Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich (https://www.trojaner-board.de/142662-gva-trojaner-webcambild-abgesicherter-modus-eingabeaufforderung-moeglich.html)

Computerix 07.10.2013 14:56
GVA-Trojaner mit Webcambild, abgesicherter Modus mit Eingabeaufforderung nicht möglich
 
Hallo liebes Board,

würde mich sehr freuen, wenn Ihr helfen könntet!

Der Rechner startet beim Versuch, in den abgesicherten Modus m. E. zu gehen, nach der Benutzeranmeldung immer gleich neu. Habe daher über Computer reparieren - Systemwiederherstellungsoptionen eine Eingabeaufforderung geöffnet und von dort einen Scan mit dem Farbar Recovery Scan Tool gemacht:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MININT-1QF141C on 07-10-2013 15:39:33
Running from H:\
WIN_7 (X86) OS Language: German Standard
Boot Mode: Recovery
Attention: Could not load system hive.
==================== Registry (Whitelisted) ==================

ATTENTION: Software hive is not loaded.


========================== Services (Whitelisted) =================


==================== Drivers (Whitelisted) ====================


========================== Drivers MD5 =======================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-09-12 06:59 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-12 06:58 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-12 06:58 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-12 06:58 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-12 05:22 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-12 05:22 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-12 05:21 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-12 05:21 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-12 05:21 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-12 05:20 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

==================== One Month Modified Files and Folders =======

2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-07 14:10 - 2011-10-16 18:45 - 01446123 _____ C:\Windows\WindowsUpdate.log
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:12 - 2013-07-21 15:46 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-10-07 10:12 - 2009-07-14 05:39 - 00156841 _____ C:\Windows\setupact.log
2013-10-07 10:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-03 11:58 - 2013-03-12 12:29 - 00491150 _____ C:\test.xml
2013-10-03 11:23 - 2012-01-14 13:40 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Windows Live
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-10-02 06:55 - 2011-10-16 19:50 - 00015392 _____ C:\Windows\PFRO.log
2013-10-02 06:55 - 2011-10-16 19:10 - 00000000 ____D C:\Program Files\McAfee
2013-09-27 08:47 - 2011-10-17 08:59 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Skype
2013-09-23 13:57 - 2010-09-24 21:49 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-23 13:47 - 2013-07-17 14:55 - 00000000 ____D C:\Users\Benutzername\Desktop\15 07 2013
2013-09-20 16:09 - 2013-02-10 12:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-09-20 16:09 - 2013-02-10 12:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-09-20 15:26 - 2012-12-20 10:38 - 00927744 ___SH C:\Users\Benutzername\Desktop\Thumbs.db
2013-09-18 16:23 - 2013-03-10 21:17 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Bico
2013-09-18 12:13 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-09-17 15:18 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-09-16 23:40 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-13 10:11 - 2011-10-21 13:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 11:37 - 2009-07-14 05:33 - 00434488 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-12 11:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-12 06:55 - 2013-07-21 21:51 - 00000000 ____D C:\Windows\System32\MRT
2013-09-12 06:50 - 2011-10-23 09:11 - 76725432 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a

Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: <===== ATTENTION!
HKLM\...\exefile\DefaultIcon:  <===== ATTENTION!
HKLM\...\exefile\open\command:  <===== ATTENTION!

==================== Restore Points  =========================

39
Restore point made on: 2013-08-26 20:26:00
Restore point made on: 2013-08-28 09:08:52
Restore point made on: 2013-08-31 09:23:28
Restore point made on: 2013-08-31 11:54:10
Restore point made on: 2013-09-02 08:03:01
Restore point made on: 2013-09-03 12:02:43
Restore point made on: 2013-09-04 08:01:16
Restore point made on: 2013-09-06 11:44:52
Restore point made on: 2013-09-09 10:04:46
Restore point made on: 2013-09-12 05:00:12
Restore point made on: 2013-09-12 06:50:06
Restore point made on: 2013-09-13 10:06:06
Restore point made on: 2013-09-15 14:59:42
Restore point made on: 2013-09-16 21:32:10
Restore point made on: 2013-09-16 23:54:08
Restore point made on: 2013-09-18 08:02:24
Restore point made on: 2013-09-18 08:19:08
Restore point made on: 2013-09-18 09:00:57
Restore point made on: 2013-09-20 14:45:14
Restore point made on: 2013-09-20 21:23:51
Restore point made on: 2013-09-21 16:52:58
Restore point made on: 2013-09-26 16:41:26
Restore point made on: 2013-09-26 18:03:20
Restore point made on: 2013-09-27 07:55:41
Restore point made on: 2013-09-28 17:06:52
Restore point made on: 2013-09-29 19:34:30
Restore point made on: 2013-10-02 07:03:07
Restore point made on: 2013-10-03 10:52:28
Restore point made on: 2013-10-03 12:09:15
Restore point made on: 2013-10-04 11:01:03
Restore point made on: 2013-10-04 11:02:13
Restore point made on: 2013-10-07 10:17:25
Restore point made on: 2013-10-07 11:02:08
Restore point made on: 2013-10-07 14:10:42
Restore point made on: 2013-10-07 14:10:48
Restore point made on: 2013-10-07 14:10:50
Restore point made on: 2013-10-07 14:10:54
Restore point made on: 2013-10-07 14:10:56
Restore point made on: 2013-10-07 14:10:58

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=Y:
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {default}
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
displayorder            {default}
toolsdisplayorder      {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {current}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {6b41e77b-f826-11e0-ae2c-8723679cab14}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                    Yes
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=Y:
path                    \boot\memtest.exe
description            Windows-Speicherdiagnose
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {6b41e77e-f826-11e0-ae2c-8723679cab14}
description            Ramdisk Options
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info ===========================

Percentage of memory in use: 21%
Total physical RAM: 1642.9 MB
Available physical RAM: 1292.73 MB
Total Pagefile: 1642.9 MB
Available Pagefile: 1291.9 MB
Total Virtual: 2047.88 MB
Available Virtual: 1943.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:287.64 GB) (Free:217.95 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:10.36 GB) (Free:1.11 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (SWIVEL) (Removable) (Total:7.46 GB) (Free:0.71 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 89BA91F6)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=288 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: ECC810A9)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)


LastRegBack: 2013-10-07 10:44

==================== End Of Log ============================
Danke, Florian

schrauber 07.10.2013 15:05
Hi,

FRST vom Stick löschen, neu laden, nochmal scannen. Der softwarehive wurde nicht geladen.

