Trojaner-Board - BSI Scan positiv + Rechner schon lange extrem langsam

Hi,

sorry, wußte nicht dass ich nach Anleitung unter Code-Text suchen musste
Danke für die schnelle Antwort! :dankeschoen:
Hier nun das Ergebnis

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-01-2014

Ran by Saturn (administrator) on ACER-ANDREA on 23-01-2014 09:31:00

Running from C:\Dokumente und Einstellungen\Saturn\Desktop

Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: German Standard

Internet Explorer Version 8

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) ===================
 

(AVAST Software) C:\Programme\AVAST Software\Avast\AvastSvc.exe

(Microsoft Corporation) C:\WINDOWS\system32\scardsvr.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe

() C:\WINDOWS\system32\afasrv32.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe

(GreenPrint Technologies LLC.) C:\Programme\GreenPrint\gpsrht01.exe

(Oracle Corporation) C:\Programme\Java\jre7\bin\jqs.exe

(Nalpeiron Ltd.) C:\WINDOWS\system32\NLSSRV32.EXE

() C:\Programme\CDBurnerXP\NMSAccessU.exe

(TeamViewer GmbH) C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe

(GreenPrint Technologies LLC.) C:\Programme\GreenPrint\gpsrdg01.exe

() C:\Programme\ResultsAlpha\bin\utilResultsAlpha.exe

(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPEnh.exe

(sonix) C:\WINDOWS\PLFSetL.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe

(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE

(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

() C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dlprotect.exe

(Safer-Networking Ltd.) C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

(Macrovision Corporation) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe

(Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Programme\Evernote\Evernote\EvernoteClipper.exe

(Realtek Semiconductor Corp.) C:\Dokumente und Einstellungen\Saturn\Lokale Einstellungen\Temp\RtkBtMnt.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe

(Microsoft Corporation) C:\WINDOWS\system32\cisvc.exe

(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe

(Mozilla Corporation) C:\Programme\Mozilla Firefox\firefox.exe

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avcenter.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [LaunchApp] - Alaunch

HKLM\...\Run: [SynTPEnh] - C:\Programme\Synaptics\SynTP\SynTPEnh.exe [1044480 2008-04-25] (Synaptics, Inc.)

HKLM\...\Run: [PLFSetL] - C:\WINDOWS\PLFSetL.exe [94208 2007-07-05] (sonix)

HKLM\...\Run: [avgnt] - C:\Programme\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [RTHDCPL] - C:\WINDOWS\RTHDCPL.EXE [20143688 2013-03-12] (Realtek Semiconductor Corp.)

HKLM\...\Run: [KernelFaultCheck] - %systemroot%\system32\dumprep 0 -k

HKLM\...\Run: [Download Protect] - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dlprotect.exe [12800 2014-01-06] ()

HKLM\...\Winlogon: [UIHost] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe [x ] ()

HKLM\...\Policies\Explorer: [NoStrCmpLogical] 1

HKLM\...\Policies\Explorer: [NoCDBurning] 0

HKCU\...\Run: [SpybotSD TeaTimer] - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)

HKCU\...\Run: [ISUSPM] - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe [222128 2007-03-29] (Macrovision Corporation)

HKCU\...\Run: [ShowBatteryBar] - C:\Programme\BatteryBar\ShowBatteryBar.exe [90624 2013-04-11] ()

HKCU\...\Policies\Explorer: [NoRecentDocsNetHood] 1

MountPoints2: {a7ec3311-0403-11de-ac82-00234d717b27} - E:\Menu.exe

MountPoints2: {dc1422ac-7432-11de-ac8e-00234d717b27} - I:\start.exe

MountPoints2: {dec47112-cc69-11dd-ac5a-00234d717b27} - D:\StartVMCLite.exe

MountPoints2: {dec47113-cc69-11dd-ac5a-00234d717b27} - D:\StartVMCLite.exe

MountPoints2: {eeac84e2-cbe3-11dd-ac57-00234d717b27} - D:\StartVMCLite.exe

MountPoints2: {eeac84e3-cbe3-11dd-ac57-00234d717b27} - E:\StartVMCLite.exe

AppInit_DLLs: c:\progra~1\greenp~1\gphknt32.dll => C:\Programme\GreenPrint\gphknt32.dll [305744 2013-01-29] (GreenPrint Technologies LLC.)

Startup: C:\Dokumente und Einstellungen\Saturn\Startmenü\Programme\Autostart\EvernoteClipper.lnk

ShortcutTarget: EvernoteClipper.lnk -> C:\Programme\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10395&gct=hp&dc=EU&locale=de_DE

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie

SearchScopes: HKLM - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus

SearchScopes: HKCU - {E03BE991-7500-491A-8E85-844437762FD3} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=0F717869-5676-4A6E-B910-962E08FF56A7&apn_sauid=E1699991-BE31-4891-9463-0EEF4F826DF0

BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Programme\PDF Architect\PDFIEHelper.dll No File

BHO: No Name - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -  No File

BHO: ResultsAlpha - {cbab673a-a480-4050-bd2b-5de24a7a0282} - C:\Programme\ResultsAlpha\ResultsAlphabho.dll (ResultsAlpha)

BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)

Toolbar: HKLM - FireShot - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} -  No File

Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229468276286

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
 

FireFox:

========

FF ProfilePath: C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default

FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Ask.com

FF Homepage: https://www.google.de/

FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Programme\PDF XChange Viewer\npPDFXCviewNPPlugin.dll No File

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Programme\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Programme\PDF XChange Viewer\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Programme\PDF XChange Viewer\npPDFXCviewNPPlugin.dll No File

FF Plugin ProgramFiles/Appdata: C:\Programme\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF SearchPlugin: C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\searchplugins\11-suche.xml

FF SearchPlugin: C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\searchplugins\askcom.xml

FF SearchPlugin: C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\searchplugins\lastminute.xml

FF SearchPlugin: C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\searchplugins\webde-suche.xml

FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: vis - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2014-01-14]

FF Extension: Xmarks - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\foxmarks@kei.com [2013-05-21]

FF Extension: DownloadHelper - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-28]

FF Extension: Bitdefender QuickScan - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2012-10-09]

FF Extension: Add to Amazon Wish List Button - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\amznUWL2@amazon.com.xpi [2013-04-30]

FF Extension: facepaste - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\facepaste.firefox.addon@azabani.com.xpi [2013-06-04]

FF Extension: Clearly - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\readable@evernote.com.xpi [2013-06-11]

FF Extension: Session Manager - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2012-10-08]

FF Extension: FlashGot - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2012-10-08]

FF Extension: Adblock Plus - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-08]

FF Extension: Tab Mix Plus - C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\Extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi [2012-10-08]

FF Extension: No Name - C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-12-27]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\PROGRA~1\AVASTS~1\Avast\WebRep\FF

FF Extension: avast! WebRep - C:\PROGRA~1\AVASTS~1\Avast\WebRep\FF [2012-10-17]

FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\ff\

FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\plugins\ff\ []

FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Programme\PDF Architect\FFPDFArchitectExt

FF Extension: No Name - C:\Programme\PDF Architect\FFPDFArchitectExt [2013-07-04]
 

========================== Services (Whitelisted) =================
 

R2 AfaService; C:\WINDOWS\system32\afasrv32.exe [65536 2010-04-29] ()

R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)

R2 avast! Antivirus; C:\Programme\AVAST Software\Avast\AvastSvc.exe [44808 2012-08-21] (AVAST Software)

R2 GreenPrint; c:\programme\greenprint\GPSRHT01.exe [352808 2013-01-29] (GreenPrint Technologies LLC.)

