 - 00000000 ____D C:\_OTL
2013-06-18 03:35 - 2013-06-18 03:28 - 00076068 ____A C:\OTL.Txt
2013-06-18 03:26 - 2010-11-10 20:29 - 00000000 ___AD C:\users\franke
2013-06-17 19:50 - 2013-06-17 19:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-15 04:00 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 18:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-06-13 16:43 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-12 23:42 - 2011-07-17 15:37 - 00001188 ____A C:\Users\franke\AppData\Local\crc32list11.txt
2013-06-12 19:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-12 19:32 - 2010-11-11 19:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 19:27 - 2009-10-14 03:21 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 14:51 - 2012-04-01 16:56 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-06-11 20:49 - 2012-07-19 21:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 20:49 - 2011-09-25 17:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 12:42 - 2013-06-12 19:31 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 12:40 - 2013-06-12 19:31 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 12:13 - 2013-06-12 19:31 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 17:36 - 2011-07-17 15:37 - 00000000 ____D C:\Users\franke\Documents\Mein Steuer-Sparbuch Heute
2013-06-01 20:36 - 2011-07-17 15:29 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-05-01 00:11:01
Restore point made on: 2013-05-11 20:28:11
Restore point made on: 2013-05-15 22:31:46
Restore point made on: 2013-06-02 12:15:44
Restore point made on: 2013-06-10 20:09:07
Restore point made on: 2013-06-12 19:26:12
Restore point made on: 2013-06-15 00:05:42

==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 4092.54 MB
Available physical RAM: 3551.39 MB
Total Pagefile: 4090.81 MB
Available Pagefile: 3545.68 MB
Total Virtual: 2047.88 MB
Available Virtual: 1919.07 MB

==================== Drives ================================

Drive c: (windows) (Fixed) (Total:488.18 GB) (Free:436.38 GB) NTFS
Drive e: (programme) (Fixed) (Total:488.28 GB) (Free:483.76 GB) NTFS
Drive f: (daten) (Fixed) (Total:420.7 GB) (Free:411.01 GB) NTFS
Drive g: (ReatogoPE) (CDROM) (Total:0.43 GB) (Free:0 GB) CDFS
Drive h: (GEHLEN) (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: FB48AFF2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=421 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-06-13 18:03

==================== End Of Log ============================
--- --- ---

schrauber 20.06.2013 08:06
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
C:\Users\franke\AppData\Local\Temp
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

tpfkarb 20.06.2013 08:17
Guten Morgen Schrauber,

werde ich heute abend machen und werde heute etwas früher damit anfangen, damit wir nicht immer eine Aktion pro Tag durchführen...:)
Danke bis hierhin für Deine Hilfe...

Gruss tpfkarb

schrauber 20.06.2013 08:43
Jup :)

tpfkarb 20.06.2013 19:43
voila........sorry kunde drohte mit auftrag.....

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-06-2013 02
Ran by SYSTEM at 2013-06-20 23:41:26 Run:2
Running from H:\
Boot Mode: Recovery

==============================================

C:\Users\franke\AppData\Local\Temp => Moved successfully.

==== End of Fixlog ====
oooooooooooohhhhhhhhhhhh
habe mal neugestartet.......und sperrbildschirm weg.......:party:

Hallo Schrauber,

das gibt ne Spende, habe ich meiner Schwester schon gesagt. Nun brauche ich noch Deine persönliche Meinung:

Kann ich den Rechner so lassen oder muss/soll ich den PC neu aufsetzen?

Gruss tpfkarb

schrauber 21.06.2013 07:06
Supi, wir sind aber noch nicht fertig :)

ab jetzt dann alles im normalen Modus.

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Scan mit SystemLook

Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop:
SystemLook (32 bit)
  • Doppelklicke auf die SystemLook.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
    Code:
    :regfind
    ofi3jZF
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.