Computerix 07.10.2013 15:19
Sorry, jetzt hats geklappt:



FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MININT-1QF141C on 07-10-2013 16:13:30
Running from H:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet003
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9398888 2010-11-01] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1873192 2010-11-01] (Synaptics Incorporated)
HKLM\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1195408 2011-09-23] (McAfee, Inc.)
HKLM\...\Run: [ISBMgr.exe] - C:\Program Files\Sony\ISB Utility\ISBMgr.exe [673136 2010-05-31] (Sony Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Norton Online Backup] - C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe [966488 2010-06-01] (Symantec Corporation)
HKLM\...\Run: [PMBVolumeWatcher] - c:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-26] (Sony Corporation)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [887976 2011-08-23] (Ask)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [TkBellExe] - c:\program files\real\realplayer\Update\realsched.exe [296096 2012-10-01] (RealNetworks, Inc.)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-04-23] (Samsung Electronics Co., Ltd.)
HKU\Benutzername\...\Run: [DAEMON Tools Lite] - C:\Program Files\DAEMON Tools Lite\DTLite.exe [ 2011-08-02] (DT Soft Ltd)
HKU\Benutzername\...\Run: [Bykyud] - C:\Users\Benutzername\AppData\Roaming\Yketis\dipyy.exe [ 2012-07-14] ()
HKU\Benutzername\...\Run: [] - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-04-23] (Samsung)
HKU\Benutzername\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [ 2013-04-23] (Samsung)
HKU\Benutzername\...\Run: [KiesAirMessage] - C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Benutzername\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll [ 2013-10-03] (ValveCorporation) <===== ATTENTION
HKU\Benutzername\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Benutzername\...\Command Processor: "C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" <===== ATTENTION!
AppInit_DLLs: c:\progra~1\magnipic\sprote~1.dll [ 2013-01-24] ()

========================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [284160 2010-11-18] (Advanced Micro Devices, Inc.)
S2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [140224 2010-06-17] (Advanced Micro Devices)
S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [198904 2010-08-30] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [364216 2010-10-07] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [171168 2011-04-14] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [188136 2011-04-14] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [141792 2011-04-14] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [271480 2010-03-10] (McAfee, Inc.)
S2 NOBU; C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe [2057560 2010-06-01] (Symantec Corporation)
S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [189048 2011-01-29] (Sony Corporation)
S2 uCamMonitor; C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [217968 2010-05-31] (Sony Corporation)
S3 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [549168 2010-10-25] (Sony Corporation)
S3 VcmINSMgr; C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [387896 2010-10-25] (Sony Corporation)
S3 VCService; C:\Program Files\Sony\VAIO Care\VCService.exe [44736 2011-02-14] (Sony Corporation)
S2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [704512 2010-06-08] (Sony Corporation)
S3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1013808 2013-03-26] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

S0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [63616 2010-11-05] (Advanced Micro Devices)
S0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [32384 2010-11-05] (Advanced Micro Devices)
S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-12-03] (ATI Technologies, Inc.)
S3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [297000 2010-11-01] (Broadcom Corporation.)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [56064 2011-04-14] (McAfee, Inc.)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2011-10-21] (DT Soft Ltd)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [95824 2011-04-14] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [153280 2011-04-14] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [52320 2011-04-14] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [314088 2011-04-14] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [387480 2011-04-14] (McAfee, Inc.)
S1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [64584 2011-04-14] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [84488 2011-04-14] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [165032 2011-04-14] (McAfee, Inc.)
S3 mfeavfk01; No ImagePath

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9EBBBA55060F786F0FCAA3893BFA2806
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\amdiox86.sys FF258424F0B2EF25EB98F04EE386E6E3
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 5D3816A677CA50A618AD7138D2C21CED
C:\Windows\System32\DRIVERS\atikmpag.sys F3DC5D5C36FEE050A6C7204F0CB12C4C
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\System32\DRIVERS\amd_sata.sys C67ABECD78888B58BFFA1F9C60C3153B
C:\Windows\System32\DRIVERS\amd_xata.sys ACF7E74A5A813364D0C0BB101E1AC0D5
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys DFD07F0A36BD4F7E7AD2BC5548213694
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\system32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athr.sys 92CE48A7B48D2F836A9706AE215A8CAA
C:\Windows\System32\drivers\AtihdW73.sys C8B17AC82AD2EE9E0E58E3461008C5F7
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\BthEnum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BTHport.sys 1153DE2E4F5941E10C399CB5592F78A1
C:\Windows\System32\Drivers\BTHUSB.sys C81E9413A25A439F436B1D4B6A0CF9E9
C:\Windows\System32\drivers\btwampfl.sys 525432CFD6D8C004860AF7ECD0A84234
C:\Windows\System32\drivers\btwaudio.sys CF8799A563F734984D4E053CACEC1426
C:\Windows\System32\drivers\btwavdt.sys 9ED9932043D599AEA04F6EA2D86964A1
C:\Windows\System32\DRIVERS\btwl2cap.sys DE53089F0678CB5F0AFEB867ACB0FB05
C:\Windows\System32\DRIVERS\btwrchid.sys 373D1BB0F7DC8F1931F9B7E0DE3E9A30
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\System32\drivers\cfwids.sys 7FD604CD7A7A0FF8975AF61BDF64C577
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 247B4CE2DAB1160CD422D532D5241E1F
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys F9F31A9F2A8C0DD0CEB6E380BF0985D4
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dtsoftbus01.sys C0C7CECCB6C85994C2BC92D58E52D3F2
C:\Windows\System32\drivers\dxgkrnl.sys 16498EBC04AE9DD07049A8884B205C05
C:\Windows\System32\DRIVERS\e1y6032.sys 8EEF52AD831471E323EE7364A8656D35
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\System32\DRIVERS\igdkmd32.sys AD626F6964F4D364D226C39E06872DD3
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHDA.sys AEE99ECF06CD1CEA95816CCB5BF73EC8
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys B7895B4182C0D16F6EFADEB8081E8D36
C:\Windows\System32\Drivers\ksecpkg.sys D30159AC9237519FBC62C6EC247D2D46
C:\Windows\System32\DRIVERS\L1C62x86.sys C8FA09049E640B0A27E4B4446D958FE5
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\mfeapfk.sys 113445FC6A858EF453CDED5B0A0DF665
C:\Windows\System32\drivers\mfeavfk.sys DBF6E1B388D5C070D438C61ADB990C30
C:\Windows\System32\drivers\mfebopk.sys A528B15E330EDB83EA649BE318D841D5
C:\Windows\System32\drivers\mfefirek.sys C7DA1B8003C89ACEDAA13768F7A1C622
C:\Windows\System32\drivers\mfehidk.sys 5E9679BB2FC4FA38EC8CA906C47ACD46
C:\Windows\System32\DRIVERS\mfenlfk.sys 3A1AA28066785449DA570462E0532D0C
C:\Windows\System32\drivers\mferkdet.sys CE1711F7C3F72F6762ABD241DCFD5EE1
C:\Windows\System32\drivers\mfewfpk.sys B2BAAC6BBEDDA3E26E82DB13FA0E5BEE
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netw5v32.sys 58218EC6B61B1169CF54AAB0D00F5FE2
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys CB928D9E6DAF51879DD6BA8D02F01321
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 867BEB23207BA425C85293BB0D3EA971
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\system32\drivers\sdbus.sys 0328BE1C7F1CBA23848179F8762E391C
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SFEP.sys DCAFF7089185E6461B92D3D3A17BA295
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\VSTAZL3.SYS E00FDFAFF025E94F9821153750C35A6D
C:\Windows\System32\DRIVERS\VSTDPV3.SYS CEB4E3B6890E1E42DCA6694D9E59E1A0
C:\Windows\System32\DRIVERS\VSTCNXT3.SYS BC0C7EA89194C299F051C24119000E17
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\System32\DRIVERS\ssudmdm.sys 07318149E102FD9197AB444C27774372
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys 7DDDF7B78BF4F67AFF691E6EA15E24C0
C:\Windows\System32\drivers\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\DRIVERS\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\tpm.sys 5AD05191DC8B444A7BA4D79B76C42A30
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys BD9C55D7023C5DE374507ACC7A14E2AC
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys F92DE757E4B7CE9C07C5E65423F3AE3B
C:\Windows\System32\DRIVERS\usbfilter.sys FB0E8B624D1F7E214EDB3D6E56B4EC88
C:\Windows\System32\DRIVERS\usbhub.sys 8DC94AEC6A7E644A06135AE7506DC2E9
C:\Windows\System32\DRIVERS\usbohci.sys E185D44FAC515A18D9DEDDC23C2CDF44
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 576096CCBC07E7C4EA4F5E6686D6888F
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\system32\drivers\usbuhci.sys 68DF884CF41CDADA664BEB01DAF67E3D
C:\Windows\System32\Drivers\usbvideo.sys 45F4E7BF43DB40A6C6B4D92C76CBC3F2
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7
C:\Windows\System32\DRIVERS\vwifimp.sys A3F04CBEA6C2A10E6CB01F8B47611882
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys A840213F1ACDCC175B4D1D5AAEAC0D7A
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-09-12 06:59 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-12 06:58 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-12 06:58 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-12 06:58 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-12 06:58 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-12 06:58 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-12 05:22 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-12 05:22 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-12 05:21 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-12 05:21 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-12 05:21 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-12 05:21 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 05:21 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-12 05:20 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 05:20 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

