Trojaner-Board - obession.co.ua/loader/loadit.exe

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-01-2014

Ran by Tommy (administrator) on STUDIO on 22-01-2014 15:25:03

Running from H:\Dokumente und Einstellungen\Tommy\Eigene Dateien\Downloads\Antivirus

Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard

Internet Explorer Version 8

Boot Mode: Normal
 

The only official download link for FRST:

Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 

Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forums
 

==================== Processes (Whitelisted) ===================
 

(Kaspersky Lab ZAO) H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe

(TeamViewer GmbH) H:\Programme\TeamViewer\Version8\TeamViewer_Service.exe

(Microsoft Corporation) H:\WINDOWS\system32\wuauclt.exe

(Kaspersky Lab ZAO) H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe

(TeamViewer GmbH) H:\Programme\TeamViewer\Version8\TeamViewer.exe

(Google Inc.) H:\Programme\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(TeamViewer GmbH) H:\Programme\TeamViewer\Version8\tv_w32.exe

(Crawler.com) H:\Programme\Spyware Terminator\SpywareTerminatorUpdate.exe

(Crawler.com) H:\Programme\Spyware Terminator\SpywareTerminatorShield.exe

(Microsoft Corporation) H:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

(Google Inc.) H:\Programme\Google\Chrome\Application\chrome.exe

(Google Inc.) H:\Programme\Google\Chrome\Application\chrome.exe

(Google Inc.) H:\Programme\Google\Chrome\Application\chrome.exe

(Farbar) H:\Dokumente und Einstellungen\Tommy\Eigene Dateien\Downloads\Antivirus\FRST32.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SpywareTerminatorUpdater] - H:\Programme\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)

HKLM\...\Run: [SpywareTerminatorShield] - H:\Programme\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)

HKLM\...\Run: [MSConfig] - H:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe [172544 2008-04-14] (Microsoft Corporation)

Winlogon\Notify\klogon: H:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)

Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]

HKLM\...\Policies\Explorer: [NoViewContextMenu] 0

HKLM\...\Policies\Explorer: [NoDesktop] 1 <===== ATTENTION

HKCU\...\Run: [ccleaner] - H:\Programme\CCleaner\ccleaner.exe [1779512 2010-08-24] (Piriform Ltd)

HKCU\...\Run: [swg] - H:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-10-16] (Google Inc.)

HKCU\...\Run: [AutoStart-Manager] - H:\Programme\Tools&More\Autostart-Manager\AutoStart-Manager.exe [409600 2012-11-27] (Wirth IT Design)

HKCU\...\Policies\Explorer: [NoViewContextMenu] 0

MountPoints2: {635aceaa-5f51-11e0-a6d0-1c6f6533e959} - E:\LaunchU3.exe -a

MountPoints2: {eeeaa781-5b59-11e0-a6ca-1c6f6533e959} - N:\LaunchU3.exe -a
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In

URLSearchHook: HKCU - (No Name) - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} -  No File

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - DefaultScope {E8DF1BE4-15DC-4D89-9DFF-471C39D424BD} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3305104&CUI=UN17111334642017824&UM=2

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {E8DF1BE4-15DC-4D89-9DFF-471C39D424BD} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3305104&CUI=UN17111334642017824&UM=2

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - H:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - H:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)

BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - H:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Programme\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)

BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)

Toolbar: HKLM - Gutscheinmieze - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - H:\Dokumente und Einstellungen\Tommy\Anwendungsdaten\Gutscheinmieze\toolbar.dll (Synatix GmbH)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - H:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - H:\Windows\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - H:\Windows\system32\SHELL32.dll (Microsoft Corporation)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - H:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Gutscheinmieze - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - H:\Dokumente und Einstellungen\Tommy\Anwendungsdaten\Gutscheinmieze\toolbar.dll (Synatix GmbH)

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - H:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - H:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - H:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR DefaultSearchKeyword: ask.com

CHR DefaultSearchProvider: ask

CHR DefaultSearchURL: hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=DVS2&o=1586&locale=de_DE&apn_uid=&apn_ptnrs=%5EAAA&apn_sauid=&apn_dtid=%5EYYYYYY%5EYY%5EDE&psv=&q={searchTerms}

CHR DefaultNewTabURL: 

CHR Plugin: (Shockwave Flash) - H:\Programme\Google\Chrome\Application\32.0.1700.76\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - H:\Programme\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - H:\Programme\Google\Chrome\Application\32.0.1700.76\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - H:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Microsoft\u00AE DRM) - H:\Programme\Windows Media Player\npdrmv2.dll (Microsoft Corporation)

CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - H:\Programme\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))

CHR Plugin: (Microsoft\u00AE DRM) - H:\Programme\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - H:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File

CHR Plugin: (Windows Presentation Foundation) - H:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - H:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

CHR Extension: (YouTube) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-06]

CHR Extension: (Google-Suche) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-06]

CHR Extension: (Modul zur Link-Untersuchung) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2014-01-20]

CHR Extension: (Sicherer Zahlungsverkehr) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh [2014-01-20]

CHR Extension: (Modul zum Sperren von gef\u00E4hrlichen Webseiten) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail [2014-01-20]

CHR Extension: (Virtuelle Tastatur) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2014-01-20]

CHR Extension: (Google Wallet) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]

CHR Extension: (Google Mail) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-26]

CHR Extension: (Anti-Banner) - H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman [2014-01-20]

CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx [2013-10-17]

CHR HKLM\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx [2013-10-17]

CHR HKLM\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx [2013-10-17]

CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx [2013-10-17]

CHR HKLM\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx [2013-10-17]
 

========================== Services (Whitelisted) =================
 

S4 AcrSch2Svc; H:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe [805024 2011-02-01] (Acronis)

S4 afcdpsrv; H:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe [3246040 2011-05-28] (Acronis)

S4 AppleChargerSrv; H:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()

R2 AVP; H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)

S4 FLEXnet Licensing Service; H:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [655624 2010-10-18] (Acresso Software Inc.)

S4 GEARSecurity; H:\Windows\System32\GEARSec.exe [49152 2002-11-25] (GEAR Software)

S4 gupdate; H:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-10-16] (Google Inc.)

S4 gupdatem; H:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-10-16] (Google Inc.)

S4 gusvc; H:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2012-08-11] (Google)

S4 Microsoft Office Groove Audit Service; H:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [65888 2008-10-25] (Microsoft Corporation)

S4 odserv; H:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [441712 2008-11-04] (Microsoft Corporation)

S4 ose; H:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)

S4 PCLEPCI; H:\WINDOWS\system32\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH)

S4 SDScannerService; H:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)

S4 SDUpdateService; H:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)

S4 SDWSCService; H:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)

S4 ST2012_Svc; H:\Programme\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)

S4 SwitchBoard; H:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

R2 TeamViewer8; H:\Programme\TeamViewer\Version8\TeamViewer_Service.exe [5087584 2013-10-01] (TeamViewer GmbH)

S4 V2i Protector; H:\Programme\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe [1200128 2003-06-03] (PowerQuest Corporation)

S4 WMPNetworkSvc; H:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

S3 61883; H:\Windows\System32\DRIVERS\61883.sys [48128 2008-04-14] (Microsoft Corporation)

S3 Ambfilt; H:\Windows\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)

R1 AppleCharger; H:\Windows\System32\DRIVERS\AppleCharger.sys [19496 2010-04-22] ()

S3 CCDECODE; H:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)

R1 Ext2Fsd; H:\Windows\System32\Drivers\Ext2Fsd.sys [651264 2009-07-26] (Ext2Fsd Project)

R0 JRAID; H:\Windows\System32\DRIVERS\jraid.sys [98928 2010-01-27] (JMicron Technology Corp.)

