Trojaner/Rootkit TR/Agent.37888.248 in C:\WINDOWS\system32\drivers\a127b2c0fb888938.sys
Liste der Anhänge anzeigen (Anzahl: 1) Hey, ich habe einen Virus auf meinem Rechner :heulen:
Mein Avira Regenschirm war vor 3 Tagen eingeklappt (Echtzeitscanner) und lässt sich seitdem nicht mehr aktivieren. Habe Avira neu installiert ohne das alte zu löschen. Jetzt kann ich weder Avira neu installieren noch löschen. Habe daraufhin mal den Luke Walker drüber laufen lassen, welcher ein Trojaner
(TR/Agent.37888.248) erkannt hat.
Der Virus/Die Datei wird zwar von diversen Anti-Viren/Trojaner/Rootkit -Programmen gefunden, doch kann nicht von ihnen gelöscht werden (auch nicht im abgesicherten Modus). Er bleibt einfach da und die Programme zeigen Fehlermeldungen oder hängen sich auf.
Der Pfad des Virus ist
C:\WINDOWS\system32\drivers\a127b2c0fb888938.sys
Datei wurde erstellt am 23.Juni um 22:56Uhr, zu der Zeit war ich auf der Seite hxxp://www.kanope.de/ascentil57.html und hatte Spotify laufen ( glaube aber nicht, dass das etwas damit zu tun hat)
hier noch was sonstige Antiviren-Programme ausgespuckt haben, falls es euch hilft
HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938
Image Path
C:\Dokumente und Einstellungen\marc\Recent
C:\WINDOWS\system32\DRIVERS\TrufosAlt.sys
Necurs rootkit
Connections Tray
Habe XP, bis jetzt funktioniert alles normal bis auf Avira, wäre euch dankbar wenn ihr mir helfen könntet:)
Jetzt meine Logs
defogger_disable Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:15 on 26/06/2014 (Änö)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Unable to read a127b2c0fb888938.sys
Unable to read tdtcp.sys
Unable to read termdd.sys
Unable to read tosdvd.sys
Unable to read tsbvcap.sys
Unable to read tunmp.sys
Unable to read uagp35.sys
Unable to read udfs.sys
Unable to read update.sys
Unable to read usb8023.sys
Unable to read usb8023x.sys
Unable to read usbaapl.sys
Unable to read USBAUDIO.sys
Unable to read usbcamd.sys
Unable to read usbcamd2.sys
Unable to read usbccgp.sys
Unable to read usbd.sys
Unable to read usbehci.sys
Unable to read usbhub.sys
Unable to read usbintel.sys
Unable to read usbport.sys
Unable to read usbprint.sys
Unable to read usbscan.sys
Unable to read usbser.sys
Unable to read usbser_lowerflt.sys
Unable to read usbser_lowerfltj.sys
Unable to read USBSTOR.SYS
Unable to read usbuhci.sys
Unable to read usbvideo.sys
Unable to read vdmindvd.sys
Unable to read vga.sys
Unable to read viaagp.sys
Unable to read videoprt.sys
Unable to read volsnap.sys
Unable to read w29n51.sys
Unable to read wacompen.sys
Unable to read wadv07nt.sys
Unable to read wadv08nt.sys
Unable to read wadv09nt.sys
Unable to read wadv11nt.sys
Unable to read wanarp.sys
Unable to read watv06nt.sys
Unable to read watv10nt.sys
Unable to read wdf01000.sys
Unable to read wdfldr.sys
Unable to read wdmaud.sys
Unable to read wmilib.sys
Unable to read wpdusb.sys
Unable to read ws2ifsl.sys
Unable to read WSTCODEC.SYS
Unable to read WudfPf.sys
Unable to read WudfRd.sys
-=E.O.F=-
FRST (normaler Modus)
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-06-2014
Ran by Änö (administrator) on MARC-VLEJ7MNMMR on 26-06-2014 23:18:14
Running from C:\Dokumente und Einstellungen\marc\Desktop
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 6
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(Ralink Technology, Corp.) C:\Programme\Tenda\Common\RaRegistry.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\My Avira\Avira.OE.Systray.exe
(Spotify Ltd) C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Spotify\Data\SpotifyWebHelper.exe
(Hewlett-Packard Co.) C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
(Hewlett-Packard) C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
(Hewlett-Packard Co.) C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
(Hewlett-Packard Co.) C:\Programme\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] => C:\Programme\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [Avira Systray] => C:\Programme\Avira\My Avira\Avira.OE.Systray.exe [183376 2014-05-14] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [TrojanScanner] => C:\Dokumente und Einstellungen\marc\Desktop\Trojan Remover\Trjscan.exe /boot
HKLM\...\Run: [Safe'n'Sec Client] => "C:\Dokumente und Einstellungen\marc\Desktop\snsmcon.exe" autostart
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-746137067-606747145-682003330-1003\...\Run: [firefox] => C:\Programme\Mozilla Firefox\firefox.exe [275568 2014-04-27] (Mozilla Corporation)
HKU\S-1-5-21-746137067-606747145-682003330-1003\...\Run: [Spotify Web Helper] => C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-16] (Spotify Ltd)
HKU\S-1-5-21-746137067-606747145-682003330-1003\...\Run: [Spotify] => C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Spotify\Spotify.exe [6170168 2014-05-16] (Spotify Ltd)
Lsa: [Authentication Packages] msv1_0 nwprovau
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\hp psc 1000 series.lnk
ShortcutTarget: hp psc 1000 series.lnk -> C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\hpoddt01.exe.lnk
ShortcutTarget: hpoddt01.exe.lnk -> C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
SSODL: SnsShell - {E8DDF189-0B6D-4E3A-BA9A-E0670C7014A7} - C:\Dokumente und Einstellungen\marc\Desktop\snsshex.dll No File
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {E9DB9E7B-A275-41D1-8158-D0423FBEBDEB} URL = hxxp://www.google.com/cse?cx=partner-pub-3540673482024757:xbhdw8hkfz5&cof=&q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
Toolbar: HKCU - &Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
ShellExecuteHooks: SFShellExt Class - {E8DDF189-0B6D-4E3A-BA9A-E0670C7014A7} - C:\Dokumente und Einstellungen\marc\Desktop\snsshex.dll No File [ ]
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Mozilla\Firefox\Profiles\0co6duds.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "http", "69.163.96.2"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Dokumente und Einstellungen\marc\Desktop\Mozilla Plugins\npitunes.dll No File
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonEU\NGM\npNxGameeu.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Programme\Yahoo!\Common\npyaxmpb.dll No File
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Mozilla\Firefox\Profiles\0co6duds.default\Extensions\abs@avira.com [2014-06-25]
FF Extension: Adblock Plus - C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Mozilla\Firefox\Profiles\0co6duds.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-04]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-05-14]
Chrome:
=======
CHR HomePage:
CHR Extension: (Google Docs) - C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-15]
CHR Extension: (Google Drive) - C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-15]
CHR Extension: (YouTube) - C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-15]
CHR Extension: (Google-Suche) - C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-15]
CHR Extension: (Google Wallet) - C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-15]
CHR Extension: (Google Mail) - C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-15]
========================== Services (Whitelisted) =================
Locked "a127b2c0fb888938" service could not be unlocked. <===== ATTENTION
S4 Alerter; C:\WINDOWS\system32\alrsvc.dll [17408 2008-04-14] (Microsoft Corporation) [File not signed]
R3 ALG; C:\WINDOWS\System32\alg.exe [44544 2008-04-14] (Microsoft Corporation) [File not signed]
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [1028688 2014-06-24] (Avira Operations GmbH & Co. KG)
S3 AppMgmt; C:\WINDOWS\System32\appmgmts.dll [175616 2008-04-14] (Microsoft Corporation) [File not signed]
R2 AudioSrv; C:\WINDOWS\System32\audiosrv.dll [42496 2008-04-14] (Microsoft Corporation) [File not signed]
R2 Avira.OE.ServiceHost; C:\Programme\Avira\My Avira\Avira.OE.ServiceHost.exe [123984 2014-05-14] (Avira Operations GmbH & Co. KG)
U3 BITS; C:\WINDOWS\system32\qmgr.dll [409088 2008-04-14] (Microsoft Corporation) [File not signed]
S2 Browser; C:\WINDOWS\System32\browser.dll [77824 2008-04-14] (Microsoft Corporation) [File not signed]
S3 cisvc; C:\WINDOWS\System32\cisvc.exe [5632 2008-04-14] (Microsoft Corporation) [File not signed]
S4 ClipSrv; C:\WINDOWS\system32\clipsrv.exe [33280 2008-04-14] (Microsoft Corporation) [File not signed]
S3 COMSysApp; C:\WINDOWS\System32\dllhost.exe [5120 2008-04-14] (Microsoft Corporation) [File not signed]
R2 CryptSvc; C:\WINDOWS\System32\cryptsvc.dll [62464 2008-04-14] (Microsoft Corporation) [File not signed]
R2 DcomLaunch; C:\WINDOWS\system32\rpcss.dll [401408 2009-02-09] (Microsoft Corporation) [File not signed]
R2 Dhcp; C:\WINDOWS\System32\dhcpcsvc.dll [127488 2008-04-14] (Microsoft Corporation) [File not signed]
S3 dmadmin; C:\WINDOWS\System32\dmadmin.exe [225280 2008-04-14] (Microsoft Corp., Veritas Software) [File not signed]
R2 dmserver; C:\WINDOWS\System32\dmserver.dll [24064 2008-04-14] (Microsoft Corp.) [File not signed]
R2 Dnscache; C:\WINDOWS\System32\dnsrslvr.dll [45568 2008-04-14] (Microsoft Corporation) [File not signed]
S3 Dot3svc; C:\WINDOWS\System32\dot3svc.dll [133120 2008-04-14] (Microsoft Corporation) [File not signed]
S3 EapHost; C:\WINDOWS\System32\eapsvc.dll [33792 2008-04-14] (Microsoft Corporation) [File not signed]
R2 ERSvc; C:\WINDOWS\System32\ersvc.dll [23040 2008-04-14] (Microsoft Corporation) [File not signed]
R2 Eventlog; C:\WINDOWS\system32\services.exe [111104 2009-02-09] (Microsoft Corporation) [File not signed]
R3 EventSystem; C:\WINDOWS\System32\es.dll [253952 2008-07-07] (Microsoft Corporation) [File not signed]
R3 FastUserSwitchingCompatibility; C:\WINDOWS\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation) [File not signed]
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2014-03-15] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [116648 2014-03-15] (Google Inc.)