==================== One Month Modified Files and Folders =======

2013-10-07 15:35 - 2013-10-07 15:35 - 00000000 ____D C:\FRST
2013-10-07 14:11 - 2011-10-16 18:45 - 01446123 _____ C:\Windows\WindowsUpdate.log
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:20 - 2009-07-14 05:34 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 10:12 - 2013-07-21 15:46 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-10-07 10:12 - 2009-07-14 05:39 - 00156841 _____ C:\Windows\setupact.log
2013-10-07 10:10 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\tracing
2013-10-03 21:10 - 2013-10-03 21:10 - 01084739 _____ C:\Users\Benutzername\AppData\Local\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084711 _____ C:\ProgramData\2433f433
2013-10-03 21:10 - 2013-10-03 21:10 - 01084674 _____ C:\Users\Benutzername\AppData\Roaming\2433f433
2013-10-03 11:58 - 2013-03-12 12:29 - 00491150 _____ C:\test.xml
2013-10-03 11:23 - 2012-01-14 13:40 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Windows Live
2013-10-02 07:43 - 2013-10-02 07:43 - 00000000 ____D C:\Users\Benutzername\AppData\Local\KB2815875
2013-10-02 06:55 - 2011-10-16 19:50 - 00015392 _____ C:\Windows\PFRO.log
2013-10-02 06:55 - 2011-10-16 19:10 - 00000000 ____D C:\Program Files\McAfee
2013-09-27 08:47 - 2011-10-17 08:59 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Skype
2013-09-23 13:57 - 2010-09-24 21:49 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI
2013-09-23 13:47 - 2013-07-17 14:55 - 00000000 ____D C:\Users\Benutzername\Desktop\15 07 2013
2013-09-20 16:09 - 2013-02-10 12:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-09-20 16:09 - 2013-02-10 12:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-09-20 15:26 - 2012-12-20 10:38 - 00927744 ___SH C:\Users\Benutzername\Desktop\Thumbs.db
2013-09-18 16:23 - 2013-03-10 21:17 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Bico
2013-09-18 12:13 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\NDF
2013-09-17 15:18 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-09-16 23:40 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-13 10:11 - 2011-10-21 13:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 11:37 - 2009-07-14 05:33 - 00434488 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-12 11:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-12 06:55 - 2013-07-21 21:51 - 00000000 ____D C:\Windows\System32\MRT
2013-09-12 06:50 - 2011-10-23 09:11 - 76725432 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a

Files to move or delete:
====================
C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll


Some content of TEMP:
====================
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

39
Restore point made on: 2013-08-26 20:26:00
Restore point made on: 2013-08-28 09:08:52
Restore point made on: 2013-08-31 09:23:28
Restore point made on: 2013-08-31 11:54:10
Restore point made on: 2013-09-02 08:03:01
Restore point made on: 2013-09-03 12:02:43
Restore point made on: 2013-09-04 08:01:16
Restore point made on: 2013-09-06 11:44:52
Restore point made on: 2013-09-09 10:04:46
Restore point made on: 2013-09-12 05:00:12
Restore point made on: 2013-09-12 06:50:06
Restore point made on: 2013-09-13 10:06:06
Restore point made on: 2013-09-15 14:59:42
Restore point made on: 2013-09-16 21:32:10
Restore point made on: 2013-09-16 23:54:08
Restore point made on: 2013-09-18 08:02:24
Restore point made on: 2013-09-18 08:19:08
Restore point made on: 2013-09-18 09:00:57
Restore point made on: 2013-09-20 14:45:14
Restore point made on: 2013-09-20 21:23:51
Restore point made on: 2013-09-21 16:52:58
Restore point made on: 2013-09-26 16:41:26
Restore point made on: 2013-09-26 18:03:20
Restore point made on: 2013-09-27 07:55:41
Restore point made on: 2013-09-28 17:06:52
Restore point made on: 2013-09-29 19:34:30
Restore point made on: 2013-10-02 07:03:07
Restore point made on: 2013-10-03 10:52:28
Restore point made on: 2013-10-03 12:09:15
Restore point made on: 2013-10-04 11:01:03
Restore point made on: 2013-10-04 11:02:13
Restore point made on: 2013-10-07 10:17:25
Restore point made on: 2013-10-07 11:02:08
Restore point made on: 2013-10-07 14:10:42
Restore point made on: 2013-10-07 14:10:48
Restore point made on: 2013-10-07 14:10:50
Restore point made on: 2013-10-07 14:10:54
Restore point made on: 2013-10-07 14:10:56
Restore point made on: 2013-10-07 14:10:58

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=Y:
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {default}
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
displayorder            {default}
toolsdisplayorder      {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {current}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {6b41e77b-f826-11e0-ae2c-8723679cab14}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                    Yes
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=Y:
path                    \boot\memtest.exe
description            Windows-Speicherdiagnose
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {6b41e77e-f826-11e0-ae2c-8723679cab14}
description            Ramdisk Options
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info ===========================

Percentage of memory in use: 27%
Total physical RAM: 1642.9 MB
Available physical RAM: 1183.77 MB
Total Pagefile: 1642.9 MB
Available Pagefile: 1189.4 MB
Total Virtual: 2047.88 MB
Available Virtual: 1952.72 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:287.64 GB) (Free:217.95 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:10.36 GB) (Free:1.11 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (SWIVEL) (Removable) (Total:7.46 GB) (Free:0.71 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 89BA91F6)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=288 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: ECC810A9)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)