R0 kl1; H:\Windows\System32\DRIVERS\kl1.sys [135776 2014-01-08] (Kaspersky Lab ZAO)

R1 KLIF; H:\Windows\System32\DRIVERS\klif.sys [573536 2014-01-08] (Kaspersky Lab ZAO)

R3 klim5; H:\Windows\System32\DRIVERS\klim5.sys [36448 2013-04-19] (Kaspersky Lab ZAO)

R3 klkbdflt; H:\Windows\System32\DRIVERS\klkbdflt.sys [24160 2013-10-17] (Kaspersky Lab ZAO)

R3 klmouflt; H:\Windows\System32\DRIVERS\klmouflt.sys [24672 2013-10-17] (Kaspersky Lab ZAO)

R1 klpd; H:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; H:\Windows\System32\DRIVERS\kltdi.sys [45024 2013-05-14] (Kaspersky Lab ZAO)

R1 kneps; H:\Windows\System32\DRIVERS\kneps.sys [144992 2014-01-08] (Kaspersky Lab ZAO)

S3 L8042pr2; H:\Windows\System32\DRIVERS\L8042pr2.Sys [51582 2003-12-11] (Logitech, Inc.)

R3 MarvinBus; H:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2007-01-04] (Pinnacle Systems GmbH)

S3 Monfilt; H:\Windows\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)

S3 MPE; H:\Windows\System32\DRIVERS\MPE.sys [15232 2008-04-13] (Microsoft Corporation)

S3 NdisIP; H:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)

R3 NVHDA; H:\Windows\System32\drivers\nvhda32.sys [58600 2010-01-28] (NVIDIA Corporation)

R3 pfc; H:\Windows\System32\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.)

R1 PQIMount; H:\Windows\System32\Drivers\PQIMount.sys [46900 2003-06-03] (PowerQuest Corporation)

R0 PQV2i; H:\Windows\System32\Drivers\PQV2i.sys [123957 2003-06-03] (StorageCraft)

R1 sp_rsdrv2; H:\WINDOWS\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] ()

S3 tap0901; H:\Windows\System32\DRIVERS\tap0901.sys [25984 2011-01-08] (The OpenVPN Project)

S3 TRIDCap; H:\Windows\System32\DRIVERS\AVerTM62.sys [2637696 2012-01-11] (AVerMedia TECHNOLOGIES, Inc. )

R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; H:\Programme\CyberLink\PowerDVD10\NavFilter\000.fcl [87536 2011-03-01] (CyberLink Corp.)

S0 cerc6; No ImagePath

S3 cpuz132; \??\H:\DOKUME~1\Tommy\LOKALE~1\Temp\DTL132\DTL132_x32.sys [x]

S3 gdrv; \??\H:\WINDOWS\gdrv.sys [x]

S3 IDDRV; \??\H:\Programme\DriveTheLife\iodrv.sys [x]

S4 IntelIde; No ImagePath

U5 klflt; H:\Windows\System32\Drivers\klflt.sys [93280 2013-06-08] (Kaspersky Lab ZAO)

S0 lwvjpl; System32\drivers\afsydsfh.sys [x]

S3 WDC_SAM; system32\DRIVERS\wdcsam.sys [x]

U1 WS2IFSL; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-22 15:25 - 2014-01-22 15:25 - 00000000 ____D H:\FRST

2014-01-21 20:34 - 2014-01-21 20:34 - 00442600 _____ H:\Dokumente und Einstellungen\Tommy\Anwendungsdaten\loadit.exe

2014-01-21 18:10 - 2014-01-21 18:10 - 00000000 ____D H:\WINDOWS\ERUNT

2014-01-21 18:09 - 2014-01-21 18:13 - 00000000 ____D H:\AdwCleaner

2014-01-21 18:05 - 2014-01-21 18:05 - 00000986 _____ H:\Dokumente und Einstellungen\Tommy\Desktop\Continue Zip Opener Installation.lnk

2014-01-19 12:38 - 2014-01-20 03:13 - 00001024 ____H H:\WINDOWS\system32\config\elam.LOG

2014-01-19 12:38 - 2014-01-19 12:38 - 00262144 _____ H:\WINDOWS\system32\config\elam

2014-01-15 19:31 - 2014-01-15 19:31 - 00000000 __HDC H:\WINDOWS\$NtUninstallKB2914368$

2014-01-08 14:28 - 2014-01-08 14:28 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Kaspersky Internet Security

2014-01-08 14:27 - 2014-01-22 15:20 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab

2014-01-08 14:27 - 2014-01-08 14:40 - 00573536 _____ (Kaspersky Lab ZAO) H:\WINDOWS\system32\Drivers\klif.sys

2014-01-08 14:27 - 2014-01-08 14:27 - 00000000 ____D H:\Programme\Kaspersky Lab

2014-01-08 14:27 - 2013-06-08 20:18 - 00093280 _____ (Kaspersky Lab ZAO) H:\WINDOWS\system32\Drivers\klflt.sys

2014-01-04 15:17 - 2014-01-04 15:17 - 00000000 ____D H:\Programme\Tools&More

2014-01-04 15:17 - 2014-01-04 15:17 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Tools&More
 

==================== One Month Modified Files and Folders =======
 

2014-01-22 15:25 - 2014-01-22 15:25 - 00000000 ____D H:\FRST

2014-01-22 15:23 - 2010-10-11 18:05 - 01186036 _____ H:\WINDOWS\system32\PerfStringBackup.INI

2014-01-22 15:21 - 2008-04-14 13:00 - 00000720 _____ H:\WINDOWS\win.ini

2014-01-22 15:21 - 2008-04-14 13:00 - 00000227 _____ H:\WINDOWS\system.ini

2014-01-22 15:20 - 2014-01-08 14:27 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab

2014-01-22 15:20 - 2013-09-30 15:20 - 00000636 _____ H:\WINDOWS\Tasks\Check for updates (Spybot - Search & Destroy).job

2014-01-22 15:20 - 2010-10-16 09:40 - 00001084 _____ H:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-22 15:20 - 2010-10-11 17:23 - 00000000 ____D H:\Dokumente und Einstellungen\Tommy

2014-01-22 15:20 - 2010-10-11 17:17 - 01243251 _____ H:\WINDOWS\WindowsUpdate.log

2014-01-22 15:20 - 2008-04-14 13:00 - 00013646 _____ H:\WINDOWS\system32\wpa.dbl

2014-01-22 15:19 - 2010-11-06 18:11 - 00000157 ____N H:\WINDOWS\wiadebug.log

2014-01-22 15:19 - 2010-11-06 18:11 - 00000050 ____N H:\WINDOWS\wiaservc.log

2014-01-22 15:19 - 2010-10-11 17:21 - 00000006 ____H H:\WINDOWS\Tasks\SA.DAT

2014-01-22 15:18 - 2012-05-23 14:28 - 00000000 __HDC H:\WINDOWS\$NtUninstallKB2676562$

2014-01-22 15:17 - 2013-09-30 15:19 - 00065536 _____ H:\WINDOWS\system32\config\SpybotSD.evt

2014-01-22 15:17 - 2011-06-19 14:35 - 07288558 _____ H:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-606747145-1123561945-1801674531-1003-0.dat

2014-01-22 15:17 - 2011-04-04 18:11 - 00731110 _____ H:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

2014-01-22 15:17 - 2010-10-11 17:23 - 00000190 ___SH H:\Dokumente und Einstellungen\Tommy\ntuser.ini

2014-01-22 15:17 - 2010-10-11 17:21 - 00032338 ____N H:\WINDOWS\SchedLgU.Txt

2014-01-22 15:15 - 2013-09-30 15:20 - 00000608 _____ H:\WINDOWS\Tasks\Refresh immunization (Spybot - Search & Destroy).job

2014-01-22 15:06 - 2010-10-16 09:40 - 00001088 _____ H:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-22 14:43 - 2012-03-31 13:58 - 00000884 _____ H:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-01-21 20:34 - 2014-01-21 20:34 - 00442600 _____ H:\Dokumente und Einstellungen\Tommy\Anwendungsdaten\loadit.exe

2014-01-21 19:31 - 2010-10-11 20:08 - 00000000 ____D H:\Dokumente und Einstellungen\Tommy\Anwendungsdaten\vlc