R2 helpsvc; C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll [38400 2008-04-14] (Microsoft Corporation) [File not signed]
R2 HidServ; C:\WINDOWS\System32\hidserv.dll [21504 2008-04-14] (Microsoft Corporation) [File not signed]
S3 hkmsvc; C:\WINDOWS\System32\kmsvc.dll [61440 2008-04-14] (Microsoft Corporation) [File not signed]
S3 HTTPFilter; C:\WINDOWS\System32\w3ssl.dll [15872 2008-04-14] (Microsoft Corporation) [File not signed]
S3 ImapiService; C:\WINDOWS\System32\imapi.exe [150528 2008-04-14] (Microsoft Corporation) [File not signed]
R2 lanmanserver; C:\WINDOWS\System32\srvsvc.dll [96768 2008-04-14] (Microsoft Corporation) [File not signed]
R2 lanmanworkstation; C:\WINDOWS\System32\wkssvc.dll [132096 2009-06-10] (Microsoft Corporation) [File not signed]
R2 LmHosts; C:\WINDOWS\System32\lmhsvc.dll [13824 2008-04-14] (Microsoft Corporation) [File not signed]
S4 Messenger; C:\WINDOWS\System32\msgsvc.dll [33792 2008-04-14] (Microsoft Corporation) [File not signed]
S3 Microsoft Office Groove Audit Service; C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [65824 2006-10-27] (Microsoft Corporation)
S3 mnmsrvc; C:\WINDOWS\System32\mnmsrvc.exe [32768 2008-04-14] (Microsoft Corporation) [File not signed]
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [119408 2014-04-27] (Mozilla Foundation)
S3 MSDTC; C:\WINDOWS\System32\msdtc.exe [6144 2008-04-14] (Microsoft Corporation) [File not signed]
S3 MSIServer; C:\WINDOWS\System32\msiexec.exe [78848 2008-04-14] (Microsoft Corporation) [File not signed]
S3 napagent; C:\WINDOWS\System32\qagentrt.dll [294400 2008-04-14] (Microsoft Corporation) [File not signed]
S4 NetDDE; C:\WINDOWS\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation) [File not signed]
S4 NetDDEdsdm; C:\WINDOWS\system32\netdde.exe [114176 2008-04-14] (Microsoft Corporation) [File not signed]
S3 Netlogon; C:\WINDOWS\System32\lsass.exe [13312 2008-04-14] (Microsoft Corporation) [File not signed]
R3 Netman; C:\WINDOWS\System32\netman.dll [198144 2008-04-14] (Microsoft Corporation) [File not signed]
R3 Nla; C:\WINDOWS\System32\mswsock.dll [247296 2008-06-20] (Microsoft Corporation) [File not signed]
S3 NtLmSsp; C:\WINDOWS\System32\lsass.exe [13312 2008-04-14] (Microsoft Corporation) [File not signed]
S3 NtmsSvc; C:\WINDOWS\system32\ntmssvc.dll [438272 2008-04-14] (Microsoft Corporation) [File not signed]
R2 NWCWorkstation; C:\WINDOWS\System32\nwwks.dll [65536 2008-04-14] (Microsoft Corporation) [File not signed]
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [441136 2006-10-26] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
R2 PlugPlay; C:\WINDOWS\system32\services.exe [111104 2009-02-09] (Microsoft Corporation) [File not signed]
S3 Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [65536 2002-11-27] (HP) [File not signed]
S3 PolicyAgent; C:\WINDOWS\System32\lsass.exe [13312 2008-04-14] (Microsoft Corporation) [File not signed]
R2 ProtectedStorage; C:\WINDOWS\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation) [File not signed]
R2 RalinkRegistryWriter; C:\Programme\Tenda\Common\RaRegistry.exe [375872 2011-03-31] (Ralink Technology, Corp.)
S3 RaMediaServer; C:\Programme\Tenda\Common\RaMediaServer.exe [621632 2011-03-04] ()
S3 RasAuto; C:\WINDOWS\System32\rasauto.dll [88576 2008-04-14] (Microsoft Corporation) [File not signed]
R3 RasMan; C:\WINDOWS\System32\rasmans.dll [186368 2008-04-14] (Microsoft Corporation) [File not signed]
S3 RDSessMgr; C:\WINDOWS\system32\sessmgr.exe [143360 2008-04-14] (Microsoft Corporation) [File not signed]
S4 RemoteAccess; C:\WINDOWS\System32\mprdim.dll [53248 2008-04-14] (Microsoft Corporation) [File not signed]
S4 RemoteRegistry; C:\WINDOWS\system32\regsvc.dll [59904 2008-04-14] (Microsoft Corporation) [File not signed]
S3 RpcLocator; C:\WINDOWS\System32\locator.exe [75264 2008-04-14] (Microsoft Corporation) [File not signed]
R2 RpcSs; C:\WINDOWS\system32\rpcss.dll [401408 2009-02-09] (Microsoft Corporation) [File not signed]
S3 RSVP; C:\WINDOWS\System32\rsvp.exe [132608 2001-08-23] (Microsoft Corporation) [File not signed]
R2 SamSs; C:\WINDOWS\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation) [File not signed]
S3 SCardSvr; C:\WINDOWS\System32\SCardSvr.exe [99840 2008-04-14] (Microsoft Corporation) [File not signed]
R2 Schedule; C:\WINDOWS\system32\schedsvc.dll [193536 2008-04-14] (Microsoft Corporation) [File not signed]
R2 seclogon; C:\WINDOWS\System32\seclogon.dll [18944 2008-04-14] (Microsoft Corporation) [File not signed]
R2 SENS; C:\WINDOWS\system32\sens.dll [39424 2008-04-14] (Microsoft Corporation) [File not signed]
R2 SharedAccess; C:\WINDOWS\System32\ipnathlp.dll [334336 2008-04-14] (Microsoft Corporation) [File not signed]
R2 ShellHWDetection; C:\WINDOWS\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation) [File not signed]
R2 Spooler; C:\WINDOWS\system32\spoolsv.exe [57856 2008-04-14] (Microsoft Corporation) [File not signed]
R2 srservice; C:\WINDOWS\System32\srsvc.dll [171520 2008-04-14] (Microsoft Corporation) [File not signed]
R3 SSDPSRV; C:\WINDOWS\System32\ssdpsrv.dll [71680 2008-04-14] (Microsoft Corporation) [File not signed]
R2 stisvc; C:\WINDOWS\system32\wiaservc.dll [334336 2008-04-14] (Microsoft Corporation) [File not signed]
S3 SwPrv; C:\WINDOWS\System32\dllhost.exe [5120 2008-04-14] (Microsoft Corporation) [File not signed]
S3 SysmonLog; C:\WINDOWS\system32\smlogsvc.exe [94208 2008-04-14] (Microsoft Corporation) [File not signed]
R3 TapiSrv; C:\WINDOWS\System32\tapisrv.dll [249856 2008-04-14] (Microsoft Corporation) [File not signed]
R3 TermService; C:\WINDOWS\System32\termsrv.dll [297472 2008-04-14] (Microsoft Corporation) [File not signed]
R2 Themes; C:\WINDOWS\System32\shsvcs.dll [135168 2008-04-14] (Microsoft Corporation) [File not signed]
S3 TlntSvr; C:\WINDOWS\System32\tlntsvr.exe [75264 2008-04-14] (Microsoft Corporation) [File not signed]
R2 TrkWks; C:\WINDOWS\system32\trkwks.dll [90112 2008-04-14] (Microsoft Corporation) [File not signed]
S3 upnphost; C:\WINDOWS\System32\upnphost.dll [186880 2008-04-14] (Microsoft Corporation) [File not signed]
S3 UPS; C:\WINDOWS\System32\ups.exe [18432 2008-04-14] (Microsoft Corporation) [File not signed]
S3 VSS; C:\WINDOWS\System32\vssvc.exe [292864 2008-04-14] (Microsoft Corporation) [File not signed]
R2 W32Time; C:\WINDOWS\System32\w32time.dll [177152 2008-04-14] (Microsoft Corporation) [File not signed]
S3 WebClient; C:\WINDOWS\System32\webclnt.dll [68096 2008-04-14] (Microsoft Corporation) [File not signed]
R2 winmgmt; C:\WINDOWS\system32\wbem\WMIsvc.dll [145408 2008-04-14] (Microsoft Corporation) [File not signed]
S3 WmdmPmSN; C:\WINDOWS\system32\MsPMSNSv.dll [27136 2006-10-18] (Microsoft Corporation) [File not signed]
S3 Wmi; C:\WINDOWS\System32\advapi32.dll [678400 2009-02-09] (Microsoft Corporation) [File not signed]
S3 WmiApSrv; C:\WINDOWS\System32\wbem\wmiapsrv.exe [126464 2008-04-14] (Microsoft Corporation) [File not signed]
S4 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-10-24] (Microsoft Corporation) [File not signed]
R2 wscsvc; C:\WINDOWS\system32\wscsvc.dll [80896 2008-04-14] (Microsoft Corporation) [File not signed]
U2 wuauserv; C:\WINDOWS\system32\wuauserv.dll [6656 2008-04-14] (Microsoft Corporation) [File not signed]
R2 WudfSvc; C:\WINDOWS\System32\WUDFSvc.dll [64512 2009-07-13] (Microsoft Corporation) [File not signed]
S3 WZCSVC; C:\WINDOWS\System32\wzcsvc.dll [483840 2008-04-14] (Microsoft Corporation) [File not signed]