LastRegBack: 2013-10-07 10:44

==================== End Of Log ============================
--- --- ---

schrauber 08.10.2013 08:05
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\Benutzername\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll [ 2013-10-03] (ValveCorporation) <===== ATTENTION
HKU\Benutzername\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Benutzername\...\Command Processor: "C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" <===== ATTENTION!
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a
C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


Rechner normal starten :)

Computerix 08.10.2013 14:15
Vielen Dank, schrauber! Zwischenzeitlich habe ich per Boot-CD temp-Ordner und Recycle.bin und ein paar verdächtige Reg-Einträge schon manuell gelöscht, und offenbar waren die Übeltäter mit dabei:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by Benutzername at 2013-10-08 14:56:32 Run:1
Running from F:\
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\Benutzername\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll [ 2013-10-03] (ValveCorporation) <===== ATTENTION
HKU\Benutzername\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\Benutzername\...\Command Processor: "C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" <===== ATTENTION!
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a
C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll
C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll
C:\Users\Benutzername\AppData\Local\Temp\converter.exe
C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe
C:\Users\Benutzername\AppData\Local\Temp\generka.exe
C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Benutzername\AppData\Local\Temp\jre7.exe
C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe
C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe
C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll
C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe
C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll
C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll
C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe
C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll
C:\Users\Benutzername\AppData\Local\Temp\SCC.dll
C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll
C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll
C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll
C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll
C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll
*****************

HKU\Benutzername\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value not found.
HKU\Benutzername\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.
HKU\Benutzername\Software\Microsoft\Command Processor\\AutoRun => Value not found.
"C:\$Recycle.Bin\S-1-5-21-1377547152-2328664034-3037785392-1001\$10f6c75ed92eed904f675614b8b7437a" => File/Directory not found.
"C:\Users\MICHAE~1\AppData\Local\Temp\~tmf6358139950007164597.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\42gwj1mq.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\c2iiohnp.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\converter.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\Execute2App.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\generka.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\InstallFlashPlayer.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\jre7.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\Kies2RemoveAll.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\lowproc.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\msimg32.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\MSNAED7.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\msvcp90.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\msvcr90.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\ose00000.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\pukqgzn1.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\SCC.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\SkypeSetup.exe" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\stubhelper.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\Tsu454681C7.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\uqjpmix2.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\yhevkstw.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll" => File/Directory not found.
"C:\Users\Benutzername\AppData\Local\Temp\~tmf6358139950007164597.dll.dll" => File/Directory not found.

==== End of Fixlog ====
Danach bootete er auch wieder normal. Hier noch die Logs von Malwarebytes:

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.07.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16686
Benutzername :: Benutzername [Administrator]

07.10.2013 19:26:09
mbam-log-2013-10-07 (19-26-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 321863
Laufzeit: 1 Stunde(n), 42 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 6
HKCR\CLSID\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{77E242E7-43CE-5C03-5FA3-15E01322F8A4} (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EB03EF39-C655-D560-FA95-79182B837D64} (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\AppDataLow\SProtector (PUP.Optional.SProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Quarantäne 1\Yketis\dipyy.exe (Trojan.Agent.ED) -> Keine Aktion durchgeführt.
C:\ProgramData\MaganiPic\515de07288508.dll (PUP.Optional.MultiPlug.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Documentation\DTLite4413-0173.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\MaganiPic\uninstall.exe (PUP.Optional.SilentInstall.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
AdwCleaner:

Code:
# AdwCleaner v3.006 - Bericht erstellt am 08/10/2013 um 09:04:13
# Updated 01/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Benutzername - Benutzername
# Gestartet von : C:\Installierer\Virenschutz\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\MaganiPic
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaganiPic
Ordner Gelöscht : C:\Program Files\MagniPic
Ordner Gelöscht : C:\Users\Benutzername\AppData\LocalLow\Industriya
Ordner Gelöscht : C:\Users\Benutzername\AppData\LocalLow\MaganiPic

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_d8283021
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\PrivitizeVPNInstallDates
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKLM\Software\SP Global
Schlüssel Gelöscht : HKLM\Software\SProtector

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16686


*************************

AdwCleaner[R0].txt - [3134 octets] - [08/10/2013 09:02:01]
AdwCleaner[S0].txt - [2985 octets] - [08/10/2013 09:04:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3045 octets] ##########
und Junkware Removal Tool:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows 7 Home Premium x86
Ran by Benutzername on 08.10.2013 at  9:07:38,17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\privitizevpn_1_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\privitizevpn_1_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskeng_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskeng_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\taskhost_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3DFD11DD-7BEF-4D5C-AE35-8D549DE60FA2}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files\myfree codec"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.10.2013 at  9:11:56,04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Combofix und Eset Online Scanner haben nichts weiter gefunden. Siehst du noch Handlungsbedarf?

Gruß, Florian

schrauber 09.10.2013 07:55
Poste mal ein FRST log vom Desktop aus :)

Computerix 09.10.2013 10:51
Hier ist es:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Benutzername (administrator) on Benutzername on 09-10-2013 11:37:08
Running from C:\Users\Benutzername\Desktop
Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Symantec Corporation) C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe
(Sony Corporation) c:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
(ArcSoft, Inc.) C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Sony Corporation) C:\Program Files\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(DT Soft Ltd) C:\Program Files\DAEMON Tools Lite\DTLite.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Farbar) C:\Users\Benutzername\Desktop\FRST32.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9398888 2010-11-01] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-11-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1873192 2010-11-01] (Synaptics Incorporated)
HKLM\...\Run: [ISBMgr.exe] - C:\Program Files\Sony\ISB Utility\ISBMgr.exe [673136 2010-05-31] (Sony Corporation)
HKLM\...\Run: [Norton Online Backup] - C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe [966488 2010-06-01] (Symantec Corporation)
HKLM\...\Run: [PMBVolumeWatcher] - c:\Program Files\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-27] (Sony Corporation)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [TkBellExe] - c:\program files\real\realplayer\Update\realsched.exe [296096 2012-10-01] (RealNetworks, Inc.)
HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-04-23] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-08-30] (AVAST Software)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files\DAEMON Tools Lite\DTLite.exe [4910912 2011-08-02] (DT Soft Ltd)
HKCU\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1561968 2013-04-23] (Samsung)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ard.de/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {34E69FDC-12F0-421F-B05F-1F582E358E2F} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {40BFEB68-5C72-4FD1-B8D9-601C7991729A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox
SearchScopes: HKCU - {8D227CD4-FB17-47E1-A96C-18656FF37EA7} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {AD3B8338-AB79-47A6-9ADC-31D4A9A5CF43} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-16/4?mpre=hxxp://shop.ebay.de/?_nkw={searchTerms}
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKLM - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1

FireFox:
========
FF ProfilePath: C:\Users\Benutzername\AppData\Roaming\Mozilla\Firefox\Profiles\hk4od86s.default
FF Homepage: hxxp://www.ard.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Benutzername\AppData\Roaming\Mozilla\Firefox\Profiles\hk4od86s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