tpfkarb 21.06.2013 17:52

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-06-2013 02
Ran by franke (administrator) on 21-06-2013 21:46:06
Running from C:\Users\franke\Desktop
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(DeviceVM, Inc.) C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(REINER SCT) C:\Windows\system32\cjpcsc.exe
() C:\Windows\System32\XSrvSetup.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
(TuneUp Software) D:\Program Files\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(DeviceVM, Inc.) C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
(Logitech, Inc.) D:\Program Files\Logitech\SetPoint\SetPoint.exe
() C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
(TuneUp Software) D:\Program Files\TuneUpUtilitiesApp32.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: []  [x]
HKLM\...\Run: [Sweetpacks Communicator] C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe                                                                                                                                                                                                        [295728 2012-02-26] (SweetIM Technologies Ltd.)
HKLM\...\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe" [346320 2009-08-04] (DeviceVM, Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKCU\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
HKCU\...\Command Processor:  <======= ATTENTION
IMEO\eslite.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\hpcustpartic.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\photoproduct.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\uninst.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKLM SearchScopes: DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&crg=3.1010006&st=12&q={searchTerms}&barid={5CCBCC9D-6A73-413E-BEA8-94D3D91C87EC}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2528046
SearchScopes: HKLM - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&crg=3.1010006&st=12&q={searchTerms}&barid={5CCBCC9D-6A73-413E-BEA8-94D3D91C87EC}
HKCU SearchScopes: DefaultScope {60216556-FD70-4b7e-A149-2B691D5DCE54} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
SearchScopes: HKCU - {60216556-FD70-4b7e-A149-2B691D5DCE54} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&st=17&q={searchTerms}&barid={5CCBCC9D-6A73-413E-BEA8-94D3D91C87EC}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: SweetPacks Browser Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} hxxp://games.bigfishgames.com/de_dinerdashfloontheg/online/ddfotg.1.0.0.33.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\gcswf32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Adobe Acrobat) - D:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll ()
CHR Plugin: (DivX OVS Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (DivX HiQ) - C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0
CHR Extension: (SweetIM for Facebook) - C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 BCUService; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [219360 2009-08-04] (DeviceVM, Inc.)
R2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
S4 ES lite Service; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 JMB36X; C:\Windows\System32\XSrvSetup.exe [72304 2010-01-19] ()
R2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll [262584 2011-04-01] (Symantec Corporation)
R2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [549384 2011-05-05] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
R2 TuneUp.UtilitiesSvc; D:\Program Files\TuneUpUtilitiesService32.exe [1527104 2011-12-13] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18984 2010-04-06] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-09] ()
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-10-01] (Avanquest Software)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-03-29] (Symantec Corporation)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-02-03] (Windows (R) 2000 DDK provider)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130619.001\IDSvix86.sys [386720 2013-05-31] (Symantec Corporation)
R0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-09] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37392 2009-06-17] (Logitech, Inc.)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130620.003\NAVENG.SYS [93272 2013-06-01] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130620.003\NAVEX15.SYS [1611992 2013-06-01] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2011-05-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; D:\Program Files\TuneUpUtilitiesDriver32.sys [10064 2010-11-29] (TuneUp Software)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-21 21:45 - 2013-06-21 18:43 - 00139264 ____A C:\Users\franke\Desktop\SystemLook.exe
2013-06-21 21:45 - 2013-06-18 19:38 - 01366977 ____A (Farbar) C:\Users\franke\Desktop\FRST.exe
2013-06-18 22:49 - 2013-06-18 22:49 - 00000000 ____D C:\FRST
2013-06-18 05:13 - 2013-06-18 05:13 - 00000000 ____D C:\_OTL
2013-06-18 04:28 - 2013-06-18 04:35 - 00076068 ____A C:\OTL.Txt
2013-06-17 20:50 - 2013-06-17 20:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-12 20:31 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 20:31 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 20:26 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 20:26 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 20:26 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 16:26 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 16:26 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 16:26 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 16:26 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 16:26 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 16:26 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 16:26 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 16:26 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 16:20 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 16:20 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 16:20 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 16:14 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

==================== One Month Modified Files and Folders ========

2013-06-21 21:42 - 2009-07-14 06:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-21 21:42 - 2009-07-14 06:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-21 21:41 - 2010-11-10 21:42 - 00005210 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-21 21:37 - 2013-02-04 16:59 - 00012749 ____A C:\Windows\setupact.log
2013-06-21 21:37 - 2011-09-02 21:51 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-21 21:37 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-21 18:43 - 2013-06-21 21:45 - 00139264 ____A C:\Users\franke\Desktop\SystemLook.exe
2013-06-21 00:30 - 2010-11-10 21:22 - 01598611 ____A C:\Windows\WindowsUpdate.log
2013-06-21 00:09 - 2011-07-17 16:37 - 00000000 ____D C:\Users\franke\Documents\Mein Steuer-Sparbuch Heute
2013-06-20 23:58 - 2012-04-01 17:56 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-06-20 23:47 - 2012-07-19 22:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-19 22:37 - 2011-09-02 21:51 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-18 22:49 - 2013-06-18 22:49 - 00000000 ____D C:\FRST
2013-06-18 19:38 - 2013-06-21 21:45 - 01366977 ____A (Farbar) C:\Users\franke\Desktop\FRST.exe
2013-06-18 05:13 - 2013-06-18 05:13 - 00000000 ____D C:\_OTL
2013-06-18 04:35 - 2013-06-18 04:28 - 00076068 ____A C:\OTL.Txt
2013-06-18 04:26 - 2010-11-10 21:29 - 00000000 ___AD C:\users\franke
2013-06-17 20:50 - 2013-06-17 20:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-15 05:00 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 19:10 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-13 17:43 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-13 00:42 - 2011-07-17 16:37 - 00001188 ____A C:\Users\franke\AppData\Local\crc32list11.txt
2013-06-12 20:54 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-12 20:32 - 2010-11-11 20:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 20:27 - 2009-10-14 04:21 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 21:49 - 2012-07-19 22:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 21:49 - 2011-09-25 18:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 13:42 - 2013-06-12 20:31 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-12 20:31 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-01 21:36 - 2011-07-17 16:29 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-13 19:03