S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2012-08-29] (Google Inc.)

S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2012-08-29] (Google Inc.)

S3 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2012-08-30] (Google)

S3 HP Port Resolver; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE [81920 2005-05-20] (Hewlett-Packard Company)

S3 HP Status Server; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE [73728 2004-10-16] (Hewlett-Packard Company)

R2 JavaQuickStarterService; C:\Programme\Java\jre7\bin\jqs.exe [181664 2013-05-02] (Oracle Corporation)

S3 McComponentHostService; C:\Programme\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [119408 2013-12-27] (Mozilla Foundation)

R2 NMSAccess; C:\Programme\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()

S3 Sony PC Companion; C:\Programme\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)

R2 TeamViewer8; C:\Programme\TeamViewer\Version8\TeamViewer_Service.exe [3574624 2013-04-23] (TeamViewer GmbH)

S4 TuneUp.Defrag; C:\Windows\System32\TuneUpDefragService.exe [361288 2010-02-02] (TuneUp Software)

S4 TuneUp.ProgramStatisticsSvc; C:\Windows\System32\TUProgSt.exe [604488 2010-02-02] (TuneUp Software)

S2 Update ResultsAlpha; C:\Programme\ResultsAlpha\updateResultsAlpha.exe [97056 2014-01-16] ()

R2 Util ResultsAlpha; C:\Programme\ResultsAlpha\bin\utilResultsAlpha.exe [97056 2014-01-14] ()

S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)

S2 ADExchange; C:\Programme\Gemeinsame Dateien\ArcSoft\esinter\Bin\eservutil.exe [x]

S2 PDF Architect Helper Service; "C:\Programme\PDF Architect\HelperService.exe" [x]

S2 PDF Architect Service; "C:\Programme\PDF Architect\ConversionService.exe" [x]
 

==================== Drivers (Whitelisted) ====================
 

R1 Aavmker4; C:\Windows\System32\Drivers\Aavmker4.sys [25256 2012-08-21] (AVAST Software)

R0 abp480n5; C:\Windows\System32\DRIVERS\ABP480N5.SYS [23552 2008-04-13] (Microsoft Corporation)

S3 AF15BDA; C:\Windows\System32\DRIVERS\AF15BDA.sys [449408 2008-04-29] (AfaTech                  )

S3 Ambfilt; C:\Windows\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)

R3 AR5416; C:\Windows\System32\DRIVERS\athw.sys [1312576 2008-05-20] (Atheros Communications, Inc.)

R2 aswMon2; C:\Windows\System32\Drivers\aswMon2.sys [97608 2012-08-21] (AVAST Software)

R1 AswRdr; C:\Windows\System32\Drivers\AswRdr.sys [35928 2012-08-21] (AVAST Software)

R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [729752 2012-08-21] (AVAST Software)

R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [355632 2012-08-21] (AVAST Software)

R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [54232 2012-08-21] (AVAST Software)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)

S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)

S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49664 2006-04-13] (HP)

S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2006-04-13] (HP)

S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2006-04-13] (HP)

R3 int15.sys; C:\Acer\Empowering Technology\eRecovery\int15.sys [69632 2005-01-13] ()

S3 Monfilt; C:\Windows\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)

S3 MPE; C:\Windows\System32\DRIVERS\MPE.sys [15232 2008-04-14] (Microsoft Corporation)

S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)

S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [104744 2009-03-25] (MCCI Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1769984 2007-10-01] ()

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)

R2 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2009-11-12] ()

S2 aswFsBlk; aswFsBlk.sys [x]

S3 MHIKEY10; System32\Drivers\MHIKEY10.sys [x]

U1 WS2IFSL; 
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-01-23 09:31 - 2014-01-23 09:32 - 00020548 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\FRST.txt

2014-01-23 09:27 - 2014-01-23 09:27 - 00000000 ____D C:\FRST

2014-01-23 08:36 - 2014-01-23 08:37 - 01222144 _____ (Farbar) C:\Dokumente und Einstellungen\Saturn\Desktop\FRST.exe

2014-01-22 21:56 - 2014-01-22 21:56 - 00001861 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\Entfernen des Avira PC Cleaners.lnk

2014-01-22 21:56 - 2014-01-22 21:56 - 00001805 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\Avira PC Cleaner.lnk

2014-01-21 15:01 - 2008-04-13 22:00 - 02178131 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\shvlres.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 01817687 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\bckgres.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 01175635 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hrtzres.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 01042515 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\cmnresm.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00781397 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\chkrres.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00753236 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\rvseres.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00539136 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\spider.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\spider.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00282624 ____C (Cinematronics) C:\WINDOWS\system32\dllcache\pinball.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00217160 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\cmnclim.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00128000 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mshearts.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshearts.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00120320 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\winmine.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmine.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00113222 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\zoneclim.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00082501 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\bckg.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00066113 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\shvl.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00057409 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hrtz.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00057344 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\sol.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\sol.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00055808 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\freecell.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\freecell.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00048706 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\rvse.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00042577 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\bckgzm.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00042575 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\chkrzm.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00042574 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\rvsezm.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00042573 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\shvlzm.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00042573 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hrtzzm.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00041029 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\zcorem.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00040515 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\chkr.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00036937 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\zclientm.exe

2014-01-21 15:01 - 2008-04-13 22:00 - 00032339 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\uniansi.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00029760 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\znetm.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00013894 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\zonelibm.dll

2014-01-21 15:01 - 2008-04-13 22:00 - 00004677 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\zeeverm.dll

2014-01-21 09:19 - 2014-01-21 09:19 - 00001502 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\Rechner (2).lnk

2014-01-21 09:09 - 2008-04-13 22:00 - 00683520 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\getuname.dll

2014-01-21 09:09 - 2008-04-13 22:00 - 00346624 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mspaint.exe

2014-01-21 09:09 - 2008-04-13 22:00 - 00216064 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\wordpad.exe

2014-01-21 09:09 - 2008-04-13 22:00 - 00114688 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\calc.exe

2014-01-21 09:09 - 2008-04-13 22:00 - 00080896 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\charmap.exe

2014-01-21 09:09 - 2008-04-13 22:00 - 00005632 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\write.exe

2014-01-21 09:08 - 2014-01-21 15:01 - 00000000 ____D C:\WINDOWS\LastGood

2014-01-21 09:08 - 2008-04-13 22:00 - 00104448 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\clipbrd.exe

2014-01-15 17:56 - 2014-01-15 17:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2014-01-15 17:53 - 2014-01-15 17:56 - 00004704 _____ C:\WINDOWS\KB2914368.log

2014-01-10 19:35 - 2014-01-10 19:35 - 00186352 _____ C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

2014-01-06 22:49 - 2014-01-06 22:49 - 00012800 _____ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dlprotect.exe

2014-01-06 22:47 - 2014-01-07 06:50 - 00000000 ____D C:\Programme\ResultsAlpha

2014-01-06 22:43 - 2014-01-06 22:43 - 00000000 ____D C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Windows Net Data