========================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [284160 2010-11-18] (Advanced Micro Devices, Inc.)
R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [140224 2010-06-17] (Advanced Micro Devices)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
R2 NOBU; C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe [2057560 2010-06-01] (Symantec Corporation)
S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [260992 2013-08-15] (Puran Software)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [189048 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [217968 2010-05-31] (Sony Corporation)
S3 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [549168 2010-10-25] (Sony Corporation)
S3 VcmINSMgr; C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [387896 2010-10-25] (Sony Corporation)
S3 VCService; C:\Program Files\Sony\VAIO Care\VCService.exe [44736 2011-02-14] (Sony Corporation)
R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [704512 2010-06-08] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1020976 2013-08-01] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [63616 2010-11-05] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [32384 2010-11-05] (Advanced Micro Devices)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [17408 2009-05-26] (ArcSoft, Inc.)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [29816 2013-08-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [61680 2013-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [49376 2013-08-30] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [770344 2013-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [369584 2013-08-30] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [56080 2013-08-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [177864 2013-08-30] ()
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-12-03] (ATI Technologies, Inc.)
S3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [297000 2010-11-01] (Broadcom Corporation.)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2011-10-21] (DT Soft Ltd)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\MICHAE~1\AppData\Local\Temp\catchme.sys [x]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9EBBBA55060F786F0FCAA3893BFA2806
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\amdiox86.sys FF258424F0B2EF25EB98F04EE386E6E3
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 5D3816A677CA50A618AD7138D2C21CED
C:\Windows\System32\DRIVERS\atikmpag.sys F3DC5D5C36FEE050A6C7204F0CB12C4C
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\System32\DRIVERS\amd_sata.sys C67ABECD78888B58BFFA1F9C60C3153B
C:\Windows\System32\DRIVERS\amd_xata.sys ACF7E74A5A813364D0C0BB101E1AC0D5
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys DFD07F0A36BD4F7E7AD2BC5548213694
C:\Windows\System32\Drivers\aswFsBlk.sys B9FE438B3CAD82B2014710349A2022F7
C:\Windows\system32\drivers\aswMonFlt.sys AE5549DD21F6DE06406031EF1D51ACC3
C:\Windows\System32\Drivers\aswrdr2.sys A29EF1A46E110F392588F7395BB55F32
C:\Windows\System32\Drivers\aswRvrt.sys FA72FA503F580C3C628DD8C7D7622E37
C:\Windows\System32\Drivers\aswSnx.sys 4D53349D848C6BADB3D4ACBE98C27676
C:\Windows\System32\Drivers\aswSP.sys 813024DFD54A41B3AFAE2B1E2796CB80
C:\Windows\System32\Drivers\aswTdi.sys 5E18413310134130D7772F0668698CB7
C:\Windows\System32\Drivers\aswVmm.sys A5F637D61719D37A5B4868C385E363C0
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\system32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athr.sys 92CE48A7B48D2F836A9706AE215A8CAA
C:\Windows\System32\drivers\AtihdW73.sys C8B17AC82AD2EE9E0E58E3461008C5F7
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 77361D72A04F18809D0EFB6CCEB74D4B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\BthEnum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bthpan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BTHport.sys 1153DE2E4F5941E10C399CB5592F78A1
C:\Windows\System32\Drivers\BTHUSB.sys C81E9413A25A439F436B1D4B6A0CF9E9
C:\Windows\System32\drivers\btwampfl.sys 525432CFD6D8C004860AF7ECD0A84234
C:\Windows\System32\drivers\btwaudio.sys CF8799A563F734984D4E053CACEC1426
C:\Windows\System32\drivers\btwavdt.sys 9ED9932043D599AEA04F6EA2D86964A1
C:\Windows\System32\DRIVERS\btwl2cap.sys DE53089F0678CB5F0AFEB867ACB0FB05
C:\Windows\System32\DRIVERS\btwrchid.sys 373D1BB0F7DC8F1931F9B7E0DE3E9A30
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 42F158036BD4C2FF3122BF142E60E6FD
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys F9F31A9F2A8C0DD0CEB6E380BF0985D4
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\dtsoftbus01.sys C0C7CECCB6C85994C2BC92D58E52D3F2
C:\Windows\System32\drivers\dxgkrnl.sys 16498EBC04AE9DD07049A8884B205C05
C:\Windows\System32\DRIVERS\e1y6032.sys 8EEF52AD831471E323EE7364A8656D35
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\System32\DRIVERS\igdkmd32.sys AD626F6964F4D364D226C39E06872DD3
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHDA.sys AEE99ECF06CD1CEA95816CCB5BF73EC8
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys B7895B4182C0D16F6EFADEB8081E8D36
C:\Windows\System32\Drivers\ksecpkg.sys 5FE1ABF1AF591A3458C9CF24ED9A4D35
C:\Windows\System32\DRIVERS\L1C62x86.sys C8FA09049E640B0A27E4B4446D958FE5
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netw5v32.sys 58218EC6B61B1169CF54AAB0D00F5FE2
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 5E43D2B0EE64123D4880DFA6626DEFDE
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rfcomm.sys CB928D9E6DAF51879DD6BA8D02F01321
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 867BEB23207BA425C85293BB0D3EA971
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\system32\drivers\sdbus.sys 0328BE1C7F1CBA23848179F8762E391C
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SFEP.sys DCAFF7089185E6461B92D3D3A17BA295
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\VSTAZL3.SYS E00FDFAFF025E94F9821153750C35A6D
C:\Windows\System32\DRIVERS\VSTDPV3.SYS CEB4E3B6890E1E42DCA6694D9E59E1A0
C:\Windows\System32\DRIVERS\VSTCNXT3.SYS BC0C7EA89194C299F051C24119000E17
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\System32\DRIVERS\ssudmdm.sys 07318149E102FD9197AB444C27774372
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys 7DDDF7B78BF4F67AFF691E6EA15E24C0
C:\Windows\System32\drivers\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\DRIVERS\tcpip.sys 4E8B9BE71B807B3BAEDB7F4243F85E3C
C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\tpm.sys 5AD05191DC8B444A7BA4D79B76C42A30
C:\Windows\System32\DRIVERS\tssecsrv.sys B37B08F2E5EEB1A37E448E09BACE1101
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys BD9C55D7023C5DE374507ACC7A14E2AC
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys F92DE757E4B7CE9C07C5E65423F3AE3B
C:\Windows\System32\DRIVERS\usbfilter.sys FB0E8B624D1F7E214EDB3D6E56B4EC88
C:\Windows\System32\DRIVERS\usbhub.sys 8DC94AEC6A7E644A06135AE7506DC2E9
C:\Windows\System32\DRIVERS\usbohci.sys E185D44FAC515A18D9DEDDC23C2CDF44
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 576096CCBC07E7C4EA4F5E6686D6888F
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\system32\drivers\usbuhci.sys 68DF884CF41CDADA664BEB01DAF67E3D
C:\Windows\System32\Drivers\usbvideo.sys 45F4E7BF43DB40A6C6B4D92C76CBC3F2
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7
C:\Windows\System32\DRIVERS\vwifimp.sys A3F04CBEA6C2A10E6CB01F8B47611882
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys A840213F1ACDCC175B4D1D5AAEAC0D7A
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070
C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-09 11:35 - 2013-10-07 15:27 - 01087213 _____ (Farbar) C:\Users\Benutzername\Desktop\FRST32.exe
2013-10-09 11:28 - 2013-10-09 11:28 - 00434488 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 11:12 - 2013-10-09 11:12 - 00000992 _____ C:\Users\Benutzername\Desktop\Free Registry Defrag.lnk
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Registry Clean Expert
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Puran Defrag
2013-10-09 11:12 - 2013-08-15 16:39 - 01136512 _____ (Puran Software) C:\Windows\system32\PuranFD.exe
2013-10-09 11:12 - 2013-08-15 16:39 - 00260992 _____ (Puran Software) C:\Windows\system32\PuranDefragS.exe
2013-10-09 11:12 - 2013-08-15 16:39 - 00257408 _____ (Puran Software) C:\Windows\system32\PuranDC.exe
2013-10-09 11:12 - 2013-08-15 16:39 - 00219520 _____ (Puran Software) C:\Windows\system32\PuranDefrag.dll
2013-10-09 11:12 - 2013-08-15 16:39 - 00109952 _____ (Puran Software) C:\Windows\system32\PuranDefragBT.exe
2013-10-08 15:46 - 2013-10-08 15:46 - 00002089 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-10-08 15:46 - 2013-08-30 09:48 - 00770344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00369584 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00177864 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00066336 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00061680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00056080 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00049376 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-10-08 15:46 - 2013-08-30 09:48 - 00029816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-10-08 15:46 - 2013-08-30 09:47 - 00229648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-10-08 15:45 - 2013-10-08 15:45 - 00000000 ____D C:\Program Files\AVAST Software
2013-10-08 15:45 - 2013-08-30 09:47 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-10-08 15:42 - 2013-10-08 15:45 - 00000000 ____D C:\ProgramData\AVAST Software
2013-10-08 14:38 - 2013-10-08 14:38 - 00000000 ____D C:\Windows\CheckSur
2013-10-08 14:18 - 2012-08-24 19:05 - 00136560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-10-08 14:18 - 2012-08-24 19:02 - 00369856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-10-08 14:18 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-10-08 14:18 - 2012-08-24 18:56 - 01039360 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-10-08 14:18 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-10-08 14:07 - 2013-10-09 11:28 - 00000280 _____ C:\Windows\setupact.log
2013-10-08 14:07 - 2013-10-08 14:07 - 00000000 _____ C:\Windows\setuperr.log
2013-10-08 10:18 - 2013-10-08 10:18 - 00001999 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-10-08 10:17 - 2013-10-08 16:03 - 00000000 ____D C:\Program Files\Adobe
2013-10-08 09:19 - 2013-10-08 09:19 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Macromedia
2013-10-08 09:18 - 2013-10-08 09:25 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Mozilla
2013-10-08 09:18 - 2013-10-08 09:19 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00001119 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\ProgramData\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-08 09:07 - 2013-10-08 09:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-07 19:25 - 2013-10-07 19:25 - 00001081 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-07 19:25 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-07 19:03 - 2013-10-09 11:20 - 00116192 _____ C:\Users\Benutzername\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-07 18:34 - 2013-10-07 19:19 - 00000000 ____D C:\Windows\erdnt
2013-10-07 18:25 - 2013-10-09 11:21 - 00000000 ____D C:\Program Files\CCleaner
2013-10-07 18:25 - 2013-10-07 18:25 - 00000969 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-10-07 18:23 - 2013-10-08 14:36 - 00000000 ____D C:\Installierer
2013-10-07 16:35 - 2013-10-07 16:35 - 00000000 ____D C:\FRST
2013-09-12 07:59 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 07:58 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 07:58 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 07:58 - 2013-08-10 05:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 07:58 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 07:58 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 07:58 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 06:22 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 06:22 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 06:21 - 2013-08-08 03:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 06:21 - 2013-08-05 03:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 06:21 - 2013-08-02 03:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 06:21 - 2013-08-02 03:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 06:21 - 2013-08-02 03:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 06:21 - 2013-08-02 02:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 06:20 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 06:20 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