==================== End Of Log ============================
--- --- ---

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-06-2013 02
Ran by franke at 2013-06-21 21:46:23 Run:
Running from C:\Users\franke\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 7.1.8)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.224)
Adobe Reader 9.5.3 - Deutsch (Version: 9.5.3)
AMD USB Filter Driver (Version: 1.0.15.94)
Anno 1701 - Der Fluch des Drachen (Version: 2.03)
Anno 1701 (Version: 1.04)
ANNO 2070 (Version: 1.0.0.0)
Apple Application Support (Version: 1.4.0)
Apple Mobile Device Support (Version: 3.3.0.69)
Apple Software Update (Version: 2.1.3.127)
ATI Catalyst Install Manager (Version: 3.0.762.0)
ATI Catalyst Registration (Version: 2.01.0000)
Big Fish Games: Game Manager (Version: 3.0.1.60)
Bonjour (Version: 2.0.4.0)
bpd_scan (Version: 3.00.0000)
Browser Configuration Utility (Version: 1.1.11.0)
CDDRV_Installer (Version: 4.60)
CPUID CPU-Z 1.62
cyberJack Base Components (Version: 6.9.13)
D3DX10 (Version: 15.4.2368.0902)
DIE SIEDLER - Aufstieg eines Königreichs (Version: 1.00.0000)
DivX-Setup (Version: 2.3.0.20)
EasySaver B9.1214.1  (Version: 1.00.0000)
erLT (Version: 1.20.0137)
Everest Poker (Remove Only)
Farm Craft
Farm Frenzy - Das antike Rom
Farm Frenzy: Helden der Wikinger
Fisher's Family Farm
Gigabyte Raid Configurer (Version: 1.00.0001)
Google Chrome (Version: 24.0.1312.57)
Google Earth Plug-in (Version: 7.0.3.8542)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.4.3607.2246)
Google Update Helper (Version: 1.3.21.145)
HP Deskjet 3050 J610 series - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Deskjet 3050 J610 series Hilfe (Version: 140.0.63.63)
HP Photo Creations (Version: 1.0.0.6972)
HP Update (Version: 5.002.006.003)
Internet Explorer Toolbar 4.6 by SweetPacks (Version: 4.6.0003)
Island Tribe
iTunes (Version: 10.1.0.54)
Java Auto Updater (Version: 2.0.6.1)
Java(TM) 6 Update 27 (Version: 6.0.270)
Junk Mail filter update (Version: 15.4.3502.0922)
KhalInstallWrapper (Version: 2.00.0000)
Logitech SetPoint (Version: 4.80)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
My Kingdom for the Princess II
My Kingdom for the Princess III
Mystic Inn
NEC Electronics USB 3.0 Host Controller Driver (Version: 1.0.18.0)
Norton Internet Security (Version: 18.7.2.3)
ON_OFF Charge B10.0409.1 (Version: 1.00.0001)
Pflanzen gegen Zombies
PreReq (Version: 6.2.2.60)
QuickTime (Version: 7.68.75.0)
Realtek Ethernet Controller Driver For Windows 7 (Version: 7.17.304.2010)
Realtek High Definition Audio Driver (Version: 6.0.1.6069)
Roads of Rome
StarMoney (Version: 2.0)
StarMoney (Version: 3.0.2.50)
StarMoney 7.0  (Version: 7.0)
StarMoney 8.0  (Version: 8.0)
Studie zur Verbesserung von HP Deskjet 3050 J610 series Produkten (Version: 22.50.231.0)
TuneUp Utilities 2011 (Version: 10.0.4600.4)
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.4600.4)
Ubisoft Game Launcher (Version: 1.0.0.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Update Manager for SweetPacks 1.0 (Version: 1.0.0005)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
VLC media player 1.1.4 (Version: 1.1.4)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WISO Steuer-Sparbuch 2011 (Version: 18.00.6928)
WISO Steuer-Sparbuch 2012 (Version: 19.00.7303)
WISO Steuer-Sparbuch 2013 (Version: 20.00.8137)

==================== Restore Points  =========================

11-05-2013 19:28:01 Geplanter Prüfpunkt
15-05-2013 21:31:37 Windows Update
02-06-2013 11:15:34 Geplanter Prüfpunkt
10-06-2013 19:08:57 Geplanter Prüfpunkt
12-06-2013 18:26:03 Windows Update
14-06-2013 23:05:31 Windows Update
20-06-2013 22:11:07 Installed Device Package
20-06-2013 22:12:17 Installed Device Package