S3 xmlprov; C:\WINDOWS\System32\xmlprov.dll [129024 2008-04-14] (Microsoft Corporation) [File not signed]
S4 iPod Service; C:\Programme\iPod\bin\iPodService.exe [X]
S2 MBAMScheduler; "C:\Dokumente und Einstellungen\marc\Desktop\Malwarebytes Anti-Malware\mbamscheduler.exe" [X]
S2 MBAMService; "C:\Dokumente und Einstellungen\marc\Desktop\Malwarebytes Anti-Malware\mbamservice.exe" [X]
S4 McComponentHostService; "C:\Programme\McAfee Security Scan\3.0.285\McCHSvc.exe" [X]
S2 safensec; "C:\Dokumente und Einstellungen\marc\Desktop\safensec.exe" [X]
S2 syshost32; No ImagePath
S4 TuneUp.UtilitiesSvc; "C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe" [X]
==================== Drivers (Whitelisted) ====================
R0 ACPI; C:\WINDOWS\System32\DRIVERS\ACPI.sys [188800 2008-04-14] () [File not signed]
R0 ACPIEC; C:\WINDOWS\System32\DRIVERS\ACPIEC.sys [12160 2001-08-23] () [File not signed]
S3 aec; C:\WINDOWS\System32\drivers\aec.sys [142592 2008-04-13] () [File not signed]
R1 AFD; C:\WINDOWS\System32\drivers\afd.sys [138496 2008-08-14] () [File not signed]
S3 AsyncMac; C:\WINDOWS\System32\DRIVERS\asyncmac.sys [14336 2008-04-14] () [File not signed]
R0 atapi; C:\WINDOWS\System32\DRIVERS\atapi.sys [96512 2008-04-14] () [File not signed]
S3 Atmarpc; C:\WINDOWS\System32\DRIVERS\atmarpc.sys [59904 2008-04-14] () [File not signed]
R3 audstub; C:\WINDOWS\System32\DRIVERS\audstub.sys [3072 2001-08-17] () [File not signed]
S2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [97648 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\System32\DRIVERS\avipbb.sys [136216 2014-06-03] () [File not signed]
R1 avkmgr; C:\WINDOWS\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] () [File not signed]
R1 Beep; C:\WINDOWS\system32\Drivers\Beep.sys [4224 2001-08-23] () [File not signed]
S3 BoiHwsetup; C:\WINDOWS\System32\drivers\BoiHwSetup.sys [5504 2005-06-10] () [File not signed]
R3 CAMCAUD; C:\WINDOWS\System32\drivers\camc6aud.sys [38144 2005-06-17] () [File not signed]
R3 CAMCHALA; C:\WINDOWS\System32\drivers\camc6hal.sys [352000 2005-06-17] () [File not signed]
S4 cbidf2k; C:\WINDOWS\system32\Drivers\cbidf2k.sys [13952 2001-08-23] () [File not signed]
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] () [File not signed]
S1 Cdaudio; C:\WINDOWS\system32\Drivers\Cdaudio.sys [18688 2001-08-23] () [File not signed]
R4 Cdfs; C:\WINDOWS\system32\Drivers\Cdfs.sys [63744 2008-04-14] () [File not signed]
R1 Cdrom; C:\WINDOWS\System32\DRIVERS\cdrom.sys [62976 2008-04-14] () [File not signed]
R3 CmBatt; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [13952 2008-04-14] () [File not signed]
R0 Compbatt; C:\WINDOWS\System32\DRIVERS\compbatt.sys [10240 2008-04-14] () [File not signed]
S3 CYDTV_SRV; C:\WINDOWS\System32\drivers\cydtv.sys [437112 2010-05-14] () [File not signed]
R0 Disk; C:\WINDOWS\System32\DRIVERS\disk.sys [36352 2008-04-14] () [File not signed]
S4 dmboot; C:\WINDOWS\System32\drivers\dmboot.sys [800384 2008-04-14] () [File not signed]
R0 dmio; C:\WINDOWS\System32\drivers\dmio.sys [154112 2008-04-14] () [File not signed]
R0 dmload; C:\WINDOWS\System32\drivers\dmload.sys [5888 2001-08-23] () [File not signed]
S3 DMusic; C:\WINDOWS\System32\drivers\DMusic.sys [52864 2008-04-14] () [File not signed]
S3 drmkaud; C:\WINDOWS\System32\drivers\drmkaud.sys [2944 2008-04-14] () [File not signed]
S3 E100B; C:\WINDOWS\System32\DRIVERS\e100b325.sys [117760 2001-08-18] () [File not signed]
S4 Fastfat; C:\WINDOWS\system32\Drivers\Fastfat.sys [143744 2008-04-14] () [File not signed]
S1 Fdc; C:\WINDOWS\system32\Drivers\Fdc.sys [27392 2008-04-14] () [File not signed]
R1 Fips; C:\WINDOWS\system32\Drivers\Fips.sys [44672 2008-04-14] () [File not signed]
S1 Flpydisk; C:\WINDOWS\system32\Drivers\Flpydisk.sys [20480 2008-04-14] () [File not signed]
R0 FltMgr; C:\WINDOWS\System32\drivers\fltmgr.sys [129792 2008-04-14] () [File not signed]
U1 Fs_Rec; C:\WINDOWS\system32\Drivers\Fs_Rec.sys [7936 2001-08-23] () [File not signed]
R0 Ftdisk; C:\WINDOWS\System32\DRIVERS\ftdisk.sys [126336 2001-08-23] () [File not signed]
R3 GEARAspiWDM; C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys [26600 2009-05-18] () [File not signed]
R3 Gpc; C:\WINDOWS\System32\DRIVERS\msgpc.sys [35072 2008-04-14] () [File not signed]
R3 HidUsb; C:\WINDOWS\System32\DRIVERS\hidusb.sys [10368 2008-04-14] () [File not signed]
S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [50960 2002-11-27] () [File not signed]
S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16080 2002-11-27] () [File not signed]
S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [22384 2002-11-27] () [File not signed]
R3 HTTP; C:\WINDOWS\System32\Drivers\HTTP.sys [265728 2009-10-20] () [File not signed]
R1 i8042prt; C:\WINDOWS\System32\DRIVERS\i8042prt.sys [52992 2008-04-14] () [File not signed]
R3 ialm; C:\WINDOWS\System32\DRIVERS\igxpmp32.sys [5672032 2007-01-13] () [File not signed]
R1 Imapi; C:\WINDOWS\system32\Drivers\Imapi.sys [42112 2008-04-14] () [File not signed]
R1 intelppm; C:\WINDOWS\System32\DRIVERS\intelppm.sys [40448 2008-04-14] () [File not signed]
S3 ip6fw; C:\WINDOWS\System32\drivers\ip6fw.sys [36608 2008-04-14] () [File not signed]
S3 IpFilterDriver; C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [32896 2001-08-23] () [File not signed]
S3 IpInIp; C:\WINDOWS\System32\DRIVERS\ipinip.sys [20864 2008-04-14] () [File not signed]
R3 IpNat; C:\WINDOWS\System32\DRIVERS\ipnat.sys [152832 2008-04-14] () [File not signed]
R1 IPSec; C:\WINDOWS\System32\DRIVERS\ipsec.sys [75264 2008-04-14] () [File not signed]
S3 IRENUM; C:\WINDOWS\System32\DRIVERS\irenum.sys [11264 2008-04-14] () [File not signed]
R0 isapnp; C:\WINDOWS\System32\DRIVERS\isapnp.sys [37632 2008-04-14] () [File not signed]
R1 Kbdclass; C:\WINDOWS\System32\DRIVERS\kbdclass.sys [25216 2008-04-14] () [File not signed]
R1 kbdhid; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [14720 2008-04-14] () [File not signed]
S3 kmixer; C:\WINDOWS\System32\drivers\kmixer.sys [172416 2008-04-14] () [File not signed]
R0 KSecDD; C:\WINDOWS\system32\Drivers\KSecDD.sys [92928 2009-06-24] () [File not signed]
S3 LVRS; C:\WINDOWS\System32\DRIVERS\lvrs.sys [310504 2012-09-21] () [File not signed]
S3 LVUVC; C:\WINDOWS\System32\DRIVERS\lvuvc.sys [4261224 2012-09-21] () [File not signed]
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-26] (Malwarebytes Corporation)
R1 mnmdd; C:\WINDOWS\system32\Drivers\mnmdd.sys [4224 2001-08-23] () [File not signed]
S3 Modem; C:\WINDOWS\system32\Drivers\Modem.sys [30336 2008-04-14] () [File not signed]
R1 Mouclass; C:\WINDOWS\System32\DRIVERS\mouclass.sys [23552 2008-04-14] () [File not signed]
R3 mouhid; C:\WINDOWS\System32\DRIVERS\mouhid.sys [12288 2001-08-18] () [File not signed]
R0 MountMgr; C:\WINDOWS\system32\Drivers\MountMgr.sys [42368 2008-04-14] () [File not signed]
S3 MPE; C:\WINDOWS\System32\DRIVERS\MPE.sys [15232 2008-04-14] () [File not signed]
S3 MRxDAV; C:\WINDOWS\System32\DRIVERS\mrxdav.sys [180608 2008-04-14] () [File not signed]
R1 MRxSmb; C:\WINDOWS\System32\DRIVERS\mrxsmb.sys [455680 2010-02-24] () [File not signed]
R1 Msfs; C:\WINDOWS\system32\Drivers\Msfs.sys [19072 2008-04-14] () [File not signed]
S3 MSKSSRV; C:\WINDOWS\System32\drivers\MSKSSRV.sys [7552 2008-04-14] () [File not signed]
S3 MSPCLOCK; C:\WINDOWS\System32\drivers\MSPCLOCK.sys [5376 2008-04-14] () [File not signed]
S3 MSPQM; C:\WINDOWS\System32\drivers\MSPQM.sys [4992 2008-04-14] () [File not signed]