2014-01-21 18:44 - 2013-10-12 15:43 - 00000000 ____D H:\WINDOWS\pss

2014-01-21 18:44 - 2010-10-11 17:23 - 00000000 ___RD H:\Dokumente und Einstellungen\Tommy\Startmenü\Programme\Autostart

2014-01-21 18:17 - 2013-09-30 15:18 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spyware Terminator

2014-01-21 18:13 - 2014-01-21 18:09 - 00000000 ____D H:\AdwCleaner

2014-01-21 18:13 - 2010-10-11 18:05 - 00000000 ___RD H:\Programme

2014-01-21 18:10 - 2014-01-21 18:10 - 00000000 ____D H:\WINDOWS\ERUNT

2014-01-21 18:05 - 2014-01-21 18:05 - 00000986 _____ H:\Dokumente und Einstellungen\Tommy\Desktop\Continue Zip Opener Installation.lnk

2014-01-21 17:54 - 2011-02-04 17:12 - 00000000 ____D H:\Dokumente und Einstellungen\Tommy\Anwendungsdaten\UseNeXT

2014-01-20 18:02 - 2010-10-11 17:16 - 00000000 ____D H:\WINDOWS\system32\Restore

2014-01-20 03:13 - 2014-01-19 12:38 - 00001024 ____H H:\WINDOWS\system32\config\elam.LOG

2014-01-19 12:38 - 2014-01-19 12:38 - 00262144 _____ H:\WINDOWS\system32\config\elam

2014-01-19 12:32 - 2011-02-04 22:19 - 00000116 _____ H:\WINDOWS\NeroDigital.ini

2014-01-19 12:32 - 2010-10-18 17:06 - 00145920 _____ H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-01-19 12:31 - 2010-11-06 17:52 - 00000349 _____ H:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI

2014-01-15 19:33 - 2013-08-31 18:32 - 00000000 ____D H:\WINDOWS\system32\MRT

2014-01-15 19:31 - 2014-01-15 19:31 - 00000000 __HDC H:\WINDOWS\$NtUninstallKB2914368$

2014-01-15 19:31 - 2010-10-12 05:21 - 83425928 _____ (Microsoft Corporation) H:\WINDOWS\system32\MRT.exe

2014-01-12 19:04 - 2010-11-07 12:44 - 00000000 ____D H:\Dokumente und Einstellungen\Tommy\Anwendungsdaten\dvdcss

2014-01-12 18:55 - 2010-10-11 17:23 - 00000000 ___HD H:\Dokumente und Einstellungen\Tommy\Netzwerkumgebung

2014-01-12 13:59 - 2010-10-18 09:18 - 00000000 ___RD H:\Dokumente und Einstellungen\Tommy\Eigene Dateien\Eigene Musik

2014-01-08 14:40 - 2014-01-08 14:27 - 00573536 _____ (Kaspersky Lab ZAO) H:\WINDOWS\system32\Drivers\klif.sys

2014-01-08 14:40 - 2013-10-17 15:47 - 00135776 _____ (Kaspersky Lab ZAO) H:\WINDOWS\system32\Drivers\kl1.sys

2014-01-08 14:40 - 2013-06-06 17:38 - 00144992 _____ (Kaspersky Lab ZAO) H:\WINDOWS\system32\Drivers\kneps.sys

2014-01-08 14:28 - 2014-01-08 14:28 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Kaspersky Internet Security

2014-01-08 14:28 - 2010-10-11 18:05 - 00000000 ___RD H:\Dokumente und Einstellungen\All Users\Startmenü\Programme

2014-01-08 14:27 - 2014-01-08 14:27 - 00000000 ____D H:\Programme\Kaspersky Lab

2014-01-08 14:11 - 2013-09-01 15:47 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira

2014-01-04 15:49 - 2010-10-17 18:57 - 00000000 ____D H:\Dokumente und Einstellungen\Tommy\Desktop\PC-DOKTOR

2014-01-04 15:17 - 2014-01-04 15:17 - 00000000 ____D H:\Programme\Tools&More

2014-01-04 15:17 - 2014-01-04 15:17 - 00000000 ____D H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Tools&More

2014-01-04 15:16 - 2010-10-18 16:56 - 00000000 ____D H:\WINDOWS\Downloaded Installations

2014-01-04 15:15 - 2013-07-04 10:17 - 00001857 _____ H:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Windows 7 Upgrade Advisor.lnk

2014-01-04 15:15 - 2013-07-04 10:17 - 00000000 ____D H:\Programme\Microsoft Windows 7 Upgrade Advisor

2014-01-01 15:20 - 2013-09-30 15:20 - 00000438 _____ H:\WINDOWS\Tasks\Scan the system (Spybot - Search & Destroy).job

2013-12-26 12:05 - 2010-10-11 18:04 - 04198888 _____ H:\WINDOWS\system32\FNTCACHE.DAT

2013-12-26 10:53 - 2011-04-04 17:04 - 00000000 ____D H:\Dokumente und Einstellungen\Tommy\Eigene Dateien\CyberLink
 

Some content of TEMP:

====================

H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Temp\ICReinstall_ZipOpenerSetup.exe

H:\Dokumente und Einstellungen\Tommy\Lokale Einstellungen\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

H:\Windows\explorer.exe

[2008-04-14 13:00] - [2008-04-14 13:00] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e 
 

H:\Windows\System32\winlogon.exe

[2008-04-14 13:00] - [2008-04-14 13:00] - 0513024 ____N (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a 
 

H:\Windows\System32\svchost.exe

[2008-04-14 13:00] - [2008-04-14 13:00] - 0014336 ____N (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366 
 

H:\Windows\System32\services.exe

[2008-04-14 13:00] - [2009-02-09 12:21] - 0111104 ____N (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc 
 

H:\Windows\System32\User32.dll

[2008-04-14 13:00] - [2008-04-14 13:00] - 0580096 ____N (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd 
 

H:\Windows\System32\userinit.exe

[2008-04-14 13:00] - [2008-04-14 13:00] - 0026624 ____N (Microsoft Corporation) 788f95312e26389d596c0fa55834e106 
 

H:\Windows\System32\rpcss.dll

[2008-04-14 13:00] - [2009-02-09 11:51] - 0401408 ____N (Microsoft Corporation) 3127afbf2c1ed0ab14a1bbb7aaecb85b 
 

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.

H:\Windows\System32\Drivers\volsnap.sys

[2008-04-14 13:00] - [2008-04-14 13:00] - 0053760 ____N (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d 
 
 

==================== End Of Log ============================

--- --- ---
FRST Additions Logfile:

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 22-01-2014

Ran by Tommy at 2014-01-22 15:25:28

Running from H:\Dokumente und Einstellungen\Tommy\Eigene Dateien\Downloads\Antivirus

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Kaspersky Internet Security (Disabled - Up to date) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security (Disabled) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
 

==================== Installed Programs ======================
 

2007 Microsoft Office Suite Service Pack 2 (SP2) (Version:  - Microsoft) Hidden

7-Zip 4.65 (Version:  - )

ACDSee 7.0 PowerPack (Version: 7.0.102 - ACD Systems Ltd.)

Acronis*True*Image*Home 2011 (Version: 14.0.6696 - Acronis)

Adobe After Effects CS4 (Version: 9 - Adobe Systems Incorporated)

Adobe After Effects CS4 (Version: 9 - Adobe Systems Incorporated) Hidden

Adobe After Effects CS4 Presets (Version: 9 - Adobe Systems Incorporated) Hidden

Adobe After Effects CS4 Third Party Content (Version: 9 - Adobe Systems Incorporated) Hidden

Adobe AIR (Version: 2.5.1.17730 - Adobe Systems Inc.)

Adobe AIR (Version: 2.5.1.17730 - Adobe Systems Inc.) Hidden

Adobe Anchor Service CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Audition 1.5 (Version: 1.5 - Adobe Systems)

Adobe Bridge CS4 (Version: 3 - Adobe Systems Incorporated) Hidden

Adobe CMaps CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Color - Photoshop Specific CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Color EU Recommended Settings CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Color JA Extra Settings CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Color NA Extra Settings CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Color Video Profiles AE CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Color Video Profiles CS CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Community Help (Version: 3.4.980 - Adobe Systems Incorporated.)