2014-01-06 22:01 - 2014-01-06 22:01 - 00000540 _____ C:\WINDOWS\wmsetup.log

2014-01-06 21:56 - 2014-01-21 15:03 - 00067519 _____ C:\WINDOWS\tsoc.log

2014-01-06 21:56 - 2014-01-21 15:03 - 00043777 _____ C:\WINDOWS\comsetup.log

2014-01-06 21:56 - 2014-01-21 15:03 - 00035966 _____ C:\WINDOWS\ntdtcsetup.log

2014-01-06 21:56 - 2014-01-21 15:03 - 00011780 _____ C:\WINDOWS\iis6.log

2014-01-06 21:56 - 2014-01-21 15:03 - 00009321 _____ C:\WINDOWS\ocmsn.log

2014-01-06 21:56 - 2014-01-21 15:03 - 00008180 _____ C:\WINDOWS\msgsocm.log

2014-01-06 21:56 - 2014-01-21 15:03 - 00004566 _____ C:\WINDOWS\imsins.log

2014-01-06 21:56 - 2014-01-21 14:59 - 00020714 _____ C:\WINDOWS\setupapi.log

2014-01-06 21:56 - 2014-01-21 09:15 - 00004566 _____ C:\WINDOWS\imsins.BAK

2014-01-06 21:56 - 2014-01-06 21:56 - 00000000 _____ C:\WINDOWS\setuperr.log

2014-01-06 21:56 - 2014-01-06 21:56 - 00000000 _____ C:\WINDOWS\setupact.log

2014-01-06 21:55 - 2014-01-21 15:03 - 00147180 _____ C:\WINDOWS\ocgen.log

2014-01-06 21:55 - 2014-01-21 15:02 - 00132860 _____ C:\WINDOWS\FaxSetup.log

2013-12-27 20:55 - 2013-12-27 20:57 - 00000000 ____D C:\Programme\Mozilla Firefox
 

==================== One Month Modified Files and Folders =======
 

2014-01-23 09:32 - 2014-01-23 09:31 - 00020548 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\FRST.txt

2014-01-23 09:32 - 2008-12-19 23:13 - 00000416 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{669307CE-96C7-4F68-AC8E-1CCA34E106EB}.job

2014-01-23 09:27 - 2014-01-23 09:27 - 00000000 ____D C:\FRST

2014-01-23 09:21 - 2011-10-03 20:56 - 00000258 _____ C:\WINDOWS\Tasks\Clean System Memory.job

2014-01-23 09:17 - 2013-05-30 14:38 - 00031776 _____ C:\WINDOWS\SchedLgU.Txt

2014-01-23 09:00 - 2009-12-04 00:08 - 00000494 _____ C:\WINDOWS\Tasks\1-Klick-Wartung.job

2014-01-23 08:39 - 2012-08-29 20:01 - 00001090 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-01-23 08:37 - 2014-01-23 08:36 - 01222144 _____ (Farbar) C:\Dokumente und Einstellungen\Saturn\Desktop\FRST.exe

2014-01-23 08:21 - 2013-05-30 14:33 - 01922620 _____ C:\WINDOWS\WindowsUpdate.log

2014-01-23 08:09 - 2012-10-13 16:53 - 00000356 ____H C:\WINDOWS\Tasks\avast! Emergency Update.job

2014-01-22 21:56 - 2014-01-22 21:56 - 00001861 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\Entfernen des Avira PC Cleaners.lnk

2014-01-22 21:56 - 2014-01-22 21:56 - 00001805 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\Avira PC Cleaner.lnk

2014-01-22 17:25 - 2013-05-30 14:39 - 00000419 _____ C:\WINDOWS\wiadebug.log

2014-01-22 13:10 - 2011-11-17 14:02 - 00000000 ____D C:\Dokumente und Einstellungen\Saturn\Eigene Dateien\Andrea AKTUELL

2014-01-21 17:45 - 2013-07-24 11:29 - 00000000 ____D C:\Programme\ScreenshotCaptor

2014-01-21 17:26 - 2009-02-09 01:18 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype

2014-01-21 17:25 - 2012-02-17 00:14 - 00000000 ____D C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Skype

2014-01-21 17:25 - 2012-02-17 00:13 - 00000000 ___RD C:\Programme\Skype

2014-01-21 17:25 - 2008-08-21 00:12 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme

2014-01-21 17:20 - 2012-09-12 04:44 - 00000000 ____D C:\Programme\VS Revo Group

2014-01-21 17:20 - 2008-10-21 16:34 - 00000000 ___RD C:\Dokumente und Einstellungen\Saturn\Startmenü\Programme

2014-01-21 16:43 - 2013-04-27 09:40 - 00000000 ____D C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Aquamarin Haushaltsbuch

2014-01-21 15:09 - 2008-08-20 23:31 - 00000000 ____D C:\WINDOWS\security

2014-01-21 15:03 - 2014-01-06 21:56 - 00067519 _____ C:\WINDOWS\tsoc.log

2014-01-21 15:03 - 2014-01-06 21:56 - 00043777 _____ C:\WINDOWS\comsetup.log

2014-01-21 15:03 - 2014-01-06 21:56 - 00035966 _____ C:\WINDOWS\ntdtcsetup.log

2014-01-21 15:03 - 2014-01-06 21:56 - 00011780 _____ C:\WINDOWS\iis6.log

2014-01-21 15:03 - 2014-01-06 21:56 - 00009321 _____ C:\WINDOWS\ocmsn.log

2014-01-21 15:03 - 2014-01-06 21:56 - 00008180 _____ C:\WINDOWS\msgsocm.log

2014-01-21 15:03 - 2014-01-06 21:56 - 00004566 _____ C:\WINDOWS\imsins.log

2014-01-21 15:03 - 2014-01-06 21:55 - 00147180 _____ C:\WINDOWS\ocgen.log

2014-01-21 15:02 - 2014-01-06 21:55 - 00132860 _____ C:\WINDOWS\FaxSetup.log

2014-01-21 15:02 - 2008-08-21 08:25 - 01401292 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2014-01-21 15:02 - 2008-08-20 23:27 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Spiele

2014-01-21 15:01 - 2014-01-21 09:08 - 00000000 ____D C:\WINDOWS\LastGood

2014-01-21 15:01 - 2008-08-20 23:59 - 00000000 ____D C:\WINDOWS\Help

2014-01-21 15:01 - 2008-08-20 23:27 - 00000000 ____D C:\WINDOWS\Cursors

2014-01-21 15:00 - 2008-08-20 23:28 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Zubehör

2014-01-21 14:59 - 2014-01-06 21:56 - 00020714 _____ C:\WINDOWS\setupapi.log

2014-01-21 09:19 - 2014-01-21 09:19 - 00001502 _____ C:\Dokumente und Einstellungen\Saturn\Desktop\Rechner (2).lnk

2014-01-21 09:15 - 2014-01-06 21:56 - 00004566 _____ C:\WINDOWS\imsins.BAK

2014-01-20 23:36 - 2012-06-25 15:34 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-01-19 22:14 - 2012-08-29 20:01 - 00001086 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-01-19 22:13 - 2013-05-30 14:39 - 00000050 _____ C:\WINDOWS\wiaservc.log

2014-01-19 22:13 - 2008-08-21 08:42 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2014-01-19 22:10 - 2008-10-21 16:34 - 00000190 ___SH C:\Dokumente und Einstellungen\Saturn\ntuser.ini