==================== Scheduled Tasks (whitelisted) =============

Task: {0BAF8A38-FB9A-4D41-810E-B033862BC3C1} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09] (Sun Microsystems, Inc.)
Task: {0EC90963-6217-42C2-A597-72B774B35FA5} - System32\Tasks\User_Feed_Synchronization-{4019269E-9F6D-4F94-94EC-C8EC32FFD63D} => C:\Windows\system32\msfeedssync.exe [2013-05-01] (Microsoft Corporation)
Task: {106D3512-2223-4849-9C0A-850EECDBF561} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2538199436-2216899891-3128283294-1001UA => C:\Users\franke\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-25] (Google Inc.)
Task: {2333BA9B-08C8-451D-ACCA-BF043CA8266F} - System32\Tasks\Symantec\Norton Error Processor 18.7.2.3 => C:\Program Files\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {2F631378-C136-4311-B8F6-1E370ADAAA50} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2538199436-2216899891-3128283294-1001Core => C:\Users\franke\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-25] (Google Inc.)
Task: {428F51FB-CE93-4160-86B7-F9A36C01D779} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated)
Task: {49E101D6-63D7-43D4-A538-D904F02433F1} - System32\Tasks\Symantec\Norton Error Analyzer 18.7.2.3 => C:\Program Files\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {4ABF4BA8-44A0-43C5-B7EA-C395265C80A1} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {593FF7A9-6FE8-43E6-9C3D-8127999004FC} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2010-06-09] (Hewlett-Packard)
Task: {5F1727FC-65C8-49FC-B244-8020EDFD9EE2} - System32\Tasks\HPCustParticipation HP Deskjet 3050 J610 series => C:\Program Files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {635BEC9B-CB3F-4EB1-A825-A0B11BDE56C7} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => D:\Program Files\OneClick.exe [2011-12-13] (TuneUp Software)
Task: {64C7DD90-FF35-4ED4-8DD8-D1CA1B767815} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {79679FFF-354D-45CF-8C5F-D28A7E5D8B81} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {92D26D29-9323-49A1-B6DF-5D2E31E7F4D6} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03] (Adobe Systems Incorporated)
Task: {99E6AF64-D1AA-49DE-8351-2F430BDD8606} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2012-01-28] ()
Task: {AA34DF59-8F82-4E9F-837C-AEE5DA1FE9A3} - System32\Tasks\Google Updater and Installer => C:\Users\franke\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-25] (Google Inc.)
Task: {BCD908FF-CDD3-4F2C-9CFA-A26D5C186255} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2538199436-2216899891-3128283294-1001 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {C5B7685A-F417-4432-B0C5-890A1BD5D98F} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {C83ED90A-531E-4721-9784-CE0E3850F759} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-02] (Google Inc.)
Task: {CA6E9504-CE9A-49FB-9AA5-0451BC7D4C9F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-02] (Google Inc.)
Task: {E2D1D2E9-DADA-4C3E-BD0A-A064D41DA5CF} - System32\Tasks\Divx-Online-Aktualisierungsprogramm => C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-01-11] ()

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/21/2013 09:41:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/21/2013 09:41:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/21/2013 09:41:36 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/21/2013 00:13:34 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/21/2013 00:13:34 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/21/2013 00:13:34 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/21/2013 00:12:16 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {06afafff-9f3c-48df-abfa-5ffa8567b3fa}

Error: (06/21/2013 00:11:07 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {06afafff-9f3c-48df-abfa-5ffa8567b3fa}

Error: (06/20/2013 11:46:45 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/20/2013 11:46:45 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (06/18/2013 09:46:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet:
%%1747

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD
AppleCharger
BHDrvx86
bizVSerial
CSC
DfsC
discache
eeCtrl
IDSVix86
NetBIOS
NetBT
nsiproxy
Psched
rdbss
spldr
SRTSPX
SymIRON
SymNetS
tdx
Wanarpv6
WfpLwf

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SMB-Miniredirector-Wrapper und -Modul" ist vom Dienst "Umgeleitetes Puffersubsystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%31

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Arbeitsstationsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerkspeicher-Schnittstellendienst" ist vom Dienst "NSI proxy service driver." abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%31

Error: (06/17/2013 08:59:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "TCP/IP-NetBIOS-Hilfsdienst" ist vom Dienst "Ancillary Function Driver for Winsock" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%31


Microsoft Office Sessions:
=========================
Error: (02/27/2013 11:04:17 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 45 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (01/29/2012 06:05:15 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 8, Application Name: Microsoft Office Publisher, Application Version: 12.0.6652.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1099 seconds with 660 seconds of active time.  This session ended with a crash.

Error: (01/08/2012 06:56:15 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.