R3 mssmbios; C:\WINDOWS\System32\DRIVERS\mssmbios.sys [15488 2008-04-14] () [File not signed]
S3 MSTEE; C:\WINDOWS\System32\drivers\MSTEE.sys [5504 2008-04-14] () [File not signed]
R0 Mup; C:\WINDOWS\system32\Drivers\Mup.sys [105344 2008-04-14] () [File not signed]
S3 NABTSFEC; C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-14] () [File not signed]
R0 NDIS; C:\WINDOWS\system32\Drivers\NDIS.sys [182656 2008-04-14] () [File not signed]
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] () [File not signed]
R3 NdisTapi; C:\WINDOWS\System32\DRIVERS\ndistapi.sys [10112 2008-04-14] () [File not signed]
S3 Ndisuio; C:\WINDOWS\System32\DRIVERS\ndisuio.sys [14592 2008-04-14] () [File not signed]
R3 NdisWan; C:\WINDOWS\System32\DRIVERS\ndiswan.sys [91520 2008-04-14] () [File not signed]
R3 NDProxy; C:\WINDOWS\system32\Drivers\NDProxy.sys [40576 2008-04-14] () [File not signed]
R1 NetBIOS; C:\WINDOWS\System32\DRIVERS\netbios.sys [34688 2008-04-14] () [File not signed]
R1 NetBT; C:\WINDOWS\System32\DRIVERS\netbt.sys [162816 2008-04-14] () [File not signed]
S3 nmwcd; C:\WINDOWS\System32\drivers\ccdcmb.sys [18560 2013-01-31] () [File not signed]
S3 nmwcdc; C:\WINDOWS\System32\drivers\ccdcmbo.sys [23168 2013-01-31] () [File not signed]
R1 Npfs; C:\WINDOWS\system32\Drivers\Npfs.sys [30848 2008-04-14] () [File not signed]
R4 Ntfs; C:\WINDOWS\system32\Drivers\Ntfs.sys [574976 2008-04-14] () [File not signed]
R1 Null; C:\WINDOWS\system32\Drivers\Null.sys [2944 2001-08-23] () [File not signed]
S3 NwlnkFlt; C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [12416 2001-08-23] () [File not signed]
S3 NwlnkFwd; C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [32512 2001-08-23] () [File not signed]
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-14] () [File not signed]
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2001-08-23] () [File not signed]
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2001-08-23] () [File not signed]
R3 NWRDR; C:\WINDOWS\System32\DRIVERS\nwrdr.sys [163584 2008-04-14] () [File not signed]
S3 Parport; C:\WINDOWS\system32\Drivers\Parport.sys [80384 2008-04-14] () [File not signed]
R0 PartMgr; C:\WINDOWS\system32\Drivers\PartMgr.sys [19712 2008-04-14] () [File not signed]
S2 ParVdm; C:\WINDOWS\system32\Drivers\ParVdm.sys [7040 2001-08-23] () [File not signed]
R0 PCI; C:\WINDOWS\System32\DRIVERS\pci.sys [68224 2008-04-14] () [File not signed]
R0 PCIIde; C:\WINDOWS\System32\DRIVERS\pciide.sys [3328 2001-08-23] () [File not signed]
R0 Pcmcia; C:\WINDOWS\System32\DRIVERS\pcmcia.sys [120576 2008-04-14] () [File not signed]
R3 PptpMiniport; C:\WINDOWS\System32\DRIVERS\raspptp.sys [48384 2008-04-14] () [File not signed]
S1 Processor; C:\WINDOWS\System32\DRIVERS\processr.sys [39936 2008-04-14] () [File not signed]
S3 PRODIGY; C:\WINDOWS\System32\Drivers\PRODIGY.SYS [32377 2006-08-29] () [File not signed]
R3 PSched; C:\WINDOWS\System32\DRIVERS\psched.sys [69120 2008-04-14] () [File not signed]
R3 Ptilink; C:\WINDOWS\System32\DRIVERS\ptilink.sys [17792 2001-08-23] () [File not signed]
S3 qkbfiltr; C:\WINDOWS\System32\drivers\qkbfiltr.sys [31360 2005-05-09] () [File not signed]
R3 qmofiltr; C:\WINDOWS\System32\drivers\qmofiltr.sys [7936 2005-05-05] () [File not signed]
R1 RasAcd; C:\WINDOWS\System32\DRIVERS\rasacd.sys [8832 2001-08-23] () [File not signed]
R3 Rasl2tp; C:\WINDOWS\System32\DRIVERS\rasl2tp.sys [51328 2008-04-14] () [File not signed]
R3 RasPppoe; C:\WINDOWS\System32\DRIVERS\raspppoe.sys [41472 2008-04-14] () [File not signed]
R3 Raspti; C:\WINDOWS\System32\DRIVERS\raspti.sys [16512 2001-08-23] () [File not signed]
R1 Rdbss; C:\WINDOWS\System32\DRIVERS\rdbss.sys [175744 2008-04-14] () [File not signed]
R1 RDPCDD; C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [4224 2001-08-23] () [File not signed]
R3 rdpdr; C:\WINDOWS\System32\DRIVERS\rdpdr.sys [196224 2008-04-14] () [File not signed]
S3 RDPWD; C:\WINDOWS\system32\Drivers\RDPWD.sys [139656 2008-04-14] () [File not signed]
R1 redbook; C:\WINDOWS\System32\DRIVERS\redbook.sys [57728 2008-04-14] () [File not signed]
S3 rt2870; C:\WINDOWS\System32\DRIVERS\rt2870.sys [1174976 2011-04-25] () [File not signed]
R3 RTL8023xp; C:\WINDOWS\System32\DRIVERS\Rtnicxp.sys [130432 2009-03-25] () [File not signed]
S3 rtl8139; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [20992 2004-08-03] () [File not signed]
R2 Scutum50; C:\WINDOWS\System32\Drivers\Scutum50.sys [19072 2009-04-21] () [File not signed]
S3 Secdrv; C:\WINDOWS\System32\DRIVERS\secdrv.sys [20480 2008-04-13] () [File not signed]
S2 Serial; C:\WINDOWS\system32\Drivers\Serial.sys [65536 2008-04-14] () [File not signed]
S1 Sfloppy; C:\WINDOWS\system32\Drivers\Sfloppy.sys [11392 2008-04-14] () [File not signed]
S3 SLIP; C:\WINDOWS\System32\DRIVERS\SLIP.sys [11136 2008-04-14] () [File not signed]
S1 SnsComlpt; C:\WINDOWS\System32\DRIVERS\snscomlpt.sys [11456 2011-09-19] (S.N.Safe&Software)
S1 SnsCore; C:\WINDOWS\System32\DRIVERS\snscore.sys [157984 2011-12-28] (S.N.Safe&Software)
S2 SnsTdi; C:\WINDOWS\System32\DRIVERS\snstdi.sys [28192 2011-11-09] (S.N.Safe&Software)
S3 splitter; C:\WINDOWS\System32\drivers\splitter.sys [6272 2008-04-14] () [File not signed]
R0 sr; C:\WINDOWS\System32\DRIVERS\sr.sys [73472 2008-04-14] () [File not signed]
R3 Srv; C:\WINDOWS\System32\DRIVERS\srv.sys [353792 2009-12-31] () [File not signed]
S1 ssmdrv; C:\WINDOWS\System32\DRIVERS\ssmdrv.sys [28520 2013-02-25] (Avira GmbH)
S3 streamip; C:\WINDOWS\System32\DRIVERS\StreamIP.sys [15232 2008-04-14] () [File not signed]
R3 swenum; C:\WINDOWS\System32\DRIVERS\swenum.sys [4352 2008-04-14] () [File not signed]
S3 swmidi; C:\WINDOWS\System32\drivers\swmidi.sys [56576 2008-04-14] () [File not signed]
R3 SynTP; C:\WINDOWS\System32\DRIVERS\SynTP.sys [185824 2004-10-08] () [File not signed]
R3 sysaudio; C:\WINDOWS\System32\drivers\sysaudio.sys [60800 2008-04-14] () [File not signed]
R1 Tcpip; C:\WINDOWS\System32\DRIVERS\tcpip.sys [361600 2008-06-20] () [File not signed]
S3 TDPIPE; C:\WINDOWS\system32\Drivers\TDPIPE.sys [12040 2008-04-14] () [File not signed]
S3 TDTCP; C:\WINDOWS\system32\Drivers\TDTCP.sys [21896 2008-04-14] () [File not signed]
R1 TermDD; C:\WINDOWS\System32\DRIVERS\termdd.sys [40840 2008-04-14] () [File not signed]
S4 Udfs; C:\WINDOWS\system32\Drivers\Udfs.sys [66048 2008-04-14] () [File not signed]
R3 Update; C:\WINDOWS\System32\DRIVERS\update.sys [384768 2008-04-14] () [File not signed]
S3 upperdev; C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys [8192 2013-01-31] () [File not signed]
S3 USBAAPL; C:\WINDOWS\System32\Drivers\usbaapl.sys [41984 2011-02-18] () [File not signed]
S3 usbaudio; C:\WINDOWS\System32\drivers\usbaudio.sys [60032 2008-04-14] () [File not signed]
R3 usbccgp; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [32128 2008-04-14] () [File not signed]
R3 usbehci; C:\WINDOWS\System32\DRIVERS\usbehci.sys [30208 2008-04-14] () [File not signed]
R3 usbhub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [59520 2008-04-14] () [File not signed]
S3 usbprint; C:\WINDOWS\System32\DRIVERS\usbprint.sys [25856 2008-04-14] () [File not signed]
S3 usbscan; C:\WINDOWS\System32\DRIVERS\usbscan.sys [15104 2008-04-14] () [File not signed]
S3 usbser; C:\WINDOWS\System32\drivers\usbser.sys [26112 2008-04-14] () [File not signed]
S3 UsbserFilt; C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys [8192 2013-01-31] () [File not signed]