2014-01-19 22:10 - 2008-10-21 16:34 - 00000000 ____D C:\Dokumente und Einstellungen\Saturn

2014-01-18 19:09 - 2012-10-14 15:54 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy

2014-01-15 20:37 - 2008-08-20 23:39 - 00000000 ____D C:\WINDOWS\Registration

2014-01-15 18:15 - 2013-07-22 20:58 - 00000000 ____D C:\WINDOWS\system32\MRT

2014-01-15 17:59 - 2008-12-27 19:30 - 83425928 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2014-01-15 17:56 - 2014-01-15 17:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2014-01-15 17:56 - 2014-01-15 17:53 - 00004704 _____ C:\WINDOWS\KB2914368.log

2014-01-14 21:20 - 2008-08-21 00:12 - 00000000 ___RD C:\Programme

2014-01-14 08:57 - 2012-10-16 09:42 - 00000000 ____D C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\QuickScan

2014-01-10 19:35 - 2014-01-10 19:35 - 00186352 _____ C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

2014-01-07 06:50 - 2014-01-06 22:47 - 00000000 ____D C:\Programme\ResultsAlpha

2014-01-06 22:49 - 2014-01-06 22:49 - 00012800 _____ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dlprotect.exe

2014-01-06 22:43 - 2014-01-06 22:43 - 00000000 ____D C:\Dokumente und Einstellungen\Saturn\Anwendungsdaten\Windows Net Data

2014-01-06 22:01 - 2014-01-06 22:01 - 00000540 _____ C:\WINDOWS\wmsetup.log

2014-01-06 22:00 - 2008-08-20 23:27 - 00000000 ____D C:\WINDOWS\addins

2014-01-06 21:56 - 2014-01-06 21:56 - 00000000 _____ C:\WINDOWS\setuperr.log

2014-01-06 21:56 - 2014-01-06 21:56 - 00000000 _____ C:\WINDOWS\setupact.log

2014-01-05 18:07 - 2012-10-08 09:18 - 00000000 ____D C:\Programme\Mozilla Maintenance Service

2014-01-05 16:43 - 2013-07-04 11:20 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PDF Architect

2014-01-05 16:43 - 2013-06-07 21:25 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Perfect365

2013-12-27 20:57 - 2013-12-27 20:55 - 00000000 ____D C:\Programme\Mozilla Firefox

2013-12-25 13:10 - 2008-10-21 16:34 - 00000000 ___RD C:\Dokumente und Einstellungen\Saturn\Eigene Dateien\Eigene Bilder
 

Some content of TEMP:

====================

C:\Dokumente und Einstellungen\Saturn\Lokale Einstellungen\Temp\avgnt.exe

C:\Dokumente und Einstellungen\Saturn\Lokale Einstellungen\Temp\RtkBtMnt.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe

[2008-04-13 22:00] - [2008-04-13 22:00] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e 
 

C:\Windows\System32\winlogon.exe

[2008-04-13 22:00] - [2008-04-13 22:00] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a 
 

C:\Windows\System32\svchost.exe

[2008-04-13 22:00] - [2008-04-13 22:00] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366 
 

C:\Windows\System32\services.exe

[2008-04-13 22:00] - [2009-02-09 12:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc 
 

C:\Windows\System32\User32.dll

[2008-04-13 22:00] - [2008-04-13 22:00] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd 
 

C:\Windows\System32\userinit.exe

[2008-04-13 22:00] - [2008-04-13 22:00] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106 
 

C:\Windows\System32\rpcss.dll

[2008-04-13 22:00] - [2009-02-09 11:51] - 0401408 ____A (Microsoft Corporation) 3127afbf2c1ed0ab14a1bbb7aaecb85b 
 

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.

C:\Windows\System32\Drivers\volsnap.sys

[2008-04-13 22:00] - [2008-04-13 22:00] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d 
 
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-01-2014

Ran by Saturn at 2014-01-23 09:34:03

Running from C:\Dokumente und Einstellungen\Saturn\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: avast! Antivirus (Disabled - Up to date) {7591DB91-41F0-48A3-B128-1A293FD8233D}
 

==================== Installed Programs ======================
 

62759 DVB-T x86 (Version: 2.00.0000 - Ihr Firmenname)

Acer Crystal Eye webcam (Version: 5.8.33.001 - Sonix)

Acer ScreenSaver (Version: 1.11.0613 - Acer Incorporated)

Acer System Information (Version: 1.0.0 - Acer)

Adobe Digital Editions 2.0 (Version: 2.0 - Adobe Systems Incorporated)

Adobe Flash Player 11 ActiveX (Version: 11.9.900.170 - Adobe Systems Incorporated)

Adobe Flash Player 11 Plugin (Version: 11.9.900.170 - Adobe Systems Incorporated)

AiO_Scan_CDA (Version: 70.0.231.000 - Hewlett-Packard) Hidden

AiOSoftwareNPI (Version: 70.0.231.000 - Hewlett-Packard) Hidden

Anti-Twin (Installation 04.12.2009) (Version:  - Joerg Rosenthal, Germany)

Aquamarin Haushaltsbuch 2.9.2 b (Version:  - makasy.com)

Atheros for Acer Driver v7.6.0.224_Foxconn Installation Program (Version: 7.6.0.224 - Atheros)

Avanquest update (Version: 1.34 - Avanquest Software)

Avira Free Antivirus (Version: 14.0.2.286 - Avira)

BatteryBar (remove only) (Version:  - )

BufferChm (Version: 70.0.170.000 - Hewlett-Packard) Hidden

C3100 (Version: 70.0.231.000 - Hewlett-Packard) Hidden

c3100_Help (Version: 70.0.231.000 - Hewlett-Packard) Hidden

CCleaner (Version: 4.04 - Piriform)

CDBurnerXP (Version: 4.3.8.2631 - CDBurnerXP)

CleanMem (Version: v2.1.1 - PcWinTech.com)

Corona Visualization Plug-in for WMP (Version: 1.0.0 - Richard Asbury)

CustomerResearchQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

Destinations (Version: 70.0.170.000 - Hewlett-Packard) Hidden

DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

eSupportQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

Evernote v. 4.6.6 (Version: 4.6.6.8360 - Evernote Corp.)

Fax_CDA (Version: 70.0.231.000 - Hewlett-Packard) Hidden

FinePrint (Version:  - )

Free Studio version 2013 (Version: 6.1.1.430 - DVDVideoSoft Ltd.)