==================== Memory info ===========================

Percentage of memory in use: 29%
Total physical RAM: 3324.54 MB
Available physical RAM: 2357.83 MB
Total Pagefile: 6647.36 MB
Available Pagefile: 5746.22 MB
Total Virtual: 2047.88 MB
Available Virtual: 1904.3 MB

==================== Drives ================================

Drive c: (windows) (Fixed) (Total:488.18 GB) (Free:438.23 GB) NTFS
Drive d: (programme) (Fixed) (Total:488.28 GB) (Free:483.76 GB) NTFS
Drive e: (daten) (Fixed) (Total:420.7 GB) (Free:411.01 GB) NTFS
Drive g: (GEHLEN) (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: FB48AFF2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=488 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=421 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================
Code:
SystemLook 30.07.11 by jpshortstuff
Log created at 21:48 on 21/06/2013 by franke
Administrator - Elevation successful

========== regfind ==========

Searching for "ofi3jZF"
No data found.

-= EOF =-

schrauber 21.06.2013 19:46
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKCU\...\Winlogon: [Shell] explorer.exe <==== ATTENTION
HKCU\...\Command Processor:  <======= ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


und ein frisches FRST Log.

tpfkarb 22.06.2013 09:30
Hallo Schrauber,

beim Ausführen von JRT kommt eine Fehlermeldung:

Error during execution ""C:\JRT\get.bat""
Das System kann die angegebene Datei nicht finden.

Hier schon einmal der erste scan:
Code:
# AdwCleaner v2.303 - Datei am 22/06/2013 um 13:23:46 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : franke - FRANKE-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\franke\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : BCUService

***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files\DeviceVM
Ordner Gelöscht : C:\Program Files\SweetIM
Ordner Gelöscht : C:\ProgramData\SweetIM
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Ordner Gelöscht : C:\Users\franke\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Windows\Installer\{FB697452-8CA4-46B4-98B1-165C922A2EF3}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\DeviceVM
Schlüssel Gelöscht : HKCU\Software\Grand Virtual
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\254796BF4AC84B64891B61C529A2E23F
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\254796BF4AC84B64891B61C529A2E23F
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2528046
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{77AA6435-2488-4A94-9FE5-49519DD2ED9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12BF94BD06C95F343A77631402B9556A
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2124D8A8CF720FD44866190AF560228E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27A325ACED8CA4743A30127638591ADB
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\350D17402BD84234EAF7D32F08172D7C
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EE8C5F419057E1478A654868CEE60B5
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4735D908D66E1BA46B6C2D7185A12B2B
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\76D8378E2DDAED3428720A631F6E3BF0
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A001B259DB7D694E818BE29B973992C
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BAE2EC163C6A68A48921573E0E7E199D
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C06C6662FA5B04646829E4A460857770
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CEEB3E14ABE8270419B0FD762E18F7C6
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED1B5E9A3BDB51349BF96E842C062D98
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FECBC2BC14DA6CD459BD59A041709836
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\254796BF4AC84B64891B61C529A2E23F
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{774C0434-9948-4DEE-A14E-69CDD316E36C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FB697452-8CA4-46B4-98B1-165C922A2EF3}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BCU]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Sweetpacks Communicator]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v24.0.1312.57

Datei : C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [10490 octets] - [22/06/2013 13:23:46]

########## EOF - C:\AdwCleaner[S1].txt - [10551 octets] ##########

schrauber 22.06.2013 13:13
Lass JRT weg und mach den Rest :)

tpfkarb 22.06.2013 13:34
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-06-2013 02
Ran by franke at 2013-06-22 11:16:29 Run:3
Running from C:\Users\franke\Desktop
Boot Mode: Normal

==============================================

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon => Key deleted successfully.
HKCU\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.