S3 USBSTOR; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [26368 2008-04-14] () [File not signed]
R3 usbuhci; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [20608 2008-04-14] () [File not signed]
S3 usbvideo; C:\WINDOWS\System32\Drivers\usbvideo.sys [121984 2008-04-14] () [File not signed]
R1 VgaSave; C:\WINDOWS\System32\drivers\vga.sys [20992 2008-04-14] () [File not signed]
R0 VolSnap; C:\WINDOWS\system32\Drivers\VolSnap.sys [53760 2008-04-14] () [File not signed]
R3 w29n51; C:\WINDOWS\System32\DRIVERS\w29n51.sys [2216064 2009-11-11] () [File not signed]
R3 Wanarp; C:\WINDOWS\System32\DRIVERS\wanarp.sys [34560 2008-04-14] () [File not signed]
R0 Wdf01000; C:\WINDOWS\System32\Drivers\wdf01000.sys [444136 2009-07-14] () [File not signed]
R3 wdmaud; C:\WINDOWS\System32\drivers\wdmaud.sys [83072 2008-04-14] () [File not signed]
S3 WpdUsb; C:\WINDOWS\System32\DRIVERS\wpdusb.sys [38528 2006-10-18] () [File not signed]
S3 WSTCODEC; C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-14] () [File not signed]
R0 WudfPf; C:\WINDOWS\System32\DRIVERS\WudfPf.sys [91904 2009-07-13] () [File not signed]
S3 WudfRd; C:\WINDOWS\System32\DRIVERS\wudfrd.sys [132224 2009-07-13] () [File not signed]
U5 a127b2c0fb888938; C:\Windows\System32\Drivers\a127b2c0fb888938.sys [37888 2014-06-23] () <===== ATTENTION Necurs Rootkit?
U5 BattC; C:\Windows\System32\Drivers\BattC.sys [16384 2008-04-14] () [File not signed]
S3 cnnctfy2; system32\DRIVERS\cnnctfy2.sys [X]
S3 cnnctfy2MP; system32\DRIVERS\cnnctfy2.sys [X]
S3 EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys [X]
S4 hpt3xx; No ImagePath
S4 IntelIde; No ImagePath
S3 NielGfx; system32\drivers\nielgfx.sys [X]
S0 nielprt; system32\DRIVERS\nielprt.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] () [File not signed]
S3 tosporte; system32\DRIVERS\tosporte.sys [X]
S3 Tosrfcom; System32\Drivers\tosrfcom.sys [X]
S3 TuneUpUtilitiesDrv; \??\C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [X]
S3 UIUSys; system32\drivers\UIUSys.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-26 23:18 - 2014-06-26 23:19 - 00039907 _____ () C:\Dokumente und Einstellungen\marc\Desktop\FRST.txt
2014-06-26 23:18 - 2014-06-26 23:18 - 00000000 ____D () C:\FRST
2014-06-26 23:17 - 2014-06-26 23:17 - 01073152 _____ (Farbar) C:\Dokumente und Einstellungen\marc\Desktop\FRST.exe
2014-06-26 23:15 - 2014-06-26 23:15 - 00003408 _____ () C:\Dokumente und Einstellungen\marc\Desktop\defogger_disable.log
2014-06-26 23:15 - 2014-06-26 23:15 - 00000000 _____ () C:\Dokumente und Einstellungen\marc\defogger_reenable
2014-06-26 23:14 - 2014-06-26 23:14 - 00050477 _____ () C:\Dokumente und Einstellungen\marc\Desktop\Defogger.exe
2014-06-26 16:02 - 2014-06-26 16:02 - 00009761 _____ () C:\Dokumente und Einstellungen\marc\collectionCache.bnk
2014-06-26 14:57 - 2014-06-26 14:57 - 00000000 ____D () C:\WINDOWS\LastGood
2014-06-26 14:33 - 2014-04-28 10:43 - 11424368 _____ (Bitdefender LLC) C:\WINDOWS\BootkitRemoval_x64.exe
2014-06-26 14:24 - 2014-06-26 15:05 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Desktop\Neuer Ordner
2014-06-26 13:47 - 2014-06-26 13:47 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\sns
2014-06-26 13:47 - 2014-06-26 13:47 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\FPAV
2014-06-26 03:26 - 2014-06-26 13:43 - 00064045 _____ () C:\WINDOWS\system32\Drivers\snscore.tmp
2014-06-26 03:21 - 2014-06-26 03:21 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\SafenSoft
2014-06-26 03:21 - 2011-12-28 14:18 - 00157984 _____ (S.N.Safe&Software) C:\WINDOWS\system32\Drivers\snscore.sys
2014-06-26 03:21 - 2011-11-09 00:00 - 00028192 _____ (S.N.Safe&Software) C:\WINDOWS\system32\Drivers\snstdi.sys
2014-06-26 03:21 - 2011-09-19 11:38 - 00011456 _____ (S.N.Safe&Software) C:\WINDOWS\system32\Drivers\snscomlpt.sys
2014-06-26 03:20 - 2014-06-26 03:20 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\S.N.Safe&Software
2014-06-26 03:18 - 2014-06-26 03:18 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
2014-06-26 01:40 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\system32\sqlite3.dll
2014-06-26 01:38 - 2014-06-26 01:55 - 00000000 ____D () C:\AdwCleaner
2014-06-26 01:22 - 2014-06-26 01:25 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
2014-06-26 01:22 - 2012-10-12 16:34 - 00033096 _____ (Sophos Limited) C:\WINDOWS\system32\Drivers\sct_skmscan.sys
2014-06-26 01:19 - 2014-06-26 01:19 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Startmenü\Programme\Sophos
2014-06-26 01:18 - 2014-06-26 14:59 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-06-26 01:17 - 2014-06-26 01:17 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes Anti-Malware
2014-06-26 01:16 - 2014-05-12 07:26 - 00053208 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-06-26 01:16 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-06-25 21:25 - 2014-06-26 02:09 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2014-06-25 21:25 - 2014-06-25 21:25 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Licenses
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Eigene Dateien\Simply Super Software
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Simply Super Software
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Trojan Remover
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
2014-06-25 21:24 - 2012-06-15 15:39 - 00169744 _____ () C:\WINDOWS\system32\ztvunrar36.dll
2014-06-25 21:24 - 2012-06-15 15:35 - 00185616 _____ () C:\WINDOWS\system32\ztvunrar39.dll
2014-06-25 21:24 - 2012-06-15 15:33 - 00605968 _____ (Igor Pavlov) C:\WINDOWS\system32\ztv7z.dll
2014-06-25 21:24 - 2012-06-15 15:33 - 00077072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ztvcabinet.dll
2014-06-25 21:24 - 2005-08-26 00:50 - 00077312 _____ () C:\WINDOWS\system32\ztvunace26.dll
2014-06-25 21:24 - 2003-02-02 19:06 - 00153088 _____ () C:\WINDOWS\system32\UNRAR3.dll
2014-06-25 21:24 - 2002-03-06 00:00 - 00075264 _____ () C:\WINDOWS\system32\unacev2.dll
2014-06-25 21:06 - 2014-06-25 21:06 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Advanced Fix 2013
2014-06-25 20:21 - 2014-06-26 14:44 - 00287734 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
2014-06-25 20:21 - 2014-06-25 21:47 - 00287734 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-746137067-606747145-682003330-1003-0.dat
2014-06-25 18:56 - 2014-06-25 20:25 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Package Cache
2014-06-23 22:56 - 2014-06-23 22:56 - 00037888 _____ () C:\WINDOWS\system32\Drivers\a127b2c0fb888938.sys
==================== One Month Modified Files and Folders =======
2014-06-26 23:19 - 2014-06-26 23:18 - 00039907 _____ () C:\Dokumente und Einstellungen\marc\Desktop\FRST.txt
2014-06-26 23:19 - 2010-04-08 20:35 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Temp
2014-06-26 23:18 - 2014-06-26 23:18 - 00000000 ____D () C:\FRST
2014-06-26 23:17 - 2014-06-26 23:17 - 01073152 _____ (Farbar) C:\Dokumente und Einstellungen\marc\Desktop\FRST.exe
2014-06-26 23:15 - 2014-06-26 23:15 - 00003408 _____ () C:\Dokumente und Einstellungen\marc\Desktop\defogger_disable.log
2014-06-26 23:15 - 2014-06-26 23:15 - 00000000 _____ () C:\Dokumente und Einstellungen\marc\defogger_reenable
2014-06-26 23:15 - 2010-04-08 20:35 - 00000000 ____D () C:\Dokumente und Einstellungen\marc
2014-06-26 23:14 - 2014-06-26 23:14 - 00050477 _____ () C:\Dokumente und Einstellungen\marc\Desktop\Defogger.exe
2014-06-26 16:04 - 2010-04-08 21:10 - 01388854 _____ () C:\WINDOWS\WindowsUpdate.log