FreeFileSync v4.1 (Version: 4.1 - ZenJu)

Google Earth Plug-in (Version: 7.1.2.2041 - Google)

Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden

GreenPrint (Version: 2.6.0 - GreenPrint Technologies)

Hewlett-Packard ACLM.NET v1.1.0.0 (Version: 1.00.0000 - Hewlett-Packard) Hidden

HP Customer Participation Program 7.0 (Version: 7.0 - HP)

HP Driver Diagnostics (Version: 1.03.0009 - Ihr Firmenname)

HP Imaging Device Functions 7.0 (Version: 7.0 - HP)

HP Photosmart, Officejet and Deskjet 7.0.A (Version:  - HP)

HP Product Assistant (Version: 100.000.001.000 - Hewlett-Packard) Hidden

HP Product Detection (Version: 11.14.0001 - HP)

HP Solution Center 7.0 (Version: 7.0 - HP)

HP Update (Version: 5.003.001.001 - Hewlett-Packard)

HPPhotoSmartExpress (Version: 70.0.170.000 - Hewlett-Packard) Hidden

HPProductAssistant (Version: 70.0.170.000 - Hewlett-Packard) Hidden

InstantShareAlert (Version: 1.00.0000 - HP) Hidden

InstantShareDevicesMFC (Version: 70.0.170.000 - Hewlett-Packard) Hidden

Intel(R) Graphics Media Accelerator Driver (Version:  - )

IrfanView (remove only) (Version:  - )

Java 7 Update 21 (Version: 7.0.210 - Oracle)

Java Auto Updater (Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden

JMicron JMB38X Flash Media Controller (Version: 1.00.16.01 - JMicron Technology Corp.)

Launch Manager (Version:  - )

Lingoes 2.9.1 (Version: 2.9.1 - Lingoes Project)

MarketResearch (Version: 70.0.170.000 - Hewlett-Packard) Hidden

McAfee Security Scan Plus (Version: 3.0.318.3 - McAfee, Inc.)

Mediencenter 3.7.0.2204 (HKCU Version: 3.7.0.2204 - Deutsche Telekom AG)

Microsoft .NET Framework 1.1 (Version:  - )

Microsoft .NET Framework 1.1 (Version: 1.1.4322 - Microsoft) Hidden

Microsoft .NET Framework 1.1 German Language Pack (Version: 1.1.4322 - Microsoft)

Microsoft .NET Framework 1.1 Security Update (KB2698023) (Version:  - )

Microsoft .NET Framework 1.1 Security Update (KB2833941) (Version:  - )

Microsoft .NET Framework 1.1 Security Update (KB979906) (Version:  - )

Microsoft .NET Framework 2.0 Language Pack - DEU (Version:  - Microsoft Corporation)

Microsoft .NET Framework 2.0 Language Pack - DEU (Version: 1.1.50727.42 - Microsoft Corporation) Hidden

Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.0 German Language Pack (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.0 German Language Pack (Version: 3.0.04506.30 - Microsoft Corporation) Hidden

Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729 - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden

Microsoft Office Word 2007 Schnellstartleiste (Version: 12.0.0 - Microsoft Corporation)

Microsoft Pro Photo Tools (Version: 2.2 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Core Components (x86) ENU  (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Sync Framework 2.0 Provider Services (x86) ENU  (Version: 2.0.1578.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (Version: 9.0.30411 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Works (Version: 08.05.0822 - Microsoft Corporation)

Mozilla Firefox 26.0 (x86 de) (Version: 26.0 - Mozilla)

Mozilla Maintenance Service (Version: 26.0 - Mozilla)

MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 6.0 Parser (Version: 6.10.1129.0 - Microsoft Corporation)

MyPhoneExplorer (Version: 1.8.4 - F.J. Wechselberger)

neroxml (Version: 1.0.0 - Nero AG) Hidden

NewCopy_CDA (Version: 70.0.231.000 - Hewlett-Packard) Hidden

OpenOffice 4.0.0 (Version: 4.00.9702 - Apache Software Foundation)

Paint.NET v3.5.10 (Version: 3.60.0 - dotPDN LLC)

PanoStandAlone (Version: 70.0.170.000 - Hewlett-Packard) Hidden

PDF Architect (Version: 1.1.83.9982 - pdfforge GmbH)

PDFCreator (Version: 1.7.0 - pdfforge)

PDF-Viewer (Version: 2.0.54.0 - Tracker Software Products Ltd)

Picasa 3 (Version: 3.9 - Google, Inc.)

Presto! PVR (Version: 5.00.00 - )

ProductContextNPI (Version: 70.0.231.000 - Hewlett-Packard) Hidden

Readme (Version: 70.0.231.000 - Hewlett-Packard) Hidden

REALTEK GbE & FE Ethernet PCI-E NIC Driver (Version: 1.17.0000 - Realtek)

Realtek High Definition Audio Driver (Version: 5.10.0.6873 - Realtek Semiconductor Corp.)

ResultsAlpha (Version: 2013.11.20.232030 - ResultsAlpha)

Scan (Version: 7.0.0.0 - Hewlett-Packard) Hidden

ScannerCopy (Version: 7.0.0.0 - Hewlett-Packard) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB938127-v2) (Version: 2 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB958215) (Version: 1 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB961260) (Version: 1 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB963027) (Version: 1 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB969897) (Version: 1 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB972260) (Version: 1 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB974455) (Version: 1 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 7 (KB976325) (Version: 1 - Microsoft Corporation) Hidden

Sicherheitsupdate für Windows Internet Explorer 8 (KB2183461) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2360131) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2416400) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2482017) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2510531) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2544521) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2559049) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2586448) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2647516) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2675157) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2699988) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2722913) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2744842) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2761465) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2792100) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2797052) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2799329) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2809289) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2817183) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2829530) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2838727) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2846071) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2847204) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2862772) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2879017) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2888505) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB2898785) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB971961) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB976325) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB978207) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB981332) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Internet Explorer 8 (KB982381) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows Media Player (KB2834904-v2) (Version:  - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2847311) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2849470) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2850869) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2859537) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862152) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862330) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2862335) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2864063) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2868626) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2876217) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2876331) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2883150) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2892075) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2893294) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2893984) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2898715) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2900986) (Version: 1 - Microsoft Corporation)

Sicherheitsupdate für Windows XP (KB2914368) (Version: 1 - Microsoft Corporation)

SolutionCenter (Version: 70.0.170.000 - Hewlett-Packard) Hidden

Sony PC Companion 2.10.165 (Version: 2.10.165 - Sony)

Spybot - Search & Destroy (Version: 1.6.2 - Safer Networking Limited)

Status (Version: 70.0.170.000 - Hewlett-Packard) Hidden

Synaptics Pointing Device Driver (Version: 11.1.4.0 - Synaptics)

SyncToy 2.1 (x86) (Version: 2.1.0 - Microsoft)

TeamViewer 8 (Version: 8.0.18051 - TeamViewer)

Toolbox (Version: 70.0.170.000 - Hewlett-Packard) Hidden

TrayApp (Version: 70.0.170.000 - Hewlett-Packard) Hidden

TuneUp Utilities 2009 (Version: 8.0.3310.3 - TuneUp Software)

Universal Extractor 1.6 (Version: 1.6 - Jared Breland)

Unload (Version: 7.0.0 - Hewlett-Packard) Hidden

Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)

Update für Windows Internet Explorer 7 (KB976749) (Version: 1 - Microsoft Corporation) Hidden

Update für Windows Internet Explorer 8 (KB975364) (Version: 1 - Microsoft Corporation)

Update für Windows Internet Explorer 8 (KB976662) (Version: 1 - Microsoft Corporation)

Update für Windows Internet Explorer 8 (KB980182) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2863058) (Version: 1 - Microsoft Corporation)

Update für Windows XP (KB2904266) (Version: 1 - Microsoft Corporation)

VIS (Version:  - )

VLC media player 1.1.11 (Version: 1.1.11 - VideoLAN)

WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden

WebReg (Version: 70.0.170.000 - Hewlett-Packard) Hidden

Windows Communication Foundation Language Pack - DEU (Version: 3.0.04506.30 - Microsoft Corporation) Hidden