Adobe Community Help (Version: 3.4.980 - Adobe Systems Incorporated.) Hidden

Adobe Content Viewer (Version: 1.4.0 - Adobe Systems Incorporated)

Adobe Content Viewer (Version: 1.4.0 - Adobe Systems Incorporated) Hidden

Adobe CSI CS4 (Version: 1 - Adobe Systems Incorporated) Hidden

Adobe Default Language CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Dynamiclink Support (Version: 1 - Adobe Systems Incorporated) Hidden

Adobe ExtendScript Toolkit CS4 (Version: 3.0.0 - Adobe Systems Incorporated) Hidden

Adobe Extension Manager CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 10 Plugin (Version: 10.0.45.2 - Adobe Systems Incorporated)

Adobe Flash Player 11 ActiveX (Version: 11.9.900.170 - Adobe Systems Incorporated)

Adobe Fonts All (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe InDesign CS5.5 (Version: 7.5 - Adobe Systems Incorporated)

Adobe Linguistics CS4 (Version: 4.0.0 - Adobe Systems Incorporated) Hidden

Adobe Media Encoder CS4 (Version: 1.0 - Adobe Systems Incorporated) Hidden

Adobe Media Encoder CS4 Additional Exporter (Version: 1.0 - Adobe Systems Incorporated) Hidden

Adobe Media Encoder CS4 Exporter (Version: 1.0 - Adobe Systems Incorporated) Hidden

Adobe Media Encoder CS4 Importer (Version: 1.0 - Adobe Systems Incorporated) Hidden

Adobe MotionPicture Color Files CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Output Module (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe PDF Library Files CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

Adobe Photoshop CS4 (Version: 11.0 - Adobe Systems Incorporated)

Adobe Photoshop CS4 (Version: 11.0 - Adobe Systems Incorporated) Hidden

Adobe Photoshop CS4 Support (Version: 11.0 - Adobe Systems Incorporated) Hidden

Adobe Reader 9.5.4 - Deutsch (Version: 9.5.4 - Adobe Systems Incorporated)

Adobe Search for Help (Version: 1.0 - Adobe Systems Incorporated) Hidden

Adobe Service Manager Extension (Version: 1.0 - Adobe Systems Incorporated) Hidden

Adobe Setup (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Type Support CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

Adobe Update Manager CS4 (Version: 6.0.0 - Adobe Systems Incorporated) Hidden

Adobe WinSoft Linguistics Plugin (Version: 1.1 - Adobe Systems Incorporated) Hidden

Adobe XMP Panels CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

AdobeColorCommonSetCMYK (Version: 2.0 - Adobe Systems Incorporated) Hidden

AdobeColorCommonSetRGB (Version: 2.0 - Adobe Systems Incorporated) Hidden

Amazon MP3-Downloader 1.0.9 (Version:  - )

Ant Renamer (Version: 2.10.0 - Ant Software)

Autostart-Manager (Version: 6.02.0000 - Wirth IT Design )

AVM FRITZ!Box Dokumentation (Version:  - AVM Berlin)

Biet-O-Matic v2.14.8 (Version: 2.14.8 - BOM Development Team)

Browser Configuration Utility (Version: 1.1.18.0 - DeviceVM Inc.)

CCleaner (Version: 2.35 - Piriform)

Connect (Version: 1.0.0.1 - Adobe Systems Incorporated) Hidden

CyberLink PowerDVD 10 (Version: 10.0.2701.51 - CyberLink Corp.)

CyberLink PowerDVD 10 (Version: 10.0.2701.51 - CyberLink Corp.) Hidden

DVD Shrink 3.2 (Version:  - DVD Shrink)

DVD Shrink 3.2 deutsch (DeCSS-frei) (Version:  - DVD Shrink)

Ext2Fsd 0.48 (Version: 0.48 - Matt Wu)

FMS (Version:  - )

Free Audio CD Burner version 1.4.7 (Version:  - DVDVideoSoft Limited.)

Free YouTube to MP3 Converter version 3.12.16.1030 (Version: 3.12.16.1030 - DVDVideoSoft Ltd.)

Freemake Video Converter Version 4.1.1 (Version: 4.1.1 - Ellora Assets Corporation)

Gigabyte Raid Configurer (Version: 1.00.0001 - GIGABYTE Technologies, Inc.)

Google Chrome (Version: 32.0.1700.76 - Google Inc.)

Google Earth (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden

Google Toolbar for Internet Explorer (Version: 7.5.4805.320 - Google Inc.)

Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden

Gutscheinmieze - Toolbar (Version:  - )

HandBrake 0.9.6 (Version: 0.9.6 - )

Hotfix für Windows XP (KB2633952) (Version: 1 - Microsoft Corporation)

Hotfix für Windows XP (KB2779562) (Version: 1 - Microsoft Corporation)

Kaspersky Internet Security (Version: 14.0.0.4651 - Kaspersky Lab)

Kaspersky Internet Security (Version: 14.0.0.4651 - Kaspersky Lab) Hidden

Knoll Light Factory EZ Studio (Version:  - )

kuler (Version: 2.0 - Adobe Systems Incorporated) Hidden

Logitech MouseWare 9.80  (Version:  - )

Magic Bullet Looks Studio (Version:  - )

Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)

Microsoft .NET Framework 1.1 (Version:  - )

Microsoft .NET Framework 1.1 (Version: 1.1.4322 - Microsoft) Hidden

Microsoft .NET Framework 1.1 German Language Pack (Version: 1.1.4322 - Microsoft)

Microsoft .NET Framework 1.1 Security Update (KB2833941) (Version:  - )

Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30730 - Microsoft Corporation)

Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30730 - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30730 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft Office Access MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Enterprise 2007 (Version: 12.0.6425.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Home and Student 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Software Update for Web Folders  (German) 12 (Version: 12.0.6425.1000 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053 - Adobe) Hidden

Microsoft_VC90_ATL_x86 (Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_MFC_x86 (Version: 1.00.0000 - Adobe) Hidden

Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000 - Adobe) Hidden

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 6.0 Parser (Version: 6.00.3883.15 - Microsoft Corporation)

NEC Electronics USB 3.0 Host Controller Driver (Version: 1.0.18.0 - NEC Electronics Corporation)

NEC Electronics USB 3.0 Host Controller Driver (Version: 1.0.18.0 - NEC Electronics Corporation) Hidden

Nero 6 Enterprise Edition (Version:  - )

neroxml (Version: 1.0.0 - Nero AG) Hidden

No23 Recorder (Version: 2.1.0.3 - No23)

NVIDIA Display Control Panel (Version: 6.14.11.9775 - NVIDIA Corporation)

NVIDIA Drivers (Version: 1.10.61.39 - NVIDIA Corporation)

NVIDIA nView Desktop Manager (Version: 6.14.10.12565 - NVIDIA Corporation)

NVIDIA PhysX (Version: 9.10.0129 - NVIDIA Corporation)

ON_OFF Charge B10.0422.2 (Version: 1.00.0001 - GIGABYTE)

PDF Settings CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden

PDFCreator (Version: 0.9.9 - Frank Heindörfer, Philip Chinery)

Photoshop Camera Raw (Version: 5.0 - Adobe Systems Incorporated) Hidden

Pinnacle Instant DVD Recorder (Version: 2.00.088 - )

Pinnacle Studio 14 (Version: 14.0.0.7255 - Pinnacle Systems)

Pinnacle Studio Ultimate Collection Plugins (Version: 14.0.0.7255 - Pinnacle Systems)

Pinnacle Video Treiber (Version: 12.1.0.030 - Pinnacle Systems)

PowerDVD (Version:  - )

PowerQuest Drive Image 7.0 (Version: 7.00.0000 - PowerQuest)

PureSync (Version: 3.7.7 - Jumping Bytes) Hidden

PureSync 3.7.7 (Version: 3.7.7 - Jumping Bytes)

Realtek High Definition Audio Driver (Version: 5.10.0.6363 - Realtek Semiconductor Corp.)