==================== One Month Modified Files and Folders =======

2013-10-09 11:36 - 2009-07-14 06:34 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-09 11:36 - 2009-07-14 06:34 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-09 11:35 - 2011-10-16 19:45 - 01245192 _____ C:\Windows\WindowsUpdate.log
2013-10-09 11:32 - 2011-12-10 16:32 - 00000000 ____D C:\Update
2013-10-09 11:28 - 2013-10-09 11:28 - 00434488 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 11:28 - 2013-10-08 14:07 - 00000280 _____ C:\Windows\setupact.log
2013-10-09 11:28 - 2013-07-21 16:46 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-10-09 11:28 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-09 11:24 - 2011-10-16 20:13 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-10-09 11:24 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing
2013-10-09 11:21 - 2013-10-07 18:25 - 00000000 ____D C:\Program Files\CCleaner
2013-10-09 11:20 - 2013-10-07 19:03 - 00116192 _____ C:\Users\Benutzername\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-09 11:18 - 2013-02-10 13:17 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-09 11:18 - 2011-10-16 20:50 - 00019970 _____ C:\Windows\PFRO.log
2013-10-09 11:16 - 2011-10-21 14:34 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-10-09 11:16 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-09 11:12 - 2013-10-09 11:12 - 00000992 _____ C:\Users\Benutzername\Desktop\Free Registry Defrag.lnk
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Registry Clean Expert
2013-10-09 11:12 - 2013-10-09 11:12 - 00000000 ____D C:\Program Files\Puran Defrag
2013-10-09 11:09 - 2013-02-10 13:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-09 11:09 - 2013-02-10 13:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-08 16:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-10-08 16:03 - 2013-10-08 10:17 - 00000000 ____D C:\Program Files\Adobe
2013-10-08 16:03 - 2011-10-16 20:14 - 00000000 ____D C:\Program Files\Common Files\Adobe AIR
2013-10-08 16:03 - 2011-10-16 20:06 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Adobe
2013-10-08 16:02 - 2011-10-16 20:06 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Adobe
2013-10-08 15:46 - 2013-10-08 15:46 - 00002089 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-10-08 15:46 - 2009-07-14 04:04 - 00002577 _____ C:\Windows\system32\config.nt
2013-10-08 15:45 - 2013-10-08 15:45 - 00000000 ____D C:\Program Files\AVAST Software
2013-10-08 15:45 - 2013-10-08 15:42 - 00000000 ____D C:\ProgramData\AVAST Software
2013-10-08 14:57 - 2010-09-24 22:49 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-08 14:38 - 2013-10-08 14:38 - 00000000 ____D C:\Windows\CheckSur
2013-10-08 14:36 - 2013-10-07 18:23 - 00000000 ____D C:\Installierer
2013-10-08 14:26 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-08 14:15 - 2011-10-16 20:14 - 00000000 ____D C:\ProgramData\Adobe
2013-10-08 14:07 - 2013-10-08 14:07 - 00000000 _____ C:\Windows\setuperr.log
2013-10-08 10:18 - 2013-10-08 10:18 - 00001999 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-10-08 10:17 - 2011-10-16 20:14 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-10-08 09:25 - 2013-10-08 09:18 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Mozilla
2013-10-08 09:19 - 2013-10-08 09:19 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Macromedia
2013-10-08 09:19 - 2013-10-08 09:18 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00001119 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\ProgramData\Mozilla
2013-10-08 09:18 - 2013-10-08 09:18 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-08 09:18 - 2013-04-04 21:41 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-08 09:07 - 2013-10-08 09:07 - 00000000 ____D C:\Windows\ERUNT
2013-10-08 08:57 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-10-07 19:52 - 2013-01-21 16:56 - 00000000 ____D C:\ProgramData\tmp
2013-10-07 19:25 - 2013-10-07 19:25 - 00001081 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-07 19:25 - 2013-10-07 19:25 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-07 19:19 - 2013-10-07 18:34 - 00000000 ____D C:\Windows\erdnt
2013-10-07 19:16 - 2009-07-14 04:37 - 00000000 __RHD C:\Users\Default
2013-10-07 19:16 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2013-10-07 19:11 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-07 18:49 - 2011-12-29 12:44 - 00000000 ____D C:\ProgramData\WinZip
2013-10-07 18:49 - 2011-10-16 19:52 - 00000000 ____D C:\Users\Benutzername
2013-10-07 18:37 - 2011-10-16 20:10 - 00000000 ____D C:\ProgramData\McAfee
2013-10-07 18:31 - 2011-10-21 14:02 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\DAEMON Tools Lite
2013-10-07 18:30 - 2011-10-17 09:59 - 00000000 ____D C:\Users\Benutzername\AppData\Roaming\Skype
2013-10-07 18:25 - 2013-10-07 18:25 - 00000969 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-10-07 16:35 - 2013-10-07 16:35 - 00000000 ____D C:\FRST
2013-10-07 15:27 - 2013-10-09 11:35 - 01087213 _____ (Farbar) C:\Users\Benutzername\Desktop\FRST32.exe
2013-10-03 12:23 - 2012-01-14 14:40 - 00000000 ____D C:\Users\Benutzername\AppData\Local\Windows Live
2013-09-23 14:47 - 2013-07-17 15:55 - 00000000 ____D C:\Users\Benutzername\Desktop\15 07 2013
2013-09-21 13:24 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-20 16:26 - 2012-12-20 11:38 - 00927744 ___SH C:\Users\Benutzername\Desktop\Thumbs.db
2013-09-18 13:13 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-09-13 11:11 - 2011-10-21 14:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 07:55 - 2013-07-21 22:51 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 07:50 - 2011-10-23 10:11 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=\Device\HarddiskVolume2
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {current}
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
displayorder            {current}
toolsdisplayorder      {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {6b41e77d-f826-11e0-ae2c-8723679cab14}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {6b41e77b-f826-11e0-ae2c-8723679cab14}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {6b41e77d-f826-11e0-ae2c-8723679cab14}
device                  ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{6b41e77e-f826-11e0-ae2c-8723679cab14}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {6b41e77b-f826-11e0-ae2c-8723679cab14}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                    Yes
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=\Device\HarddiskVolume2
path                    \boot\memtest.exe
description            Windows-Speicherdiagnose
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {6b41e77e-f826-11e0-ae2c-8723679cab14}
description            Ramdisk Options
ramdisksdidevice        partition=\Device\HarddiskVolume1
ramdisksdipath          \Recovery\WindowsRE\boot.sdi