==== End of Fixlog ====
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-06-2013 02
Ran by franke (administrator) on 22-06-2013 14:29:08
Running from C:\Users\franke\Desktop
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(REINER SCT) C:\Windows\system32\cjpcsc.exe
() C:\Windows\System32\XSrvSetup.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
(TuneUp Software) D:\Program Files\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Logitech, Inc.) D:\Program Files\Logitech\SetPoint\SetPoint.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
() C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe
(TuneUp Software) D:\Program Files\TuneUpUtilitiesApp32.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: []  [x]
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
IMEO\eslite.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\hpcustpartic.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\photoproduct.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\uninst.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - {60216556-FD70-4b7e-A149-2B691D5DCE54} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} hxxp://games.bigfishgames.com/de_dinerdashfloontheg/online/ddfotg.1.0.0.33.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\gcswf32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Adobe Acrobat) - D:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll ()
CHR Plugin: (DivX OVS Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (DivX HiQ) - C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
S4 ES lite Service; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 JMB36X; C:\Windows\System32\XSrvSetup.exe [72304 2010-01-19] ()
R2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll [262584 2011-04-01] (Symantec Corporation)
R2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [549384 2011-05-05] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
R2 TuneUp.UtilitiesSvc; D:\Program Files\TuneUpUtilitiesService32.exe [1527104 2011-12-13] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18984 2010-04-06] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-09] ()
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-10-01] (Avanquest Software)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-03-29] (Symantec Corporation)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-02-03] (Windows (R) 2000 DDK provider)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130619.001\IDSvix86.sys [386720 2013-05-31] (Symantec Corporation)
R0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-09] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37392 2009-06-17] (Logitech, Inc.)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130620.003\NAVENG.SYS [93272 2013-06-01] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130620.003\NAVEX15.SYS [1611992 2013-06-01] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2011-05-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; D:\Program Files\TuneUpUtilitiesDriver32.sys [10064 2010-11-29] (TuneUp Software)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-22 13:27 - 2013-06-22 10:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\franke\Desktop\JRT.exe
2013-06-22 13:23 - 2013-06-22 13:23 - 00010621 ____A C:\AdwCleaner[S1].txt
2013-06-22 13:23 - 2013-06-22 10:18 - 00648201 ____A C:\Users\franke\Desktop\adwcleaner.exe
2013-06-22 10:55 - 2013-06-22 14:24 - 00000000 ____D C:\JRT
2013-06-21 21:45 - 2013-06-21 18:43 - 00139264 ____A C:\Users\franke\Desktop\SystemLook.exe
2013-06-21 21:45 - 2013-06-18 19:38 - 01366977 ____A (Farbar) C:\Users\franke\Desktop\FRST.exe
2013-06-18 22:49 - 2013-06-18 22:49 - 00000000 ____D C:\FRST
2013-06-18 05:13 - 2013-06-18 05:13 - 00000000 ____D C:\_OTL
2013-06-18 04:28 - 2013-06-18 04:35 - 00076068 ____A C:\OTL.Txt
2013-06-17 20:50 - 2013-06-17 20:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-12 20:31 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 20:31 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 20:26 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 20:26 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 20:26 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 16:26 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 16:26 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 16:26 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 16:26 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 16:26 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 16:26 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 16:26 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 16:26 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 16:20 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 16:20 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 16:20 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 16:14 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

==================== One Month Modified Files and Folders ========

2013-06-22 14:24 - 2013-06-22 10:55 - 00000000 ____D C:\JRT
2013-06-22 14:19 - 2009-07-14 06:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-22 14:19 - 2009-07-14 06:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-22 14:18 - 2010-11-10 21:42 - 00005210 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-22 14:14 - 2013-02-04 16:59 - 00012917 ____A C:\Windows\setupact.log
2013-06-22 14:14 - 2011-09-02 21:51 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-22 14:14 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-22 13:23 - 2013-06-22 13:23 - 00010621 ____A C:\AdwCleaner[S1].txt
2013-06-22 11:17 - 2010-11-10 21:22 - 01620696 ____A C:\Windows\WindowsUpdate.log
2013-06-22 10:47 - 2012-07-19 22:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-22 10:37 - 2011-09-02 21:51 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-22 10:35 - 2013-06-22 13:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\franke\Desktop\JRT.exe
2013-06-22 10:18 - 2013-06-22 13:23 - 00648201 ____A C:\Users\franke\Desktop\adwcleaner.exe
2013-06-21 18:43 - 2013-06-21 21:45 - 00139264 ____A C:\Users\franke\Desktop\SystemLook.exe
2013-06-21 00:09 - 2011-07-17 16:37 - 00000000 ____D C:\Users\franke\Documents\Mein Steuer-Sparbuch Heute
2013-06-20 23:58 - 2012-04-01 17:56 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-06-18 22:49 - 2013-06-18 22:49 - 00000000 ____D C:\FRST
2013-06-18 19:38 - 2013-06-21 21:45 - 01366977 ____A (Farbar) C:\Users\franke\Desktop\FRST.exe
2013-06-18 05:13 - 2013-06-18 05:13 - 00000000 ____D C:\_OTL
2013-06-18 04:35 - 2013-06-18 04:28 - 00076068 ____A C:\OTL.Txt
2013-06-18 04:26 - 2010-11-10 21:29 - 00000000 ___AD C:\users\franke
2013-06-17 20:50 - 2013-06-17 20:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-15 05:00 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 19:10 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-13 17:43 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-13 00:42 - 2011-07-17 16:37 - 00001188 ____A C:\Users\franke\AppData\Local\crc32list11.txt
2013-06-12 20:54 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-12 20:32 - 2010-11-11 20:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 20:27 - 2009-10-14 04:21 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 21:49 - 2012-07-19 22:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 21:49 - 2011-09-25 18:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 13:42 - 2013-06-12 20:31 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-12 20:31 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-01 21:36 - 2011-07-17 16:29 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-13 19:03

==================== End Of Log ============================
--- --- ---

schrauber 22.06.2013 17:34

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST Log. Noch Probleme? :)

tpfkarb 22.06.2013 19:00
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a8191d3afe5b634a8ac86d03fbdc5a94
# engine=14135
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-22 05:50:24
# local_time=2013-06-22 07:50:24 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 66 94 68179765 123554615 0 0
# scanned=51432
# found=0
# cleaned=0
# scan_time=848
beim Ausführen von SecurityCheck kommt eine Fehlermeldung: eine .bat kann nicht gefunden werden.