Red Giant ToonIt Studio (Version:  - )

Sicherheitsupdate für Windows Internet Explorer 8 (KB2183461) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2360131) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2416400) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2482017) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2497640) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2510531) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2530548) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2544521) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2559049) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2586448) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2675157) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2699988) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2817183) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2862772) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2870699) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2879017) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2888505) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2898785) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB971961) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB981332) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB982381) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2584146) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2585542) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2598479) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2603381) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2618451) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2619339) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2620712) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2621440) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2624667) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2631813) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2633171) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2646524) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2653956) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2655992) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2659262) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2661637) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2676562) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2685939) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2686509) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2691442) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2695962) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2698365) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2705219-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2707511) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2712808) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2718523) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2719985) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2723135-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2727528) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2753842-v2) (Version: 2 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2757638) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2758857) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2770660) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2780091) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2802968) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2807986) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2808735) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2813170) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2813345) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2820197) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2820917) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2834886) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2845187) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2847311) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2849470) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2850851) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2850869) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2859537) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862152) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862330) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862335) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2864063) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2868038) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2868626) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2876217) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2876315) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2876331) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2883150) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2892075) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2893294) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2893984) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2898715) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2900986) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2914368) (Version: 1 - Microsoft Corporation)

Spybot - Search & Destroy (Version: 2.1.21 - Safer-Networking Ltd.)

Spyware Terminator 2012 (Version: 3.0.0.82 - Crawler.com)

Studio 11 (Version: 11.0 - Pinnacle Systems)

Studio 11 (Version: 11.0.0.0 - Pinnacle Systems) Hidden

Suite Shared Configuration CS4 (Version: 1.0 - Adobe Systems Incorporated) Hidden

TeamViewer 8 (Version: 8.0.22298 - TeamViewer)

Text-To-Speech-Runtime (Version: 1.0.0.0 - Magix Development GmbH)

Trapcode 3DStroke Studio (Version:  - )

Trapcode Particular Studio (Version:  - )

Trapcode Shine Studio (Version:  - )

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)

Update for Microsoft Office Word 2007 (KB974631) (Version:  - Microsoft)

Update für Windows Internet Explorer 8 (KB2362765) (Version: 1 - Microsoft Corporation)

Update für Windows Internet Explorer 8 (KB976662) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2661254-v2) (Version: 2 - Microsoft Corporation)

Update für Windows XP (KB2718704) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2736233) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2749655) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2863058) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2904266) (Version: 1 - Microsoft Corporation)

UseNeXT (Version:  - Tangysoft Ltd.)

UseNeXT by Tangysoft (Version:  - Tangysoft Ltd.)

VLC media player 1.0.5 (Version: 1.0.5 - VideoLAN Team)

WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden

Windows 7 Upgrade Advisor (Version: 2.0.5000.0 - Microsoft Corporation)

Windows Genuine Advantage Notifications (KB905474) (Version: 1.9.0040.0 - Microsoft Corporation)

Windows Internet Explorer 8 (Version: 20090308.140743 - Microsoft Corporation)

Windows Media Format 11 runtime (Version:  - )

Windows Media Player 11 (Version:  - )

WinRAR Archivierer (Version:  - )

Wireshark 1.10.2 (32-bit) (Version: 1.10.2 - The Wireshark developer community, Wireshark · Go Deep.)

Wisdom-soft AutoScreenRecorder 3.1 Free (Version:  - Wisdom Software Inc.)

Yahoo! Desktop Login (Version: 1.00.0001 - Pinnacle Systems) Hidden
 

==================== Restore Points  =========================
 

25-10-2013 03:53:14 Systemprüfpunkt

26-10-2013 04:36:01 Systemprüfpunkt

27-10-2013 05:34:42 Systemprüfpunkt

28-10-2013 11:48:41 Systemprüfpunkt

29-10-2013 12:25:59 Systemprüfpunkt

30-10-2013 13:19:22 Systemprüfpunkt

07-11-2013 20:38:05 Systemprüfpunkt

09-11-2013 04:04:44 Systemprüfpunkt

10-11-2013 07:38:12 Systemprüfpunkt

11-11-2013 08:50:09 Systemprüfpunkt

12-11-2013 10:38:10 Systemprüfpunkt

13-11-2013 13:38:10 Systemprüfpunkt

14-11-2013 14:26:09 Systemprüfpunkt

16-11-2013 07:48:53 Systemprüfpunkt

17-11-2013 11:08:08 Systemprüfpunkt

18-11-2013 11:50:41 Systemprüfpunkt

19-11-2013 14:02:43 Systemprüfpunkt

19-11-2013 17:39:08 Software Distribution Service 3.0

21-11-2013 03:04:30 Systemprüfpunkt

22-11-2013 07:05:58 Systemprüfpunkt

23-11-2013 10:18:23 Systemprüfpunkt

24-11-2013 10:23:11 Systemprüfpunkt

25-11-2013 12:43:27 Systemprüfpunkt

26-11-2013 15:48:49 Systemprüfpunkt

27-11-2013 17:03:23 Systemprüfpunkt

28-11-2013 17:15:23 Systemprüfpunkt

29-11-2013 18:46:54 Systemprüfpunkt

30-11-2013 19:11:05 Systemprüfpunkt

01-12-2013 22:27:49 Systemprüfpunkt

02-12-2013 22:42:12 Systemprüfpunkt

03-12-2013 23:39:48 Systemprüfpunkt

05-12-2013 00:03:48 Systemprüfpunkt

06-12-2013 03:11:58 Systemprüfpunkt

07-12-2013 03:45:27 Systemprüfpunkt

08-12-2013 04:27:48 Systemprüfpunkt

09-12-2013 16:22:54 Systemprüfpunkt

10-12-2013 19:04:35 Systemprüfpunkt

11-12-2013 21:35:06 Systemprüfpunkt

12-12-2013 23:41:05 Systemprüfpunkt

14-12-2013 00:16:43 Systemprüfpunkt

15-12-2013 01:04:34 Systemprüfpunkt

16-12-2013 01:24:44 Systemprüfpunkt

17-12-2013 03:41:32 Systemprüfpunkt

17-12-2013 18:24:58 Software Distribution Service 3.0

18-12-2013 18:41:34 Systemprüfpunkt

19-12-2013 22:17:09 Systemprüfpunkt

20-12-2013 22:29:10 Systemprüfpunkt

21-12-2013 22:54:03 Systemprüfpunkt

22-12-2013 23:17:24 Systemprüfpunkt

23-12-2013 23:41:31 Systemprüfpunkt

25-12-2013 02:46:40 Systemprüfpunkt

26-12-2013 03:30:01 Systemprüfpunkt

27-12-2013 04:20:23 Systemprüfpunkt

28-12-2013 05:44:15 Systemprüfpunkt

29-12-2013 11:57:19 Systemprüfpunkt

30-12-2013 12:22:07 Systemprüfpunkt

31-12-2013 13:27:49 Systemprüfpunkt

01-01-2014 16:57:14 Systemprüfpunkt

02-01-2014 18:56:25 Systemprüfpunkt

03-01-2014 20:09:06 Systemprüfpunkt

04-01-2014 14:17:06 Autostart-Manager wird installiert

05-01-2014 15:14:39 Systemprüfpunkt

06-01-2014 17:21:09 Systemprüfpunkt

07-01-2014 19:09:07 Systemprüfpunkt

08-01-2014 13:16:18 Ask Toolbar wurde entfernt.