LastRegBack: 2013-10-07 11:44

==================== End Of Log ============================
--- --- ---


und

Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Benutzername at 2013-10-09 11:38:32
Running from C:\Users\Benutzername\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958)
Adobe AIR (Version: 3.9.0.1030)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Reader XI (11.0.04) - Deutsch (Version: 11.0.04)
AMD Fuel (Version: 2010.1118.1603.28745)
ArcSoft Magic-i Visual Effects 2 (Version: 2.0.1.134)
ArcSoft WebCam Companion 4 (Version: 4.0.21.356)
ATI Catalyst Install Manager (Version: 3.0.800.0)
avast! Free Antivirus (Version: 8.0.1497.0)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (Version: 2010.1118.1603.28745)
Catalyst Control Center InstallProxy (Version: 2010.1118.1603.28745)
Catalyst Control Center Localization All (Version: 2010.1118.1603.28745)
Catalyst Control Center Profiles Mobile (Version: 2010.1118.1603.28745)
CCC Help Chinese Standard (Version: 2010.1118.1602.28745)
CCC Help Chinese Traditional (Version: 2010.1118.1602.28745)
CCC Help Czech (Version: 2010.1118.1602.28745)
CCC Help Danish (Version: 2010.1118.1602.28745)
CCC Help Dutch (Version: 2010.1118.1602.28745)
CCC Help English (Version: 2010.1118.1602.28745)
CCC Help Finnish (Version: 2010.1118.1602.28745)
CCC Help French (Version: 2010.1118.1602.28745)
CCC Help German (Version: 2010.1118.1602.28745)
CCC Help Greek (Version: 2010.1118.1602.28745)
CCC Help Hungarian (Version: 2010.1118.1602.28745)
CCC Help Italian (Version: 2010.1118.1602.28745)
CCC Help Japanese (Version: 2010.1118.1602.28745)
CCC Help Korean (Version: 2010.1118.1602.28745)
CCC Help Norwegian (Version: 2010.1118.1602.28745)
CCC Help Polish (Version: 2010.1118.1602.28745)
CCC Help Portuguese (Version: 2010.1118.1602.28745)
CCC Help Russian (Version: 2010.1118.1602.28745)
CCC Help Spanish (Version: 2010.1118.1602.28745)
CCC Help Swedish (Version: 2010.1118.1602.28745)
CCC Help Thai (Version: 2010.1118.1602.28745)
ccc-core-static (Version: 2010.1118.1603.28745)
ccc-utility (Version: 2010.1118.1603.28745)
CCleaner (Version: 4.06)
Complément Messenger (Version: 15.4.3502.0922)
Control ActiveX de Windows Live Mesh para conexiones remotas (Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (Version: 15.4.5722.2)
CutePDF Writer 2.8
D3DX10 (Version: 15.4.2368.0902)
DAEMON Tools Lite (Version: 4.41.3.0173)
Evernote (Version: 3.5.7.2910)
Free Registry Defrag
Galería fotográfica de Windows Live (Version: 15.4.3502.0922)
Galerie de photos Windows Live (Version: 15.4.3502.0922)
Junk Mail filter update (Version: 15.4.3502.0922)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Media Gallery (Version: 1.4.0.11300)
Mein CEWE FOTOBUCH (Version: 5.0.1)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel 2007 Help Îáíîâëåíèå (KB963678)
Microsoft Office Excel MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office InfoPath MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Outlook 2007 Help Îáíîâëåíèå (KB963677)
Microsoft Office Outlook MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Powerpoint 2007 Help Îáíîâëåíèå (KB963669)
Microsoft Office PowerPoint MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proof (Ukrainian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proofing (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Shared MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft Office Word 2007 Help Îáíîâëåíèå (KB963665)
Microsoft Office Word MUI (Russian) 2007 (Version: 12.0.4804.1000)
Microsoft PowerPoint Viewer (Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (Version: 10.0.30319)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB2721691) (Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
Norton Online Backup (Version: 2.1.17869)
PMB (Version: 5.5.00.11260)
PMB VAIO Edition Plug-in (Version: 1.4.00.09190)
PMB VAIO Edition Plug-in (Version: 1.4.00.11290)
Puran Defrag 7.7
Raccolta foto di Windows Live (Version: 15.4.3502.0922)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
Realtek High Definition Audio Driver (Version: 6.0.1.6167)
Realtek USB 2.0 Card Reader (Version: 6.1.7600.30113)
RealUpgrade 1.1 (Version: 1.1.0)
Remote Keyboard (Version: 1.1.0.10220)
Remote Play mit PlayStation®3 (Version: 1.0.2.06210)
Remote Play with PlayStation 3 (Version: 1.0.2.06210)
Samsung Kies (Version: 2.5.3.13043_14)
Skype Click to Call (Version: 5.6.8442)
Skype™ 6.0 (Version: 6.0.126)
Synaptics Pointing Device Driver (Version: 15.1.9.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825641) 32-Bit Edition
VAIO - Media Gallery (Version: 1.4.0.11300)
VAIO - PMB VAIO Edition Guide (Version: 1.4.00.10090)
VAIO - PMB VAIO Edition Plug-in (Version: 1.4.00.11300)
VAIO - Remote-Tastatur  (Version: 1.0.0.10220)
VAIO Care (Version: 6.4.2.11150)
VAIO Control Center (Version: 4.3.0.05310)
VAIO Data Restore Tool (Version: 1.5.0.10140)
VAIO Gate (Version: 2.3.0.11090)
VAIO Gate Default (Version: 2.3.0.11220)
VAIO Hardware Diagnostics (Version: 4.1.0.10120)
VAIO Media plus (Version: 2.1.0.23300)
VAIO Media plus Opening Movie (Version: 2.1.0.13220)
VAIO Sample Contents (Version: 1.4.2.09010)
VAIO Smart Network (Version: 3.3.0.06080)
VAIO Update (Version: 6.3.0.08010)
VAIO-Handbuch (Version: 1.1.0.05280)
VAIO-Support für Übertragungen (Version: 1.3.0.11250)
VU5x86 (Version: 1.1.0)
WIDCOMM Bluetooth Software (Version: 6.3.0.6300)
Windows Live (Version: 15.4.3502.0922)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (Version: 15.4.5722.2)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WMV9/VC-1 Video Playback (Version: 1.0.51110.1535)
Компаньон Messenger (Version: 15.4.3502.0922)
Основные компоненты Windows Live (Version: 15.4.3502.0922)
Почта Windows Live (Version: 15.4.3502.0922)
Фотоальбом Windows Live (Version: 15.4.3502.0922)
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (Version: 15.4.5722.2)