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-06-2013
Ran by franke (administrator) on 22-06-2013 19:56:57
Running from C:\Users\franke\Downloads
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(REINER SCT) C:\Windows\system32\cjpcsc.exe
() C:\Windows\System32\XSrvSetup.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
(TuneUp Software) D:\Program Files\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Logitech, Inc.) D:\Program Files\Logitech\SetPoint\SetPoint.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
() C:\Program Files\WISO\Steuersoftware 2013\mshaktuell.exe
(TuneUp Software) D:\Program Files\TuneUpUtilitiesApp32.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8546848 2010-03-17] (Realtek Semiconductor)
HKLM\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43632 2010-01-19] ()
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]
HKLM\...\Run: []  [x]
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
IMEO\eslite.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\hpcustpartic.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\photoproduct.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"
IMEO\uninst.exe: [Debugger] "D:\Program Files\TUAutoReactivator32.exe"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU SearchScopes: DefaultScope {60216556-FD70-4b7e-A149-2B691D5DCE54} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
SearchScopes: HKCU - {60216556-FD70-4b7e-A149-2B691D5DCE54} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} hxxp://games.bigfishgames.com/de_dinerdashfloontheg/online/ddfotg.1.0.0.33.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\gcswf32.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.8) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Adobe Acrobat) - D:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\franke\AppData\Local\Google\Chrome\Application\24.0.1312.57\pdf.dll ()
CHR Plugin: (DivX OVS Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (DivX HiQ) - C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.0.900_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\franke\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.0.900_0

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
S4 ES lite Service; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 JMB36X; C:\Windows\System32\XSrvSetup.exe [72304 2010-01-19] ()
R2 NIS; C:\Program Files\Norton Internet Security\Engine\18.7.2.3\diMaster.dll [262584 2011-04-01] (Symantec Corporation)
R2 StarMoney 7.0 OnlineUpdate; C:\Program Files\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [549384 2011-05-05] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
R2 TuneUp.UtilitiesSvc; D:\Program Files\TuneUpUtilitiesService32.exe [1527104 2011-12-13] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18984 2010-04-06] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-09] ()
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-10-01] (Avanquest Software)
S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-18] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-03-29] (Symantec Corporation)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-02-03] (Windows (R) 2000 DDK provider)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130621.001\IDSvix86.sys [386720 2013-05-31] (Symantec Corporation)
R0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-09] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37392 2009-06-17] (Logitech, Inc.)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28560 2009-06-17] (Logitech, Inc.)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130621.022\NAVENG.SYS [93272 2013-06-01] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130621.022\NAVEX15.SYS [1611992 2013-06-01] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1207020.003\SRTSP.SYS [516216 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1207020.003\SRTSPX.SYS [50168 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1207020.003\SYMDS.SYS [340088 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1207020.003\SYMEFA.SYS [744568 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [126584 2011-05-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1207020.003\Ironx86.SYS [136312 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NIS\1207020.003\SYMNETS.SYS [299640 2011-04-21] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; D:\Program Files\TuneUpUtilitiesDriver32.sys [10064 2010-11-29] (TuneUp Software)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-22 19:56 - 2013-06-22 19:56 - 01369655 ____A (Farbar) C:\Users\franke\Downloads\FRST.exe
2013-06-22 19:54 - 2013-06-22 19:54 - 00890839 ____A C:\Users\franke\Downloads\SecurityCheck.exe
2013-06-22 19:33 - 2013-06-22 19:34 - 02347384 ____A (ESET) C:\Users\franke\Downloads\esetsmartinstaller_enu.exe
2013-06-22 14:29 - 2013-06-22 14:29 - 00021092 ____A C:\Users\franke\Desktop\FRST.txt
2013-06-22 13:27 - 2013-06-22 10:35 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\franke\Desktop\JRT.exe
2013-06-22 13:23 - 2013-06-22 13:23 - 00010621 ____A C:\AdwCleaner[S1].txt
2013-06-22 13:23 - 2013-06-22 10:18 - 00648201 ____A C:\Users\franke\Desktop\adwcleaner.exe
2013-06-22 10:55 - 2013-06-22 14:24 - 00000000 ____D C:\JRT
2013-06-21 21:45 - 2013-06-21 18:43 - 00139264 ____A C:\Users\franke\Desktop\SystemLook.exe
2013-06-21 21:45 - 2013-06-18 19:38 - 01366977 ____A (Farbar) C:\Users\franke\Desktop\FRST.exe
2013-06-18 22:49 - 2013-06-18 22:49 - 00000000 ____D C:\FRST
2013-06-18 05:13 - 2013-06-18 05:13 - 00000000 ____D C:\_OTL
2013-06-18 04:28 - 2013-06-18 04:35 - 00076068 ____A C:\OTL.Txt
2013-06-17 20:50 - 2013-06-17 20:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-12 20:31 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 20:31 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 20:31 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 20:26 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 20:26 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 20:26 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 20:26 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 16:26 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 16:26 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 16:26 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 16:26 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 16:26 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 16:26 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 16:26 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 16:26 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-12 16:20 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-12 16:20 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-12 16:20 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 16:14 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