08-01-2014 13:16:34 Avira SearchFree Toolbar plus Web Protection wird entfernt

10-01-2014 00:29:19 Systemprüfpunkt

11-01-2014 02:30:04 Systemprüfpunkt

12-01-2014 02:54:04 Systemprüfpunkt

13-01-2014 03:10:25 Systemprüfpunkt

14-01-2014 05:30:04 Systemprüfpunkt

15-01-2014 06:18:04 Systemprüfpunkt

15-01-2014 18:31:09 Software Distribution Service 3.0

16-01-2014 21:18:53 Systemprüfpunkt

17-01-2014 21:42:52 Systemprüfpunkt

18-01-2014 22:18:53 Systemprüfpunkt

20-01-2014 04:37:19 Systemprüfpunkt

20-01-2014 17:05:10 Wiederherstellungsvorgang

20-01-2014 21:11:57 Wiederherstellungsvorgang

21-01-2014 15:22:17 Wiederherstellungsvorgang
 

==================== Hosts content: ==========================
 

2008-04-14 13:00 - 2011-08-07 08:23 - 00000850 ____N H:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1       localhost

127.0.0.1 activate.adobe.com
 
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: H:\WINDOWS\Tasks\Adobe Flash Player Updater.job => H:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: H:\WINDOWS\Tasks\Check for updates (Spybot - Search & Destroy).job => H:\Programme\Spybot - Search & Destroy 2\SDUpdate.exe

Task: H:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => H:\Programme\Google\Update\GoogleUpdate.exe

Task: H:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => H:\Programme\Google\Update\GoogleUpdate.exe

Task: H:\WINDOWS\Tasks\Refresh immunization (Spybot - Search & Destroy).job => H:\Programme\Spybot - Search & Destroy 2\SDImmunize.exe

Task: H:\WINDOWS\Tasks\Scan the system (Spybot - Search & Destroy).job => H:\Programme\Spybot - Search & Destroy 2\SDScan.exe
 

==================== Loaded Modules (whitelisted) =============
 

2010-10-11 18:57 - 2001-10-28 15:42 - 00116224 ____N () H:\WINDOWS\system32\pdfcmnnt.dll

2013-06-17 12:35 - 2013-06-17 12:35 - 00478400 _____ () H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\dblite.dll

2013-05-08 14:52 - 2013-05-08 14:52 - 01270464 _____ () H:\Programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kpcengine.2.3.dll

2009-02-27 16:41 - 2009-02-27 16:41 - 00311296 _____ () H:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU

2010-10-18 17:33 - 2005-07-31 20:10 - 00125952 _____ () H:\Programme\WinRAR\rarext.dll

2013-09-30 15:19 - 2013-05-16 09:55 - 00113496 _____ () H:\Programme\Spybot - Search & Destroy 2\snlThirdParty150.bpl

2013-09-30 15:19 - 2013-05-16 09:55 - 00416600 _____ () H:\Programme\Spybot - Search & Destroy 2\DEC150.bpl

2010-10-11 18:46 - 2010-04-21 22:37 - 00473704 _____ () H:\Programme\NVIDIA Corporation\nView\nvshell.dll

2008-04-14 13:00 - 2008-04-14 13:00 - 00014336 ____N () H:\WINDOWS\system32\msdmo.dll

2014-01-16 11:30 - 2014-01-11 11:29 - 04055320 _____ () H:\Programme\Google\Chrome\Application\32.0.1700.76\pdf.dll

2014-01-16 11:30 - 2014-01-11 11:29 - 00399640 _____ () H:\Programme\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll

2014-01-16 11:30 - 2014-01-11 11:28 - 01634584 _____ () H:\Programme\Google\Chrome\Application\32.0.1700.76\ffmpegsumo.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot => "AlternateShell"=""
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/16/2013 04:55:59 PM) (Source: Application Hang) (User: )

Description: Stillstehende Anwendung vlc.exe, Version 1.0.5.0, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 

Error: (12/16/2013 04:54:21 PM) (Source: Application Hang) (User: )

Description: Fehlerhafter Speicherbereich 1687780565.
 

Error: (12/16/2013 04:54:14 PM) (Source: Application Hang) (User: )

Description: Stillstehende Anwendung vlc.exe, Version 1.0.5.0, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 

Error: (12/09/2013 04:50:57 PM) (Source: Application Hang) (User: )

Description: Fehlerhafter Speicherbereich 1687780565.
 

Error: (12/09/2013 04:50:28 PM) (Source: Application Hang) (User: )

Description: Stillstehende Anwendung vlc.exe, Version 1.0.5.0, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 

Error: (11/25/2013 11:54:24 AM) (Source: Application Error) (User: )

Description: Fehlerhafter Speicherbereich -409974893.

Nach der 802.1x-Authentifizierung resultierte der WEP-Schlüsselaustausch nicht in einer sicheren Verbindung. Die aktuelle Einstellung wurde als fehlerhaft markiert, und die Drahtlosverbindung wird getrennt.
 

Error: (11/25/2013 11:54:19 AM) (Source: Application Error) (User: )

Description: Fehlgeschlagene Anwendung WPFFontCache_v0400.exe, Version 4.0.30319.1014, fehlgeschlagenes Modul MSVCR100_CLR0400.dll, Version 10.0.30319.1, Fehleradresse 0x0008f33a.

Das medienspezifische Ereignis für [WPFFontCache_v0400.exe!ws!] wird verarbeitet.
 

Error: (10/30/2013 06:46:35 PM) (Source: Application Error) (User: )

Description: Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0x04b40fef.

Das medienspezifische Ereignis für [explorer.exe!ws!] wird verarbeitet.
 

Error: (10/22/2013 05:40:59 PM) (Source: Application Hang) (User: )

Description: Stillstehende Anwendung vlc.exe, Version 1.0.5.0, Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 

Error: (10/15/2013 06:20:49 AM) (Source: .NET Runtime Optimization Service) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown
 
 

System errors:

=============

Error: (01/22/2014 03:07:04 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 02:17:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 02:17:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 02:17:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 02:17:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 02:17:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 02:16:21 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 01:44:11 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 01:44:11 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 

Error: (01/22/2014 01:43:18 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "RAS-Verbindungsverwaltung" ist vom Dienst "Telefonie" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 

%%1058
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 24%

Total physical RAM: 3582.42 MB

Available physical RAM: 2720.72 MB

Total Pagefile: 5458.06 MB

Available Pagefile: 4743.35 MB

Total Virtual: 2047.88 MB

Available Virtual: 1955.01 MB
 

==================== Drives ================================
 

Drive c: (Intenso) (Removable) (Total:7.55 GB) (Free:7.43 GB) FAT32

Drive h: (Platte 0 - SYSTEM) (Fixed) (Total:931.5 GB) (Free:884.65 GB) NTFS ==>[Drive with boot components (Windows XP)]

Drive m: (Platte 3 - UseNext) (Fixed) (Total:1863.01 GB) (Free:343.35 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 277B78D3)

Partition 1: (Not Active) - (Size=-198626966528) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 932 GB) (Disk ID: FB64FB64)

Partition 1: (Active) - (Size=932 GB) - (Type=07 NTFS)
 

========================================================

Disk: 6 (Size: 8 GB) (Disk ID: 72F45E04)

Partition 1: (Not Active) - (Size=8 GB) - (Type=0B)
 

==================== End Of Log ============================

--- --- ---

Hallo

auf dem Desktop alles wieder Sichtbar - die Meldung obession.co.ua/loader/loadit.exe
von kaspersky mommt auch nicht mehr. Sieht gut aus "Vielen Dank für die Hilfe"

Hier noch der .txt

Combofix Logfile:

Code:

ComboFix 14-01-22.01 - Tommy 23.01.2014  11:46:23.1.8 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3582.2657 [GMT 1:00]

ausgeführt von:: h:\dokumente und einstellungen\Tommy\Desktop\ComboFix.exe

AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

h:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP

h:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\PostBuild.exe

h:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}\Setup.exe

h:\dokumente und einstellungen\Tommy\Anwendungsdaten\loadit.exe

h:\dokumente und einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\lame_enc.dll

h:\dokumente und einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\no23xwrapper.dll

h:\dokumente und einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\ogg.dll

h:\dokumente und einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\vorbis.dll

h:\dokumente und einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\vorbisenc.dll

h:\dokumente und einstellungen\Tommy\Lokale Einstellungen\Anwendungsdaten\vorbisfile.dll

h:\windows\system32\SET5F.tmp

h:\windows\system32\SET6B.tmp

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_NPF

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-12-23 bis 2014-01-23  ))))))))))))))))))))))))))))))

.

.