2014-06-26 16:02 - 2014-06-26 16:02 - 00009761 _____ () C:\Dokumente und Einstellungen\marc\collectionCache.bnk
2014-06-26 16:02 - 2014-03-02 15:59 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Spotify
2014-06-26 16:00 - 2014-03-15 20:06 - 00001080 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-26 16:00 - 2011-03-10 23:22 - 01098783 _____ () C:\WINDOWS\setupapi.log
2014-06-26 15:58 - 2010-04-08 21:19 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-06-26 15:58 - 2010-04-08 21:19 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-06-26 15:55 - 2010-04-08 20:28 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-06-26 15:14 - 2010-04-08 20:36 - 00000190 ___SH () C:\Dokumente und Einstellungen\marc\ntuser.ini
2014-06-26 15:05 - 2014-06-26 14:24 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Desktop\Neuer Ordner
2014-06-26 14:59 - 2014-06-26 01:18 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-06-26 14:57 - 2014-06-26 14:57 - 00000000 ____D () C:\WINDOWS\LastGood
2014-06-26 14:44 - 2014-06-25 20:21 - 00287734 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
2014-06-26 14:44 - 2010-04-08 20:34 - 00032496 _____ () C:\WINDOWS\SchedLgU.Txt
2014-06-26 14:36 - 2014-04-03 16:14 - 00001090 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-26 14:27 - 2011-06-22 00:06 - 00000000 ____D () C:\WINDOWS\system32\NtmsData
2014-06-26 14:26 - 2010-04-08 20:24 - 00000000 ____D () C:\WINDOWS\Registration
2014-06-26 13:47 - 2014-06-26 13:47 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\sns
2014-06-26 13:47 - 2014-06-26 13:47 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\FPAV
2014-06-26 13:43 - 2014-06-26 03:26 - 00064045 _____ () C:\WINDOWS\system32\Drivers\snscore.tmp
2014-06-26 03:21 - 2014-06-26 03:21 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\SafenSoft
2014-06-26 03:21 - 2010-04-08 21:17 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2014-06-26 03:21 - 2001-08-23 14:00 - 00000810 _____ () C:\WINDOWS\win.ini
2014-06-26 03:20 - 2014-06-26 03:20 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\S.N.Safe&Software
2014-06-26 03:18 - 2014-06-26 03:18 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
2014-06-26 02:09 - 2014-06-25 21:25 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2014-06-26 01:55 - 2014-06-26 01:38 - 00000000 ____D () C:\AdwCleaner
2014-06-26 01:50 - 2010-04-08 20:35 - 00000000 ___RD () C:\Dokumente und Einstellungen\marc\Startmenü\Programme
2014-06-26 01:49 - 2013-07-29 18:04 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Common
2014-06-26 01:25 - 2014-06-26 01:22 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos
2014-06-26 01:19 - 2014-06-26 01:19 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Startmenü\Programme\Sophos
2014-06-26 01:17 - 2014-06-26 01:17 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes Anti-Malware
2014-06-26 01:16 - 2011-10-15 13:52 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2014-06-25 22:44 - 2013-02-27 01:42 - 00000000 ____D () C:\Programme\Avira
2014-06-25 21:47 - 2014-06-25 20:21 - 00287734 _____ () C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-746137067-606747145-682003330-1003-0.dat
2014-06-25 21:25 - 2014-06-25 21:25 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Licenses
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Eigene Dateien\Simply Super Software
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\Simply Super Software
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Trojan Remover
2014-06-25 21:24 - 2014-06-25 21:24 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
2014-06-25 21:22 - 2010-04-08 20:35 - 00000000 ___SD () C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Verlauf
2014-06-25 21:10 - 2014-04-27 00:42 - 00000000 ____D () C:\Programme\Mozilla Firefox
2014-06-25 21:10 - 2012-11-14 15:36 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\.BrainYoo2
2014-06-25 21:10 - 2011-10-26 12:03 - 00000000 ____D () C:\Programme\Mobile Master
2014-06-25 21:10 - 2011-06-13 14:33 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\MB Free Subliminal Message Software
2014-06-25 21:06 - 2014-06-25 21:06 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Advanced Fix 2013
2014-06-25 20:25 - 2014-06-25 18:56 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Package Cache
2014-06-25 20:18 - 2013-12-23 15:56 - 00000525 _____ () C:\hpfr3420.xml
2014-06-25 18:58 - 2014-01-06 02:22 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
2014-06-25 18:57 - 2013-02-27 01:42 - 00000000 ____D () C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2014-06-25 17:49 - 2014-03-02 16:01 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Spotify
2014-06-25 17:45 - 2001-08-23 14:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2014-06-25 17:22 - 2010-04-08 21:17 - 01154384 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-06-24 13:35 - 2013-02-27 01:42 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2014-06-23 22:56 - 2014-06-23 22:56 - 00037888 _____ () C:\WINDOWS\system32\Drivers\a127b2c0fb888938.sys
2014-06-23 13:30 - 2010-04-08 21:17 - 00000000 ____D () C:\Programme
2014-06-17 14:57 - 2013-12-23 01:13 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Desktop\Arbeit
2014-06-11 23:48 - 2014-03-15 20:08 - 00001769 _____ () C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
2014-06-09 16:11 - 2013-04-21 11:10 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Anwendungsdaten\vlc
2014-06-09 15:24 - 2013-12-22 23:24 - 00000000 ___RD () C:\Dokumente und Einstellungen\marc\Eigene Dateien\Bilder
2014-06-09 15:16 - 2012-09-16 14:22 - 00000000 ____D () C:\Dokumente und Einstellungen\marc\Eigene Dateien\Sankt Peter Ording
2014-06-03 12:19 - 2013-02-27 01:42 - 00136216 _____ () C:\WINDOWS\system32\Drivers\avipbb.sys
Files to move or delete:
====================
C:\Dokumente und Einstellungen\marc\Anwendungsdaten\GoodnightTimer.ini
Some content of TEMP:
====================
C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Temp\avgnt.exe
C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Temp\Quarantine.exe
C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Temp\twppmjph.exe
C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Temp\zupdklus.exe
==================== Bamital & volsnap Check =================
C:\WINDOWS\explorer.exe
[2001-08-23 14:00] - [2008-04-14 07:52] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e
C:\WINDOWS\system32\winlogon.exe
[2001-08-23 14:00] - [2008-04-14 07:53] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a
C:\WINDOWS\system32\svchost.exe
[2001-08-23 14:00] - [2008-04-14 07:53] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366
C:\WINDOWS\system32\services.exe
[2001-08-23 14:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc
C:\WINDOWS\system32\User32.dll
[2001-08-23 14:00] - [2008-04-14 07:52] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd
C:\WINDOWS\system32\userinit.exe
[2001-08-23 14:00] - [2008-04-14 07:53] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106
C:\WINDOWS\system32\rpcss.dll
[2001-08-23 14:00] - [2009-02-09 12:51] - 0401408 ____A (Microsoft Corporation) 3127afbf2c1ed0ab14a1bbb7aaecb85b
ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\WINDOWS\system32\Drivers\volsnap.sys
[2001-08-23 14:00] - [2008-04-14 07:22] - 0053760 ____A ()
C:\WINDOWS\system32\Drivers\volsnap.sys No Company Name <===== ATTENTION!