==================== One Month Modified Files and Folders ========

2013-06-22 19:56 - 2013-06-22 19:56 - 01369655 ____A (Farbar) C:\Users\franke\Downloads\FRST.exe
2013-06-22 19:54 - 2013-06-22 19:54 - 00890839 ____A C:\Users\franke\Downloads\SecurityCheck.exe
2013-06-22 19:47 - 2012-07-19 22:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-22 19:37 - 2011-09-02 21:51 - 00001098 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-22 19:34 - 2013-06-22 19:33 - 02347384 ____A (ESET) C:\Users\franke\Downloads\esetsmartinstaller_enu.exe
2013-06-22 19:32 - 2010-11-10 21:22 - 01633627 ____A C:\Windows\WindowsUpdate.log
2013-06-22 18:37 - 2011-09-02 21:51 - 00001094 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-22 14:29 - 2013-06-22 14:29 - 00021092 ____A C:\Users\franke\Desktop\FRST.txt
2013-06-22 14:24 - 2013-06-22 10:55 - 00000000 ____D C:\JRT
2013-06-22 14:19 - 2009-07-14 06:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-22 14:19 - 2009-07-14 06:34 - 00014192 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-22 14:18 - 2010-11-10 21:42 - 00005210 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-22 14:14 - 2013-02-04 16:59 - 00012917 ____A C:\Windows\setupact.log
2013-06-22 14:14 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-22 13:23 - 2013-06-22 13:23 - 00010621 ____A C:\AdwCleaner[S1].txt
2013-06-22 10:35 - 2013-06-22 13:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\franke\Desktop\JRT.exe
2013-06-22 10:18 - 2013-06-22 13:23 - 00648201 ____A C:\Users\franke\Desktop\adwcleaner.exe
2013-06-21 18:43 - 2013-06-21 21:45 - 00139264 ____A C:\Users\franke\Desktop\SystemLook.exe
2013-06-21 00:09 - 2011-07-17 16:37 - 00000000 ____D C:\Users\franke\Documents\Mein Steuer-Sparbuch Heute
2013-06-20 23:58 - 2012-04-01 17:56 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-06-18 22:49 - 2013-06-18 22:49 - 00000000 ____D C:\FRST
2013-06-18 19:38 - 2013-06-21 21:45 - 01366977 ____A (Farbar) C:\Users\franke\Desktop\FRST.exe
2013-06-18 05:13 - 2013-06-18 05:13 - 00000000 ____D C:\_OTL
2013-06-18 04:35 - 2013-06-18 04:28 - 00076068 ____A C:\OTL.Txt
2013-06-18 04:26 - 2010-11-10 21:29 - 00000000 ___AD C:\users\franke
2013-06-17 20:50 - 2013-06-17 20:50 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2013-06-15 05:00 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-06-13 19:10 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-13 17:43 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-13 00:42 - 2011-07-17 16:37 - 00001188 ____A C:\Users\franke\AppData\Local\crc32list11.txt
2013-06-12 20:54 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-12 20:32 - 2010-11-11 20:28 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-12 20:27 - 2009-10-14 04:21 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 21:49 - 2012-07-19 22:35 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-11 21:49 - 2011-09-25 18:00 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 13:42 - 2013-06-12 20:31 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-12 20:31 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-12 20:31 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-01 21:36 - 2011-07-17 16:29 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-13 19:03

==================== End Of Log ============================
--- --- ---

schrauber 22.06.2013 19:03
Noch Probleme? :)

tpfkarb 22.06.2013 19:12
nö,
so wie ich sehe nicht. Meinst nun ist alles runter und ich brauche den PC nicht neu aufsetzen?

schrauber 23.06.2013 08:32
Jep das würde ich so unterschreiben :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

tpfkarb 23.06.2013 11:47
Hallo Schrauber,

alles soweit wieder in Ordnung! Vielen Dank für Deine Hilfe!! Ich werde den Rechner heute wieder zu meiner Schwester bringen.
Die Spende wird unter dem Benutzerzweck "tpfkarb" lauten.
:dankeschoen:

schrauber 23.06.2013 16:12
Gern geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:35 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131