2014-01-22 14:25 . 2014-01-22 14:25        --------        d-----w-        H:\FRST

2014-01-21 17:10 . 2014-01-21 17:10        --------        d-----w-        h:\windows\ERUNT

2014-01-21 17:09 . 2014-01-21 17:13        --------        d-----w-        H:\AdwCleaner

2014-01-08 13:27 . 2014-01-23 11:53        --------        d-----w-        h:\dokumente und einstellungen\All Users\Anwendungsdaten\Kaspersky Lab

2014-01-08 13:27 . 2014-01-08 13:27        --------        d-----w-        h:\programme\Kaspersky Lab

2014-01-08 13:27 . 2013-06-08 19:18        93280        ----a-w-        h:\windows\system32\drivers\klflt.sys

2014-01-04 14:17 . 2014-01-04 14:17        --------        d-----w-        h:\programme\Tools&More

2013-12-26 09:56 . 2014-01-04 14:00        --------        d-----r-        h:\dokumente und einstellungen\Tommy\Favoriten

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-01-08 13:40 . 2013-06-06 16:38        144992        ----a-w-        h:\windows\system32\drivers\kneps.sys

2014-01-08 13:40 . 2013-10-17 14:47        135776        ----a-w-        h:\windows\system32\drivers\kl1.sys

2013-12-10 23:43 . 2012-03-31 12:58        692616        ----a-w-        h:\windows\system32\FlashPlayerApp.exe

2013-12-10 23:43 . 2011-05-28 16:16        71048        ----a-w-        h:\windows\system32\FlashPlayerCPLApp.cpl

2013-11-27 20:21 . 2008-04-14 12:00        40960        ------w-        h:\windows\system32\drivers\ndproxy.sys

2013-11-13 02:59 . 2008-04-14 12:00        150528        ------w-        h:\windows\system32\imagehlp.dll

2013-11-07 05:38 . 2008-04-14 12:00        591360        ----a-w-        h:\windows\system32\rpcrt4.dll

2013-11-06 01:36 . 2008-05-05 05:25        8192        ----a-w-        h:\windows\system32\xpsp4res.dll

2013-10-30 02:51 . 2008-04-14 12:00        1879168        ------w-        h:\windows\system32\win32k.sys

2013-10-29 07:57 . 2008-04-14 12:00        920064        ----a-w-        h:\windows\system32\wininet.dll

2013-10-29 07:57 . 2008-04-14 12:00        43520        ------w-        h:\windows\system32\licmgr10.dll

2013-10-29 07:57 . 2008-04-14 12:00        1469440        ------w-        h:\windows\system32\inetcpl.cpl

2013-10-29 07:57 . 2008-04-14 12:00        18944        ------w-        h:\windows\system32\corpol.dll

2013-10-29 00:45 . 2008-04-14 12:00        385024        ------w-        h:\windows\system32\html.iec

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ccleaner"="h:\programme\CCleaner\ccleaner.exe" [2010-08-24 1779512]

"swg"="h:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-10-16 39408]

"AutoStart-Manager"="h:\programme\Tools&More\Autostart-Manager\AutoStart-Manager.exe" [2012-11-27 409600]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpywareTerminatorUpdater"="h:\programme\Spyware Terminator\SpywareTerminatorUpdate.exe" [2013-04-03 3684488]

"SpywareTerminatorShield"="h:\programme\Spyware Terminator\SpywareTerminatorShield.exe" [2013-04-03 2777736]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0sdnclean.exe\0\0h:\dokume~1\ALLUSE~1\ANWEND~1\SPYWAR~1\st_rsdel.exe \??\H:\Dokumente

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\36X Raid Configurer]

2010-01-19 02:31        1976944        ------w-        h:\windows\system32\xRaidSetup.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]

2011-02-01 19:53        391232        ----a-w-        h:\programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2013-04-04 21:06        958576        ----a-w-        h:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-12-19 14:39        41208        ----a-w-        h:\programme\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5.5ServiceManager]

2011-01-12 06:08        1523360        ----a-w-        h:\programme\Gemeinsame Dateien\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

2008-04-14 12:00        15360        ------w-        h:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriveTheLife]

2010-10-11 19:55        3236744        ----a-w-        h:\programme\DriveTheLife\DriveTheLife.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2008-10-25 09:44        31072        ----a-w-        h:\programme\Microsoft Office\Office12\GrooveMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2005-02-17 05:15        221184        ----a-w-        h:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2005-02-17 05:15        81920        ----a-w-        h:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]

2010-01-19 02:27        43632        ------r-        h:\windows\RaidTool\xInsIDE.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList]

2007-03-21 13:41        145496        ----a-w-        h:\programme\Pinnacle\Studio 11\LaunchList2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]

2003-12-11 07:50        20992        ------w-        h:\windows\LOGI_MWX.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 10:50        155648        ------w-        h:\windows\system32\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NUSB3MON]

2009-11-20 11:17        106496        ----a-w-        h:\programme\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2010-04-28 15:47        13671016        ------w-        h:\windows\system32\nvcpl.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

2010-04-28 15:47        110696        ------w-        h:\windows\system32\nvmctray.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

2010-04-21 21:37        1657448        ----a-w-        h:\programme\NVIDIA Corporation\nView\nwiz.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PureSync]

2013-08-07 17:36        907808        ----a-w-        h:\programme\PureSync\PureSyncTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

2011-04-14 11:36        20053608        ----a-w-        h:\windows\RTHDCPL.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SAOB Monitor]

2010-11-16 02:33        2570688        ----a-w-        h:\programme\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]

2013-07-25 09:19        5624784        ----a-w-        h:\programme\Spybot - Search & Destroy 2\SDTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]

2010-02-19 12:37        517096        ----a-w-        h:\programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]

2011-02-01 19:53        5583056        ----a-w-        h:\programme\Acronis\TrueImageHome\TrueImageMonitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]

2007-02-20 09:07        199752        ----a-w-        h:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"TapiSrv"=3 (0x3)

"ST2012_Svc"=2 (0x2)

"SDUpdateService"=2 (0x2)

"SDScannerService"=2 (0x2)

"CltMngSvc"=2 (0x2)

"nvsvc"=2 (0x2)

"GEARSecurity"=2 (0x2)

"Themes"=2 (0x2)

"BCUService"=2 (0x2)

"APNMCP"=2 (0x2)

"AcrSch2Svc"=2 (0x2)

"afcdpsrv"=2 (0x2)

"FontCache3.0.0.0"=3 (0x3)

"WMPNetworkSvc"=3 (0x3)

"idsvc"=3 (0x3)

"VSS"=3 (0x3)

"dmadmin"=3 (0x3)

"RasAuto"=3 (0x3)

"V2i Protector"=2 (0x2)

"UPS"=3 (0x3)

"upnphost"=3 (0x3)

"SwitchBoard"=3 (0x3)

"SDWSCService"=2 (0x2)

"rpcapd"=3 (0x3)

"ose"=3 (0x3)

"mnmsrvc"=3 (0x3)

"napagent"=3 (0x3)

"Microsoft Office Groove Audit Service"=3 (0x3)

"odserv"=3 (0x3)

"ImapiService"=3 (0x3)

"gupdatem"=3 (0x3)

"gupdate"=2 (0x2)

"gusvc"=3 (0x3)

"FLEXnet Licensing Service"=3 (0x3)

"MSDTC"=3 (0x3)

"Dot3svc"=3 (0x3)

"AppleChargerSrv"=3 (0x3)

"AppMgmt"=3 (0x3)

"aspnet_state"=3 (0x3)

"PCLEPCI"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"h:\\Programme\\DriveTheLife\\DriveTheLife.exe"=

"h:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"h:\\Programme\\Pinnacle\\Studio 11\\programs\\RM.exe"=

"h:\\Programme\\Pinnacle\\Studio 11\\programs\\Studio.exe"=

"h:\\Programme\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=

"h:\\Programme\\Pinnacle\\Studio 11\\programs\\umi.exe"=

"h:\\Programme\\Pinnacle\\Studio 14\\Programs\\RM.exe"=

"h:\\Programme\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=

"h:\\Programme\\Pinnacle\\Studio 14\\Programs\\umi.exe"=

"h:\\Programme\\VideoLAN\\VLC\\vlc.exe"=

"h:\\Programme\\CyberLink\\PowerDVD10\\PowerDVD10.exe"=

"h:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"h:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"h:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=

"h:\\Programme\\Spyware Terminator\\SpywareTerminator.exe"=

"h:\\Programme\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

"h:\\Programme\\Spybot - Search & Destroy 2\\SDTray.exe"=

"h:\\Programme\\Spybot - Search & Destroy 2\\SDFSSvc.exe"=

"h:\\Programme\\Spybot - Search & Destroy 2\\SDUpdate.exe"=

"h:\\Programme\\Spybot - Search & Destroy 2\\SDUpdSvc.exe"=

"h:\\Programme\\TeamViewer\\Version8\\TeamViewer.exe"=

"h:\\Programme\\TeamViewer\\Version8\\TeamViewer_Service.exe"=

"h:\\Programme\\Spybot - Search & Destroy 2\\SDFiles.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5353:TCP"= 5353:TCP:Adobe CSI CS4

.