==================== End Of Log ============================
--- --- ---
Addition (normaler Modus) Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:25-06-2014
Ran by Änö at 2014-06-26 23:20:44
Running from C:\Dokumente und Einstellungen\marc\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: SafenSoft SysWatch (Disabled - Up to date) {38F6975E-7122-4B26-BEFE-60F8C68AB8FB}
==================== Installed Programs ======================
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Advanced Fix 2013 version 2.1.3.83 (HKLM\...\{0094D07C-1FFB-4450-8D10-AD7E05A318DF}_is1) (Version: 2.1.3.83 - Advanced Fix, Inc.)
Avira (HKLM\...\{68e29fba-92b1-4f6f-a604-1d8679da3a9f}) (Version: 1.1.13.24161 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.13.24161 - Avira Operations GmbH & Co. KG) Hidden
CameraHelperMsi (Version: 13.51.815.0 - Logitech) Hidden
Conexant AC-Link Audio (HKLM\...\CNXT_AUDIO) (Version: - )
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Foxit Reader (HKLM\...\Foxit Reader) (Version: 4.1.1.805 - Foxit Software Company)
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Hotfix für Windows XP (KB981793) (HKLM\...\KB981793) (Version: 1 - Microsoft Corporation)
HP Foto- und Bildbearbeitung 2.0 - All-in-One (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Foto und Bildbearbeitung 2.0 - hp psc 1200 series (HKLM\...\HP PSC 1200 Series) (Version: - )
HP Foto- und Bildbearbeitung 2.0 All-in-One Treiber (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
hp psc 1200 series (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )
Logitech Webcam-Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)
LWS Facebook (Version: 13.50.854.0 - Logitech) Hidden
LWS Gallery (Version: 13.51.827.0 - Logitech) Hidden
LWS Help_main (Version: 13.51.828.0 - Logitech) Hidden
LWS Launcher (Version: 13.51.828.0 - Logitech) Hidden
LWS Motion Detection (Version: 13.51.815.0 - Logitech) Hidden
LWS Pictures And Video (Version: 13.51.815.0 - Logitech) Hidden
LWS Twitter (Version: 13.30.1346.0 - Logitech) Hidden
LWS Webcam Software (Version: 13.51.815.0 - Logitech) Hidden
LWS WLM Plugin (Version: 1.30.1201.0 - Logitech) Hidden
LWS YouTube Plugin (Version: 13.31.1038.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU (HKLM\...\{C314CE45-3392-3B73-B4E1-139CD41CA933}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU (HKLM\...\{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 (Version: - Microsoft Corporation) Hidden
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 (Version: - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Software Update for Web Folders (German) 12 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC100_CRT_SP1_x86 (Version: 10.0.40219.1 - Nokia) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
PhotoScape (HKLM\...\PhotoScape) (Version: - )
REALTEK GbE & FE Ethernet PCI NIC Driver (HKLM\...\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}) (Version: 1.23.0000 - Realtek)
REALTEK Gigabit and Fast Ethernet NIC Driver (HKLM\...\{94FB906A-CF42-4128-A509-D353026A607E}) (Version: 1.70 - REALTEK Semiconductor Corp.)
SafenSoft SysWatch (HKLM\...\{D8792A76-0D25-46EA-8927-36396649F229}) (Version: 3.6.36.1631 - SafenSoft)
Sicherheitsupdate für Windows XP (KB923789) (HKLM\...\KB923789) (Version: - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB971961) (HKLM\...\KB971961) (Version: 1 - Microsoft Corporation)
Sicherheitsupdate für Windows XP (KB975713) (HKLM\...\KB975713) (Version: 1 - Microsoft Corporation)
Sophos Virus Removal Tool (HKLM\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.1 - Sophos Limited)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 7.12.3.0 - )
System Requirements Lab CYRI (HKLM\...\{AB49B509-8FCA-45E6-9FB9-9E4AEEB8F148}) (Version: 4.3.1.0 - Husdawg, LLC)
System Requirements Lab for Intel (HKLM\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)
Tenda Wireless LAN Card (HKLM\...\{192BCCC6-C47B-4473-B187-5164185A413C}) (Version: 1.0.0.0 - Tenda)
Tenda Wireless LAN Card (HKLM\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 1.5.12.0 - Tenda)
Toshiba Hotkey Utility (Version: 1.06.02.01 - TOSHIBA) Hidden
TOSHIBA PC-Diagnose-Tool (HKLM\...\PC-Diagnose-Tool) (Version: - )
Toshiba Touchpad Utility (HKLM\...\InstallShield_{F77890F3-774A-4CBE-A2E3-7BB0DC71D1FA}) (Version: 1.06.02.01 - TOSHIBA)
Toshiba Touchpad Utility (Version: 1.06.02.01 - TOSHIBA) Hidden
Trojan Remover 6.9.1.2931 (HKLM\...\Trojan Remover_is1) (Version: 6.9.1.2931 - Simply Super Software)
TuneUp Utilities 2011 (Version: 10.0.4010.25 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (Version: 10.0.4010.25 - TuneUp Software) Hidden
Update für Windows XP (KB980182) (HKLM\...\KB980182) (Version: 1 - Microsoft Corporation)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.6 (HKLM\...\VLC media player) (Version: 2.0.6 - VideoLAN)
WebFldrs XP (Version: 9.50.5318 - Microsoft Corporation) Hidden
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Media Format 11 runtime (Version: - Microsoft Corporation) Hidden
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
Windows Media Player 11 (Version: - Microsoft Corporation) Hidden
XML Paper Specification Shared Components Language Pack 1.0 (Version: - Microsoft Corporation) Hidden
XML Paper Specification Shared Components Pack 1.0 (Version: - Microsoft Corporation) Hidden
XP Codec Pack (HKLM\...\XP Codec Pack) (Version: 2.5.3 - XP Codec Pack team)
Yahoo! Install Manager (HKLM\...\YInstHelper) (Version: - )
Zipeg (HKCU\...\Zipeg) (Version: 2.9.3.1316 - hxxp://zipeg.com)
==================== Restore Points =========================
12-06-2014 14:15:45 Systemprüfpunkt
13-06-2014 16:54:10 Systemprüfpunkt
15-06-2014 17:07:09 Systemprüfpunkt
17-06-2014 11:56:00 Systemprüfpunkt
18-06-2014 12:47:16 Systemprüfpunkt
19-06-2014 14:35:25 Systemprüfpunkt
20-06-2014 15:09:16 Systemprüfpunkt
21-06-2014 15:37:25 Systemprüfpunkt
23-06-2014 16:27:49 Systemprüfpunkt
24-06-2014 17:30:34 Systemprüfpunkt
25-06-2014 23:19:08 Installed Sophos Virus Removal Tool.