Windows Genuine Advantage Validation Tool (KB892130) (Version:  - Microsoft Corporation)

Windows Internet Explorer 8 (Version: 20090308.140743 - Microsoft Corporation)

Windows Media Format 11 runtime (Version:  - )

Windows Media Player 11 (Version:  - )

Windows Movie Maker 2.0 (Version: 2.0.0000 - Microsoft Corporation) Hidden

Windows Presentation Foundation (Version: 3.0.6920.0 - Microsoft Corporation) Hidden

Windows Presentation Foundation Language Pack (DEU) (Version: 3.0.6920.0 - Microsoft Corporation) Hidden

Windows Workflow Foundation DE Language Pack (Version: 3.0.4203.2 - Microsoft Corporation) Hidden

XML Paper Specification Shared Components Pack 1.0 (Version:  - Microsoft Corporation) Hidden
 

==================== Restore Points  =========================
 

27-10-2013 03:58:10 Systemprüfpunkt

29-10-2013 00:05:51 Systemprüfpunkt

30-10-2013 16:05:50 Software Distribution Service 3.0

02-11-2013 11:42:31 Systemprüfpunkt

03-11-2013 14:28:45 Systemprüfpunkt

05-11-2013 08:07:19 Systemprüfpunkt

06-11-2013 14:06:38 Systemprüfpunkt

08-11-2013 15:32:05 Systemprüfpunkt

13-11-2013 16:05:17 IObit Uninstaller restore point

13-11-2013 16:55:59 Removed PixiePack Codec Pack

13-11-2013 17:05:01 Removed Wunderlist

15-11-2013 09:19:39 Software Distribution Service 3.0

20-11-2013 11:28:56 Systemprüfpunkt

21-11-2013 11:48:04 Systemprüfpunkt

22-11-2013 12:48:54 Systemprüfpunkt

23-11-2013 16:06:41 Systemprüfpunkt

25-11-2013 11:52:18 Systemprüfpunkt

26-11-2013 23:05:02 Systemprüfpunkt

29-11-2013 00:47:32 Systemprüfpunkt

05-12-2013 10:21:18 Systemprüfpunkt

06-12-2013 11:01:19 Systemprüfpunkt

07-12-2013 15:45:32 Systemprüfpunkt

08-12-2013 17:19:29 Systemprüfpunkt

12-12-2013 13:52:33 Software Distribution Service 3.0

13-12-2013 15:17:28 Software Distribution Service 3.0

16-12-2013 17:33:18 Systemprüfpunkt

18-12-2013 10:03:30 Systemprüfpunkt

23-12-2013 18:32:29 Systemprüfpunkt

27-12-2013 16:29:36 Systemprüfpunkt

29-12-2013 11:32:06 Systemprüfpunkt

01-01-2014 15:31:31 Systemprüfpunkt

02-01-2014 16:05:00 Systemprüfpunkt

04-01-2014 21:52:03 Systemprüfpunkt

06-01-2014 22:39:47 Systemprüfpunkt

10-01-2014 18:01:46 Systemprüfpunkt

14-01-2014 12:10:41 Software Distribution Service 3.0

15-01-2014 15:06:05 Systemprüfpunkt

15-01-2014 16:52:25 Software Distribution Service 3.0

16-01-2014 19:00:29 Systemprüfpunkt

18-01-2014 15:53:32 Systemprüfpunkt

21-01-2014 07:59:36 Systemprüfpunkt

21-01-2014 16:01:37 IObit Uninstaller restore point

21-01-2014 16:25:10 Skype™ 5.10 wird entfernt

22-01-2014 18:31:24 Systemprüfpunkt
 

==================== Hosts content: ==========================
 

2008-04-13 22:00 - 2008-04-13 22:00 - 00000820 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: C:\WINDOWS\Tasks\1-Klick-Wartung.job => C:\Programme\TuneUp Utilities 2009\OneClickStarter.exe

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\avast! Emergency Update.job => C:\Programme\AVAST Software\Avast\AvastEmUpdate.exe

Task: C:\WINDOWS\Tasks\Clean System Memory.job => C:\WINDOWS\system32\CleanMem.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Programme\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Programme\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\User_Feed_Synchronization-{669307CE-96C7-4F68-AC8E-1CCA34E106EB}.job => C:\WINDOWS\system32\msfeedssync.exe
 

==================== Loaded Modules (whitelisted) =============
 

2012-10-17 19:08 - 2012-08-21 08:21 - 01802240 _____ () C:\Programme\AVAST Software\Avast\defs\12082100\algo.dll

2012-10-06 22:11 - 2012-09-19 18:17 - 00397088 _____ () C:\Programme\Avira\AntiVir Desktop\sqlite3.dll

2014-01-14 18:21 - 2014-01-14 18:21 - 00337920 _____ () C:\Programme\ResultsAlpha\bin\sqlite3.dll

2008-10-21 16:48 - 2007-04-06 00:56 - 00356352 _____ () C:\Acer\Empowering Technology\eRecovery\it41.dll

2008-10-21 16:48 - 2006-01-12 08:33 - 00212992 _____ () C:\Acer\Empowering Technology\eRecovery\imagefile.dll

2012-09-08 12:16 - 2012-09-08 12:16 - 00433664 _____ () C:\Programme\Evernote\Evernote\libxml2.dll

2012-09-08 12:16 - 2012-09-08 12:16 - 00315392 _____ () C:\Programme\Evernote\Evernote\libtidy.dll

2013-12-27 20:55 - 2013-12-27 20:57 - 03559024 _____ () C:\Programme\Mozilla Firefox\mozjs.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

AlternateDataStreams: C:\WINDOWS:nlsPreferences
 

==================== Safe Mode (whitelisted) ===================
 
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (01/21/2014 03:03:07 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/21/2014 03:03:07 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/21/2014 09:15:49 AM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/21/2014 09:15:49 AM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/19/2014 10:27:58 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/19/2014 10:27:58 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/19/2014 10:20:36 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/19/2014 10:20:36 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/19/2014 10:07:52 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 

Error: (01/19/2014 10:07:52 PM) (Source: Ci) (User: )

Description: Inhaltsindex auf c:\system volume information\catalog.wci konnte nicht initialisiert werden. Fehler 3221225620.
 
 

System errors:

=============

Error: (01/22/2014 04:37:17 AM) (Source: Service Control Manager) (User: )

Description: Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung von Dienst stisvc.
 

Error: (01/21/2014 11:45:22 PM) (Source: Service Control Manager) (User: )

Description: Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung von Dienst stisvc.
 

Error: (01/21/2014 01:53:32 PM) (Source: Service Control Manager) (User: )

Description: Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung von Dienst stisvc.
 

Error: (01/20/2014 05:47:26 PM) (Source: Service Control Manager) (User: )

Description: Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung von Dienst stisvc.
 

Error: (01/19/2014 10:51:09 PM) (Source: 0) (User: )

Description: \Device\ACPIEC
 

Error: (01/19/2014 10:16:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (01/19/2014 10:16:01 PM) (Source: Service Control Manager) (User: )

Description: Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Update ResultsAlpha.
 

Error: (01/19/2014 10:16:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "PDF Architect Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (01/19/2014 10:16:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "PDF Architect Helper Service" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (01/19/2014 10:16:01 PM) (Source: Service Control Manager) (User: )

Description: Der Dienst "aswFsBlk" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 
 

Microsoft Office Sessions:

=========================

Error: (12/02/2008 07:34:50 PM) (Source: Microsoft Office 12 Sessions)(User: )

Description: 0Microsoft Office Word12.0.6211.100012.0.6215.100022560
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 63%

Total physical RAM: 1011.88 MB

Available physical RAM: 371.88 MB

Total Pagefile: 2430.67 MB

Available Pagefile: 1312.34 MB

Total Virtual: 2047.88 MB

Available Virtual: 1955.89 MB
 

==================== Drives ================================
 

Drive c: (ACER) (Fixed) (Total:144.17 GB) (Free:50 GB) NTFS ==>[Drive with boot components (Windows XP)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 149 GB) (Disk ID: 11A8BA38)

Partition 1: (Not Active) - (Size=5 GB) - (Type=12)

Partition 2: (Active) - (Size=144 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

--- --- ---

Danke und Gruß

N'Abend,

alles erledigt. Combofix hat Wiederherstellungskonsole runtergeladen. Her der Log

Code:

Combofix Logfile:
 

        Code:


        
ComboFix 14-01-23.02 - Saturn 25.01.2014  18:11:20.1.2 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1012.586 [GMT 1:00]

ausgeführt von:: c:\dokumente und einstellungen\Saturn\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\All Users\Anwendungsdaten\8f01a90e-7eb3-48d3-93b1-50d88fd146fb

c:\dokumente und einstellungen\All Users\Anwendungsdaten\dlprotect.exe

c:\dokumente und einstellungen\All Users\Anwendungsdaten\hpe3.dll

c:\dokumente und einstellungen\Saturn\Lokale Einstellungen\Anwendungsdaten\assembly\tmp

c:\dokumente und einstellungen\Saturn\Lokale Einstellungen\Temporary Internet Files\ResultsAlpha_iels

C:\Install.exe

C:\timerintray

c:\windows\system32\autorun.ini

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-12-25 bis 2014-01-25  ))))))))))))))))))))))))))))))

.

.

2014-01-23 08:27 . 2014-01-23 08:27        --------        d-----w-        C:\FRST

2014-01-21 08:09 . 2008-04-13 21:00        5632        -c--a-w-        c:\windows\system32\dllcache\write.exe

2014-01-21 08:09 . 2008-04-13 21:00        683520        -c--a-w-        c:\windows\system32\dllcache\getuname.dll

2014-01-21 08:09 . 2008-04-13 21:00        80896        -c--a-w-        c:\windows\system32\dllcache\charmap.exe

2014-01-21 08:09 . 2008-04-13 21:00        216064        -c--a-w-        c:\windows\system32\dllcache\wordpad.exe

2014-01-21 08:09 . 2008-04-13 21:00        114688        -c--a-w-        c:\windows\system32\dllcache\calc.exe

2014-01-21 08:09 . 2008-04-13 21:00        346624        -c--a-w-        c:\windows\system32\dllcache\mspaint.exe

2014-01-21 08:08 . 2008-04-13 21:00        104448        -c--a-w-        c:\windows\system32\dllcache\clipbrd.exe

2014-01-06 21:47 . 2014-01-07 05:50        --------        d-----w-        c:\programme\ResultsAlpha

2014-01-06 21:43 . 2014-01-06 21:43        --------        d-----w-        c:\dokumente und einstellungen\Saturn\Anwendungsdaten\Windows Net Data

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-12-18 07:37 . 2012-10-06 21:10        135648        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-12-18 07:37 . 2012-10-06 21:10        90400        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-12-16 15:37 . 2012-06-25 14:34        692616        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2013-12-16 15:37 . 2011-09-28 06:10        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2013-11-27 20:21 . 2008-04-13 21:00        40960        ----a-w-        c:\windows\system32\drivers\ndproxy.sys

2013-11-25 13:56 . 2012-10-06 21:10        37352        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2013-11-13 02:59 . 2008-04-13 21:00        150528        ----a-w-        c:\windows\system32\imagehlp.dll

2013-11-07 05:38 . 2008-04-13 21:00        591360        ----a-w-        c:\windows\system32\rpcrt4.dll

2013-11-06 01:36 . 2008-05-05 05:25        8192        ----a-w-        c:\windows\system32\xpsp4res.dll

2013-10-30 02:51 . 2008-04-13 21:00        1879168        ----a-w-        c:\windows\system32\win32k.sys

2013-10-29 07:57 . 2007-08-13 16:54        920064        ----a-w-        c:\windows\system32\wininet.dll

2013-10-29 07:57 . 2007-08-13 16:45        1469440        ------w-        c:\windows\system32\inetcpl.cpl

2013-10-29 07:57 . 2007-08-13 16:44        43520        ----a-w-        c:\windows\system32\licmgr10.dll

2013-10-29 07:57 . 2008-04-13 21:00        18944        ----a-w-        c:\windows\system32\corpol.dll

2013-10-29 00:45 . 2008-04-13 21:00        385024        ----a-w-        c:\windows\system32\html.iec

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2013-04-30 17:05        280736        ----a-w-        c:\programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Mediencenter_InSync]

@="{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}"

"ReferenceCount"=dword:00000001

[HKEY_CLASSES_ROOT\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}]

2013-04-18 16:06        540672        ----a-w-        c:\dokumente und einstellungen\Saturn\Anwendungsdaten\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Mediencenter_ToSync]

@="{528EE335-5034-4EFC-834E-63E5F02D2BC2}"

"ReferenceCount"=dword:00000001

[HKEY_CLASSES_ROOT\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}]

2013-04-18 16:06        540672        ----a-w-        c:\dokumente und einstellungen\Saturn\Anwendungsdaten\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Mediencenter_Failed]

@="{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}"

"ReferenceCount"=dword:00000001

[HKEY_CLASSES_ROOT\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}]

2013-04-18 16:06        540672        ----a-w-        c:\dokumente und einstellungen\Saturn\Anwendungsdaten\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"ISUSPM"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]

"ShowBatteryBar"="c:\programme\BatteryBar\ShowBatteryBar.exe" [2013-04-11 90624]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LaunchApp"="Alaunch" [X]

"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1044480]

"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2013-12-18 684600]

"RTHDCPL"="RTHDCPL.EXE" [2013-03-12 20143688]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

.

c:\dokumente und einstellungen\Saturn\Startmenü\Programme\Autostart\

EvernoteClipper.lnk - c:\programme\Evernote\Evernote\EvernoteClipper.exe [2013-5-22 1089888]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoStrCmpLogical"= 1 (0x1)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoRecentDocsNetHood"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\GREENP~1\gphknt32.dll

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^McAfee Security Scan Plus.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk

backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Stickies.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Stickies.lnk

backup=c:\windows\pss\Stickies.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Saturn^Startmenü^Programme^Autostart^OneNote Inhaltsverzeichnis.onetoc2]

path=c:\dokumente und einstellungen\Saturn\Startmenü\Programme\Autostart\OneNote Inhaltsverzeichnis.onetoc2

backup=c:\windows\pss\OneNote Inhaltsverzeichnis.onetoc2Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Saturn^Startmenü^Programme^Autostart^OpenOffice.org 3.4.1.lnk]

path=c:\dokumente und einstellungen\Saturn\Startmenü\Programme\Autostart\OpenOffice.org 3.4.1.lnk

backup=c:\windows\pss\OpenOffice.org 3.4.1.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AzMixerSel]

2006-07-17 14:40        53248        ------w-        c:\programme\Realtek\Audio\InstallShield\AzMixerSel.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]

2013-07-22 17:17        3643160        ----a-w-        c:\programme\CCleaner\CCleaner.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChangeFilterMerit]

2006-12-27 10:16        45056        ----a-w-        c:\programme\NewSoft\Presto! PVR\ChangeFilterMerit.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eRecoveryService]

2008-05-22 13:30        425984        ----a-w-        c:\acer\Empowering Technology\eRecovery\eRAgent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lingoes]

2013-03-29 22:41        2506752        ----a-w-        c:\dokumente und einstellungen\Saturn\Lokale Einstellungen\Anwendungsdaten\Lingoes\Translator\lingoes-us\Lingoes.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Presto! PVR Monitor]

2007-05-29 15:57        143360        ----a-w-        c:\programme\NewSoft\Presto! PVR\Monitor.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2013-03-12 05:32        253816        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"BthServ"=2 (0x2)

"TuneUp.ProgramStatisticsSvc"=2 (0x2)

"TuneUp.Defrag"=3 (0x3)

"OMSI download service"=2 (0x2)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

"ISUSPM"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler

"TuneUp MemOptimizer"="c:\programme\TuneUp Utilities 2009\MemOptimizer.exe" autostart

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Persistence"=c:\windows\system32\igfxpers.exe

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

"MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC

"IgfxTray"=c:\windows\system32\igfxtray.exe

"HotKeysCmds"=c:\windows\system32\hkcmd.exe

"LManager"=c:\progra~1\LAUNCH~1\QtZgAcer.EXE

"USBestCR"=c:\programme\USIM Editor\iconcs1349453.exe RunFromReg

"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Messenger\\msmsgs.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpofxs08.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqusgm.exe"=

"c:\\Programme\\Hp\\Digital Imaging\\bin\\hpqusgh.exe"=

"c:\\Programme\\Hp\\HP Software Update\\hpwucli.exe"=

"c:\\Programme\\TeamViewer\\Version8\\TeamViewer.exe"=

"c:\\Programme\\TeamViewer\\Version8\\TeamViewer_Service.exe"=

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [06.10.2012 22:10 37352]

R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [06.10.2012 22:11 440376]

R2 GreenPrint;GreenPrint;c:\programme\GreenPrint\gpsrht01.exe [30.04.2013 04:51 352808]

R2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\system32\NLSSRV32.EXE [09.10.2012 23:46 69640]

R2 TeamViewer8;TeamViewer 8;c:\programme\TeamViewer\Version8\TeamViewer_Service.exe [07.06.2013 21:18 3574624]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [05.05.2010 19:45 27632]

S2 ADExchange;ArcSoft Exchange Service;c:\programme\Gemeinsame Dateien\ArcSoft\esinter\Bin\eservutil.exe --> c:\programme\Gemeinsame Dateien\ArcSoft\esinter\Bin\eservutil.exe [?]

S2 AfaService;Afa Card Reader Service;c:\windows\system32\afasrv32.exe [29.04.2010 19:08 65536]

S2 PDF Architect Helper Service;PDF Architect Helper Service;"c:\programme\PDF Architect\HelperService.exe" --> c:\programme\PDF Architect\HelperService.exe [?]

S2 PDF Architect Service;PDF Architect Service;"c:\programme\PDF Architect\ConversionService.exe" --> c:\programme\PDF Architect\ConversionService.exe [?]

S2 Update ResultsAlpha;Update ResultsAlpha;c:\programme\ResultsAlpha\updateResultsAlpha.exe [21.11.2013 00:20 102176]

S2 Util ResultsAlpha;Util ResultsAlpha;c:\programme\ResultsAlpha\bin\utilResultsAlpha.exe [07.01.2014 06:50 102176]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [15.06.2013 21:10 1691480]

S3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [21.10.2008 16:47 96856]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\programme\McAfee Security Scan\3.0.318\McCHSvc.exe [05.02.2013 16:48 235216]

S3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10.sys --> c:\windows\system32\Drivers\MHIKEY10.sys [?]

S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [04.05.2010 20:26 86824]

S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [04.05.2010 20:26 15016]

S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [04.05.2010 20:26 114728]

S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [04.05.2010 20:26 106208]

S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [04.05.2010 20:26 26024]

S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [04.05.2010 20:26 104744]

S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [04.05.2010 20:26 109864]

S3 Sony PC Companion;Sony PC Companion;c:\programme\Sony\Sony PC Companion\PCCService.exe [08.08.2013 10:59 155824]

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Inhalt des "geplante Tasks" Ordners

.

2014-01-25 c:\windows\Tasks\1-Klick-Wartung.job

- c:\programme\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 11:45]

.

2014-01-20 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-25 15:37]

.

2014-01-25 c:\windows\Tasks\Clean System Memory.job

- c:\windows\system32\CleanMem.exe [2009-04-01 16:51]

.

2014-01-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2012-08-29 19:01]

.

2014-01-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2012-08-29 19:01]

.

2014-01-25 c:\windows\Tasks\User_Feed_Synchronization-{669307CE-96C7-4F68-AC8E-1CCA34E106EB}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.avira.com/?l=dis&o=APN10395&gct=hp&dc=EU&locale=de_DE

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Auswahl speichern - c:\programme\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=3

IE: Bild ausschneiden - c:\programme\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=4

IE: Diese Seite ausschneiden - c:\programme\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=1

IE: Free YouTube Download - c:\programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - c:\programme\Gemeinsame Dateien\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: Neue Notiz - c:\programme\Evernote\Evernote\\EvernoteIERes\NewNote.html

IE: URL notieren - c:\programme\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0

Trusted Zone: amazon.de\www

Trusted Zone: internet

Trusted Zone: mcafee.com

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\dokumente und einstellungen\Saturn\Anwendungsdaten\Mozilla\Firefox\Profiles\n6uzpwso.default\

FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)

Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKLM-Run-Download Protect - c:\dokumente und einstellungen\All Users\Anwendungsdaten\dlprotect.exe

MSConfigStartUp-Adobe ARM - c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

MSConfigStartUp-Adobe Reader Speed Launcher - c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe

MSConfigStartUp-LightScribe Control Panel - c:\programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe

MSConfigStartUp-Skype - c:\programme\Skype\Phone\Skype.exe

MSConfigStartUp-swg - c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2014-01-25 18:28

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Zeit der Fertigstellung: 2014-01-25  18:34:28

ComboFix-quarantined-files.txt  2014-01-25 17:34

.

Vor Suchlauf: 16 Verzeichnis(se), 53.506.383.872 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 54.500.913.152 Bytes frei

.

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /TUTag=T69YAZ /Kernel=TUKernel.exe

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition (TuneUp Backup)" /noexecute=optin /fastdetect /TUTag=T69YAZ-BAK

.

- - End Of File - - A8818543C4FA9E7002135115607C6621

 
--- --- ---

99852D5C3A78447C3D6D82B6155FE848
 
 

Danke schonmal und bis bald

Gruß

Toffifeee