R0 PQV2i;PQV2i;h:\windows\system32\drivers\PQV2i.sys [03.06.2003 14:52 123957]

R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);h:\windows\system32\drivers\tdrpm273.sys [28.05.2011 17:09 752128]

R1 AppleCharger;AppleCharger;h:\windows\system32\drivers\AppleCharger.sys [11.10.2010 18:41 19496]

R1 Ext2Fsd;Linux ext2 file system driver;h:\windows\system32\drivers\ext2fsd.sys [04.07.2012 16:34 651264]

R1 klpd;klpd;h:\windows\system32\drivers\klpd.sys [12.04.2013 15:34 14432]

R1 kltdi;kltdi;h:\windows\system32\drivers\kltdi.sys [14.05.2013 17:34 45024]

R1 kneps;kneps;h:\windows\system32\drivers\kneps.sys [06.06.2013 17:38 144992]

R1 PQIMount;PQIMount;h:\windows\system32\drivers\PQIMount.sys [03.06.2003 14:52 46900]

R1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;h:\windows\system32\drivers\sp_rsdrv2.sys [30.09.2013 15:18 32768]

R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2011/04/04 17:53];h:\programme\CyberLink\PowerDVD10\NavFilter\000.fcl [01.03.2011 09:57 87536]

R2 TeamViewer8;TeamViewer 8;h:\programme\TeamViewer\Version8\TeamViewer_Service.exe [25.08.2013 17:12 5087584]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;h:\windows\system32\drivers\klim5.sys [19.04.2013 11:44 36448]

R3 klkbdflt;Kaspersky Lab KLKBDFLT;h:\windows\system32\drivers\klkbdflt.sys [17.10.2013 15:47 24160]

R3 klmouflt;Kaspersky Lab KLMOUFLT;h:\windows\system32\drivers\klmouflt.sys [17.10.2013 15:47 24672]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;h:\windows\system32\drivers\nusb3hub.sys [20.11.2009 12:15 58880]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;h:\windows\system32\drivers\nusb3xhc.sys [20.11.2009 12:15 137728]

S0 cerc6;cerc6; [x]

S0 lwvjpl;lwvjpl;h:\windows\system32\drivers\afsydsfh.sys --> h:\windows\system32\drivers\afsydsfh.sys [?]

S3 afcdp;afcdp;h:\windows\system32\drivers\afcdp.sys [28.05.2011 17:09 167968]

S3 Ambfilt;Ambfilt;h:\windows\system32\drivers\Ambfilt.sys [11.10.2010 18:38 1691480]

S3 IDDRV;IDDRV;\??\h:\programme\DriveTheLife\iodrv.sys --> h:\programme\DriveTheLife\iodrv.sys [?]

S3 TRIDCap;AVerMedia service;h:\windows\system32\drivers\AVerTM62.sys [29.06.2012 11:53 2637696]

S3 WDC_SAM;WD SCSI Pass Thru driver;h:\windows\system32\DRIVERS\wdcsam.sys --> h:\windows\system32\DRIVERS\wdcsam.sys [?]

S4 afcdpsrv;Acronis Nonstop Backup-Dienst;h:\programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe [28.05.2011 17:09 3246040]

S4 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]

S4 SDScannerService;Spybot-S&D 2 Scanner Service;h:\programme\Spybot - Search & Destroy 2\SDFSSvc.exe [30.09.2013 15:19 1817560]

S4 SDUpdateService;Spybot-S&D 2 Updating Service;h:\programme\Spybot - Search & Destroy 2\SDUpdSvc.exe [30.09.2013 15:19 1033688]

S4 SDWSCService;Spybot-S&D 2 Security Center Service;h:\programme\Spybot - Search & Destroy 2\SDWSCSvc.exe [30.09.2013 15:19 171928]

S4 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;h:\programme\Spyware Terminator\st_rsser.exe [30.09.2013 15:18 587912]

S4 SwitchBoard;SwitchBoard;h:\programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe [19.02.2010 12:37 517096]

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-01-16 10:29        1211672        ----a-w-        h:\programme\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-01-23 h:\windows\Tasks\Adobe Flash Player Updater.job

- h:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 23:43]

.

2014-01-23 h:\windows\Tasks\Check for updates (Spybot - Search & Destroy).job

- h:\programme\Spybot - Search & Destroy 2\SDUpdate.exe [2013-09-30 08:58]

.

2014-01-23 h:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- h:\programme\Google\Update\GoogleUpdate.exe [2010-10-16 08:40]

.

2014-01-23 h:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- h:\programme\Google\Update\GoogleUpdate.exe [2010-10-16 08:40]

.

2014-01-22 h:\windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job

- h:\programme\Spybot - Search & Destroy 2\SDImmunize.exe [2013-09-30 08:57]

.

2014-01-01 h:\windows\Tasks\Scan the system (Spybot - Search & Destroy).job

- h:\programme\Spybot - Search & Destroy 2\SDScan.exe [2013-09-30 08:58]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://google.de/

IE: Free YouTube Download - h:\dokumente und einstellungen\Tommy\Anwendungsdaten\DVDVideoSoftIEHelpers\freeytvdownloader.htm

IE: Free YouTube to Mp3 Converter - h:\dokumente und einstellungen\Tommy\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft &Excel exportieren - h:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - h:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Zu Anti-Banner hinzufügen - h:\programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ie_banner_deny.htm

TCP: DhcpNameServer = 192.168.178.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Notify-SDWinLogon - SDWinLogon.dll

MSConfigStartUp-ApnTBMon - h:\programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

MSConfigStartUp-BCU - h:\programme\DeviceVM\Browser Configuration Utility\BCU.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2014-01-23 12:53

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]

"ImagePath"="\??\h:\programme\CyberLink\PowerDVD10\NavFilter\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@h:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="h:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'explorer.exe'(3760)

h:\programme\TeamViewer\Version8\tv_w32.dll

h:\windows\system32\msi.dll

h:\windows\system32\webcheck.dll

h:\windows\system32\WPDShServiceObj.dll

h:\windows\system32\PortableDeviceTypes.dll

h:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

h:\programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe

h:\programme\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe

h:\programme\teamviewer\version8\TeamViewer.exe

h:\programme\Google\Update\1.3.22.3\GoogleCrashHandler.exe

h:\programme\TeamViewer\Version8\tv_w32.exe

h:\programme\teamviewer\version8\TeamViewer_Desktop.exe

h:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-01-23  12:57:52 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-01-23 11:57

.

Vor Suchlauf: 9 Verzeichnis(se), 949.767.884.800 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 950.132.604.928 Bytes frei

.

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[Boot Loader]

Timeout=2

Default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[Operating Systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

c:\$win_nt$.~bt\BOOTSECT.DAT="Microsoft Windows XP Professional Setup"

.

- - End Of File - - E6C1AC18DB802F350CF5D32FA668DEA8

--- --- ---
8F558EB6672622401DA993E1E865C861