==================== Restore Points  =========================

07-10-2013 17:22:04 ComboFix created restore point
08-10-2013 07:01:49 Windows Update
08-10-2013 07:52:56 Die Service Pack-Sicherungsdateien wurden entfernt.
08-10-2013 12:18:40 Windows Update
08-10-2013 12:32:56 Windows Update
08-10-2013 12:38:15 Windows Update
08-10-2013 12:58:19 Windows Update
08-10-2013 13:44:49 avast! Free Antivirus Setup
08-10-2013 19:28:00 Windows Update
09-10-2013 09:22:54 Installiert VAIO Update

==================== Hosts content: ==========================

2009-07-14 04:04 - 2013-10-07 19:11 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {02464BE2-5A1C-4B0A-9EC5-DE6B66D3A176} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-08-01] (Sony Corporation)
Task: {089316C2-51AA-4837-A42C-8C5BA500770F} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2011-02-16] (Sony Corporation)
Task: {0A5B39B4-2EFA-4CB9-862F-226D720273E6} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-11-16] (Sony Corporation)
Task: {302DB9FD-6807-45CB-B035-F28DDF16DBB1} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1377547152-2328664034-3037785392-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {3BFD0E2A-4F2F-497C-BFB9-F97E1B3AFB6F} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2013-08-01] (Sony Corporation)
Task: {5D36CEB4-395E-4A2C-B49E-9BFE9B8DD6B3} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-11-16] (Sony Corporation)
Task: {656B48D8-37DD-407F-9D95-9BC4C4939F2C} - System32\Tasks\SONY\VAIO Wallpaper Setting Tool\VAIO Wallpaper Setting Tool => C:\Program Files\Sony\VAIO Wallpaper Setting Tool\VWSet.exe
Task: {6FBB39C0-3391-4051-87AA-8B43EEE06F9F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {7768C420-35FF-4550-A254-6193A3C26013} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2011-02-16] (Sony Corporation)
Task: {93AD7E7A-D542-4029-9826-30F0A9E6C33B} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1377547152-2328664034-3037785392-1001
Task: {9E03458A-1D22-4D80-A907-AC9EECD9C754} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {9E9B2117-2B7C-43FA-9536-AA84823330A1} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {AF061290-51B0-41FB-B038-0C1D11ACB43A} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1377547152-2328664034-3037785392-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {D7F4549F-6CD2-402C-922B-F72D94D1A444} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-04-18 20:17 - 2013-04-18 20:17 - 00036352 _____ () C:\Program Files\Samsung\Kies\Common\Kies.Common.DeviceServiceLib.Interface.dll
2013-04-23 12:44 - 2013-04-23 12:44 - 17497600 _____ () C:\Program Files\Samsung\Kies\Theme\Kies.Theme.dll
2013-04-19 12:34 - 2013-04-19 12:34 - 00563200 _____ () C:\Program Files\Samsung\Kies\Common\Kies.UI.dll
2013-04-18 20:17 - 2013-04-18 20:17 - 00023040 _____ () C:\Program Files\Samsung\Kies\MVVM\Kies.MVVM.dll
2013-04-18 18:08 - 2013-04-18 18:08 - 00057856 _____ () C:\Program Files\Samsung\Kies\External\MediaModules\ASF_cSharpAPI.dll
2010-11-18 16:13 - 2010-11-18 16:13 - 00096256 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2010-11-18 16:02 - 2010-11-18 16:02 - 00243712 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-08-24 14:39 - 2010-08-24 14:39 - 00016384 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/08/2013 03:25:09 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (10/08/2013 03:24:21 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (10/08/2013 09:52:55 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {8ee216ac-496a-4560-b358-1f7bdcfbf4fc}


System errors:
=============
Error: (10/08/2013 09:28:21 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)

Error: (10/08/2013 02:59:06 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)

Error: (10/08/2013 02:33:41 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)

Error: (10/08/2013 02:21:27 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2804579)

Error: (10/08/2013 09:47:29 AM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 63%
Total physical RAM: 1642.9 MB
Available physical RAM: 602.91 MB
Total Pagefile: 3285.8 MB
Available Pagefile: 1957.14 MB
Total Virtual: 2047.88 MB
Available Virtual: 1910.99 MB

==================== Drives ================================

Drive c: (Festplatte) (Fixed) (Total:287.64 GB) (Free:234.76 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 89BA91F6)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=288 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Gruß, Florian

schrauber 09.10.2013 14:05
sieht gut aus, noch Probleme?

Computerix 09.10.2013 16:43
Alles wieder im grünen Bereich. Klasse, danke!!

schrauber 10.10.2013 08:42
Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:21 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131