26-06-2014 01:20:20 Installed SafenSoft SysWatch.
==================== Hosts content: ==========================
2001-08-23 14:00 - 2011-10-15 15:44 - 00437963 ____N C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 www.123fporn.info
127.0.0.1 123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1324131579.job => C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Programme\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Programme\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-05-14 14:27 - 2014-05-14 14:27 - 00137296 _____ () C:\Programme\Avira\My Avira\Avira.OE.NativeCore.dll
2014-05-14 14:27 - 2014-05-14 14:27 - 00065616 _____ () C:\Programme\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-06-25 18:58 - 2014-05-14 14:27 - 00049744 _____ () C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-04-27 00:43 - 2014-04-27 00:43 - 03642480 _____ () C:\Programme\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UploadMgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
MSCONFIG\startupfolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^McAfee Security Scan Plus.lnk => C:\WINDOWS\pss\McAfee Security Scan Plus.lnkCommon Startup
MSCONFIG\startupfolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Tenda Wireless Utility.lnk => C:\WINDOWS\pss\Tenda Wireless Utility.lnkCommon Startup
MSCONFIG\startupfolder: C:^Dokumente und Einstellungen^marc^Startmenü^Programme^Autostart^Dropbox.lnk => C:\WINDOWS\pss\Dropbox.lnkStartup
MSCONFIG\startupfolder: C:^Dokumente und Einstellungen^marc^Startmenü^Programme^Autostart^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\WINDOWS\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnkStartup
MSCONFIG\startupfolder: C:^Dokumente und Einstellungen^marc^Startmenü^Programme^Autostart^Yahoo! Widgets.lnk => C:\WINDOWS\pss\Yahoo! Widgets.lnkStartup
MSCONFIG\startupreg: Google Update => "C:\Dokumente und Einstellungen\marc\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: iTunesHelper => "C:\Dokumente und Einstellungen\marc\Desktop\iTunesHelper.exe"
MSCONFIG\startupreg: LWS => C:\Programme\Logitech\LWS\Webcam Software\LWS.exe -hide
MSCONFIG\startupreg: NokiaSuite.exe => C:\Programme\Nokia\Nokia Suite\NokiaSuite.exe -tray
MSCONFIG\startupreg: QuickTime Task => "C:\Programme\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPLpr => C:\Programme\Synaptics\SynTP\SynTPLpr.exe
==================== Faulty Device Manager Devices =============
Name: PCI-Modem
Description: PCI-Modem
Class Guid:
Manufacturer:
Service:
Problem: : This device is not configured correctly. (Code1)
Resolution: You may be prompted to provide the path of the driver. Windows may have the driver built-in, or may still have the driver files installed from the last time that you set up the device. If you are asked for the driver and you do not have it, you can try to download the latest driver from the hardware vendor�s Web site.
In the device properties dialog box, click the "Driver" tab, and then click "Update Driver" to start the "Hardware Update Wizard". Follow the instructions to update the driver. If updating the driver does not work, see your hardware documentation for more information.
Name: Microsoft Kernel-Waveaudiomixer
Description: Microsoft Kernel-Waveaudiomixer
Class Guid: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Manufacturer: Microsoft
Service: kmixer
Problem: : Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)
Resolution: Reasons for this error include a driver that is not present; a binary file that is corrupt; a file I/O problem, or a driver that references an entry point in another binary file that could not be loaded.
Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/26/2014 10:55:40 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 10:55:40 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 10:55:40 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 10:55:40 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 04:00:15 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 04:00:15 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 03:56:07 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 03:56:07 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 01:17:21 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
Error: (06/26/2014 01:17:21 PM) (Source: Userenv) (EventID: 1041) (User: NT-AUTORITÄT)
Description: Der Registrierungseintrag DllName konnte für "{7B849a69-220F-451E-B3FE-2CB811AF94AE}" nicht abgerufen und daher auch nicht geladen werden. Dies wurde wahrscheinlich durch eine fehlerhafte Registrierung verursacht.
System errors:
=============
Error: (06/26/2014 03:59:19 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ssmdrv
Error: (06/26/2014 03:58:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "safensec" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/26/2014 03:58:34 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "MBAMService" ist vom Dienst "MBAMProtector" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%31
Error: (06/26/2014 03:58:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMScheduler" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (06/26/2014 03:58:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SnsTdi" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (06/26/2014 03:58:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMProtector" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (06/26/2014 03:58:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avgntflt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (06/26/2014 03:14:00 PM) (Source: DCOM) (EventID: 10005) (User: NT-AUTORITÄT)
Description: Bei DCOM ist der Fehler "%%1084" aufgetreten, als der Dienst "EventSystem" mit den Argumenten ""
gestartet wurde, um den folgenden Server zu verwenden:
{1BE1F766-5536-11D1-B726-00C04FB926AF}
Error: (06/26/2014 03:13:38 PM) (Source: DCOM) (EventID: 10005) (User: MARC-VLEJ7MNMMR)
Description: Bei DCOM ist der Fehler "%%1084" aufgetreten, als der Dienst "StiSvc" mit den Argumenten ""
gestartet wurde, um den folgenden Server zu verwenden:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error: (06/26/2014 03:13:16 PM) (Source: DCOM) (EventID: 10005) (User: MARC-VLEJ7MNMMR)
Description: Bei DCOM ist der Fehler "%%1084" aufgetreten, als der Dienst "StiSvc" mit den Argumenten ""
gestartet wurde, um den folgenden Server zu verwenden:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}
Microsoft Office Sessions:
=========================
Error: (04/25/2012 00:53:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 388 seconds with 300 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 68%
Total physical RAM: 1013.98 MB
Available physical RAM: 317.89 MB
Total Pagefile: 2426.61 MB
Available Pagefile: 1662.62 MB
Total Virtual: 2047.88 MB
Available Virtual: 1958.3 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:55.88 GB) (Free:24.45 GB) NTFS ==>[Drive with boot components (Windows XP)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 56 GB) (Disk ID: 6F5616F9)
Partition 1: (Active) - (Size=56 GB) - (Type=07 NTFS)
==================== End Of Log ============================
GMER hat folgende Fehlermeldung rausgegeben:
LoadDriver( "C:\DOKUME~1\marc\LOKALE~1\Temp\awlcraog.sys" ) error =xCD0000001: Ein dauerhafter Unterschlüssel kann nicht unter einem temporären übergeordneten Schlüssel erstellt werden.
WARNING !!! GMER has found system modification caused by ROOTKIT activity.
GMER log: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-27 00:52:48
Windows 5.1.2600 Service Pack 3
Running: Gmer-19357.exe
---- Services - GMER 2.1 ----
Service C:\WINDOWS\System32\Drivers\a127b2c0fb888938.sys (*** hidden *** ) [BOOT] a127b2c0fb888938 <-- ROOTKIT !!!
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938@ImagePath \SystemRoot\System32\Drivers\a127b2c0fb888938.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938@Group Boot Bus Extender
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938@Tag 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938@DisplayName syshost.exe
Reg HKLM\SYSTEM\CurrentControlSet\Services\a127b2c0fb888938
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 4880
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters@DhcpNameServer 192.168.2.1
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{73079E0F-C68E-4598-BE82-5269CEDD9BB9}@DhcpRetryTime 2147483647
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{73079E0F-C68E-4598-BE82-5269CEDD9BB9}@DhcpRetryStatus 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{73079E0F-C68E-4598-BE82-5269CEDD9BB9}@DhcpDefaultGateway 192.168.2.1?
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{73079E0F-C68E-4598-BE82-5269CEDD9BB9}@DhcpSubnetMaskOpt 255.255.255.0?
Reg HKLM\SYSTEM\CurrentControlSet\Services\{73079E0F-C68E-4598-BE82-5269CEDD9BB9}\Parameters\Tcpip@DhcpDefaultGateway 192.168.2.1?
Reg HKLM\SYSTEM\CurrentControlSet\Services\{73079E0F-C68E-4598-BE82-5269CEDD9BB9}\Parameters\Tcpip@DhcpSubnetMaskOpt 255.255.255.0?
Reg HKLM\SYSTEM\ControlSet002\Services\a127b2c0fb888938@ImagePath \SystemRoot\System32\Drivers\a127b2c0fb888938.sys
Reg HKLM\SYSTEM\ControlSet002\Services\a127b2c0fb888938@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\Services\a127b2c0fb888938@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\a127b2c0fb888938@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\a127b2c0fb888938@Start 0
Reg HKLM\SYSTEM\ControlSet002\Services\a127b2c0fb888938@Tag 1
Reg HKLM\SYSTEM\ControlSet002\Services\a127b2c0fb888938@DisplayName syshost.exe
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList@V.I.P.O \xae 0
---- EOF - GMER 2.1 ----
| 
WARNUNG an die MITLESER: