Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 11.10.2012, 21:48   #1
User1578
 
GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien - Standard

GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien



Hallo,
meine Geschichte der Reihe nach:

1. Ich bin GData Internet Security 2013 - Nutzer und habe vorgestern aus Neugier und um sicherzugehen, dass alles in Ordnung ist (habe keine direkten Anzeichen für Viren etc., bin halt vllt. etwas übervorsichtig), den Boot Scan der GData - Installations-CD ausprobiert. Nachdem ich es endlich geschafft hatte, die CD Upzudaten und den Scan zu starten, hat er mir in meinem Windows-Systemabbild einen Win32:Gremo gefunden. Ich habe leider kein Log von diesem Scan.

2. Ich habe mich gestern dem Problem nochmals angenommen. Dabei habe ich bemerkt, dass der Scan nach jedem Virusfund anhält, fragt, was er machen soll, und, unabhängig, was man auswählt, danach einfach nicht mehr weiterscant. Jedoch konnte ich dadurch ein Log des Virusfundes aufzeichnen:

Code:
ATTFilter
Virenprüfung mit G Data AntiVirus
Version 10.0 (02.02.2011)
Virensignaturen vom 10.10.2012
Startzeit: 10.10.2012 17:35
Engine(s): EngineA (AVA 22.6380) EngineB (AVB 22.1182) 
Heuristik: Ein
Archive: Ein
Systembereiche: Ein

Prüfe Systembereiche....
Prüfung folgender Verzeichnisse und Dateien:
	/mnt/

Objekt: c099986d-9a9d-11e1-816f-806e6f6e6963.vhd
	Pfad: /mnt/F:/WindowsImageBackup/Lenovo-PC/Backup 2012-08-22 095349
	Status: Virus gefunden
	Virus: Win32:Gremo
Objekt: 
	Pfad: /mnt/F:/WindowsImageBackup/Lenovo-PC/Catalog/GlobalCatalog
	Status: 
	Virus: 

Analyse vorzeitig abgebrochen: 10.10.2012 18:12
216 Dateien geprüft
1 infizierte Dateien gefunden
0 verdächtige Dateien gefunden
         
Hinweiszu den Laufwerken:
/mnt/F:/ ist meine zweite Partition D: neben /mnt/D:/ = C:
/mnt/C:/ könnte die SYSTEM_DRV sein und
/mnt/E:/ könnte die OEM-Partition sein (kommt später noch)

Ich habe den Scan abgebrochen, da er nicht mehr weiterlief, steht auch hier:
www.rokop-security.de/index.php?showtopic=22015&st=0&p=355140&#entry355140 .

3. In meiner Panik habe ich das Internet durchsucht, bin auf dieses Board gestoßen und habe mir OTL geholt und ausgeführt:

OTL.txt:
Code:
ATTFilter
OTL logfile created on: 10.10.2012 20:41:56 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Normal\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,96 Gb Total Physical Memory | 5,70 Gb Available Physical Memory | 71,56% Memory free
15,93 Gb Paging File | 13,38 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 454,89 Gb Total Space | 252,58 Gb Free Space | 55,52% Space Free | Partition Type: NTFS
Drive D: | 451,35 Gb Total Space | 363,38 Gb Free Space | 80,51% Space Free | Partition Type: NTFS
 
Computer Name: LENOVO-PC | User Name: Daniel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.10 19:13:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Normal\Downloads\OTL.exe
PRC - [2012.09.17 05:24:09 | 000,995,352 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
PRC - [2012.08.23 15:46:06 | 001,542,680 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
PRC - [2012.07.25 10:46:42 | 000,681,056 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\sua.exe
PRC - [2012.03.29 04:42:27 | 000,470,008 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
PRC - [2012.01.27 06:13:00 | 001,470,968 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
PRC - [2012.01.27 05:43:33 | 000,468,472 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
PRC - [2011.12.20 10:43:44 | 000,712,192 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Power Control Switch\LitModeSwitch.exe
PRC - [2011.12.16 09:47:34 | 000,199,264 | ---- | M] (1206 Lab) -- C:\Program Files (x86)\Lenovo\Rapidboot\FBService.exe
PRC - [2011.12.16 09:47:28 | 001,260,128 | ---- | M] (Lenovo) -- C:\Program Files (x86)\Lenovo\Rapidboot\FBConsole.exe
PRC - [2011.12.16 06:37:30 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.12.16 06:37:26 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2011.12.16 06:37:18 | 000,128,280 | ---- | M] () -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
PRC - [2011.12.16 06:37:10 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
PRC - [2011.12.08 19:36:20 | 002,688,296 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Lenovo\Power2Go\Power2GoExpressServer.exe
PRC - [2011.12.04 20:14:28 | 000,291,096 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
PRC - [2011.11.29 20:04:56 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.11.29 20:04:54 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2011.11.07 12:24:22 | 000,101,888 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Power Control Switch\LitModeCtrl.exe
PRC - [2011.11.04 17:39:56 | 000,037,888 | ---- | M] (Lenovo) -- C:\Programme\Lenovo\Power Control Switch\LenovoCOMSvc.exe
PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011.06.08 08:41:42 | 000,118,784 | ---- | M] (Lenovo) -- C:\Windows\jmesoft\hotkey.exe
PRC - [2011.05.25 14:09:30 | 000,049,152 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe
PRC - [2011.05.17 13:54:44 | 000,024,576 | ---- | M] () -- C:\Windows\jmesoft\JME_LOAD.exe
PRC - [2011.03.15 20:47:40 | 000,032,768 | ---- | M] () -- C:\Windows\jmesoft\Service.exe
PRC - [2009.12.04 16:59:28 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.15 21:20:14 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.07.15 21:20:13 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.07.15 21:20:13 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\acc563eb665e430df4375afb9697a5d9\IAStorCommon.ni.dll
MOD - [2012.07.15 21:20:12 | 000,487,424 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\33e53ffe7ba7362a2d483ef4ea79bfe3\IAStorUtil.ni.dll
MOD - [2012.07.15 21:20:10 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll
MOD - [2012.07.15 21:20:06 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll
MOD - [2012.07.15 21:19:45 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.07.15 21:19:43 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.07.15 21:19:42 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.07.15 21:19:39 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012.05.11 00:23:49 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2011.12.16 09:47:38 | 000,031,328 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Rapidboot\FBServiceps.dll
MOD - [2011.05.25 14:09:30 | 000,049,152 | ---- | M] () -- C:\Windows\SysWOW64\UMonit.exe
MOD - [2011.05.17 14:53:20 | 001,031,976 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\Language\DEU\P2GRC.dll
MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.12.04 17:04:32 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll
MOD - [2009.12.04 17:00:00 | 000,144,680 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\CLVistaAudioMixer.dll
MOD - [2009.12.04 16:59:54 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2012.02.14 17:12:10 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.10.10 19:12:27 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.06 04:14:08 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.30 05:06:18 | 002,011,568 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe -- (AVKWCtl)
SRV - [2012.08.23 15:46:06 | 001,542,680 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)
SRV - [2012.07.25 10:46:44 | 001,326,176 | ---- | M] (Secunia) [On_Demand | Stopped] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2012.07.25 10:46:42 | 000,681,056 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2012.07.20 14:00:51 | 002,635,776 | ---- | M] (Deutsche Telekom AG) [Auto | Running] -- D:\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)
SRV - [2012.06.04 11:50:20 | 001,766,464 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe -- (GDFwSvc)
SRV - [2012.03.29 04:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan)
SRV - [2012.01.27 05:43:33 | 000,468,472 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe -- (AVKService)
SRV - [2011.12.16 09:47:34 | 000,199,264 | ---- | M] (1206 Lab) [Auto | Running] -- C:\Program Files (x86)\Lenovo\Rapidboot\FBService.exe -- (FastbootService)
SRV - [2011.12.16 06:37:30 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011.12.16 06:37:26 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2011.12.16 06:37:18 | 000,128,280 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe -- (Intel(R)
SRV - [2011.12.16 06:37:10 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service)
SRV - [2011.12.08 16:38:24 | 000,607,456 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\iCLS Client\HeciServer.exe -- (Intel(R)
SRV - [2011.11.29 20:04:56 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.11.07 12:24:22 | 000,101,888 | ---- | M] (Lenovo) [On_Demand | Running] -- C:\Programme\Lenovo\Power Control Switch\LitModeCtrl.exe -- (LitModeCtrl)
SRV - [2011.11.04 17:39:56 | 000,037,888 | ---- | M] (Lenovo) [Auto | Running] -- C:\Programme\Lenovo\Power Control Switch\LenovoCOMSvc.exe -- (LenovoCOMSvc)
SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011.03.15 20:47:40 | 000,032,768 | ---- | M] () [Auto | Running] -- C:\Windows\jmesoft\Service.exe -- (JME Keyboard)
SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.21 14:49:00 | 002,286,976 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.06.25 19:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2010.03.18 23:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.09.26 19:37:01 | 000,060,320 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt)
DRV:64bit: - [2012.09.25 19:34:31 | 000,126,880 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt)
DRV:64bit: - [2012.09.25 19:34:31 | 000,064,416 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd)
DRV:64bit: - [2012.09.25 19:34:31 | 000,054,176 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave)
DRV:64bit: - [2012.09.20 20:31:36 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD)
DRV:64bit: - [2012.09.20 20:29:06 | 000,064,376 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre)
DRV:64bit: - [2012.09.20 20:17:49 | 000,031,448 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GdNetMon64.sys -- (GdNetMon)
DRV:64bit: - [2012.09.07 17:38:22 | 000,147,288 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2012.08.06 14:55:38 | 000,878,696 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:64bit: - [2012.05.14 08:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.05.11 00:31:26 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2012.05.11 00:31:26 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.14 21:05:24 | 010,493,952 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.02.14 16:34:46 | 000,326,656 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.12.04 20:13:24 | 000,785,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
DRV:64bit: - [2011.12.04 20:13:24 | 000,355,096 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
DRV:64bit: - [2011.12.04 20:13:24 | 000,016,152 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
DRV:64bit: - [2011.11.29 19:40:32 | 000,568,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.11.09 19:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.08.23 15:57:24 | 000,565,352 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.18 07:50:02 | 000,058,368 | ---- | M] (GenesysLogic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GeneStor.sys -- (GeneStor)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.09.23 00:36:48 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2010.09.01 10:30:58 | 000,017,976 | ---- | M] (Secunia) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\psi_mf.sys -- (PSI)
DRV:64bit: - [2010.06.25 19:07:26 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2009.07.21 14:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2010.09.16 17:02:59 | 000,045,664 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- D:\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys -- (TelekomNM6)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LEND&bmod=LEND
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=LEND&bmod=LEND
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LEND
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: {906305f7-aafc-45e9-8bbd-941950a84dad}:1.1.11215.1124
FF - prefs.js..extensions.enabledAddons: firefox@ghostery.com:2.8.3
FF - prefs.js..extensions.enabledAddons: https-everywhere@eff.org:2.0.3
FF - prefs.js..extensions.enabledAddons: trackerblock@privacychoice.org:2.2
FF - prefs.js..extensions.enabledAddons: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.15.1
FF - prefs.js..extensions.enabledAddons: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.5.7
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.10 19:13:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.09.19 22:03:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Extensions
[2012.10.10 19:18:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\z0hcw6oc.default\extensions
[2012.10.10 19:18:10 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\z0hcw6oc.default\extensions\firefox@ghostery.com
[2012.10.10 19:18:11 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\z0hcw6oc.default\extensions\https-everywhere@eff.org
[2012.10.10 19:18:11 | 000,049,540 | ---- | M] () (No name found) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\z0hcw6oc.default\extensions\trackerblock@privacychoice.org.xpi
[2012.10.10 19:18:11 | 000,097,169 | ---- | M] () (No name found) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\z0hcw6oc.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}.xpi
[2012.10.10 19:18:11 | 000,529,404 | ---- | M] () (No name found) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\z0hcw6oc.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.10.10 19:15:15 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\z0hcw6oc.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.10.10 19:13:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.25 19:34:31 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\mozilla firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}
[2012.10.06 04:14:59 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.10.06 05:22:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.06 05:22:08 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.10.06 05:22:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.10.06 05:22:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.10.06 05:22:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.10.06 05:22:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=LEND&bmod=LEND
CHR - default_search_provider: Bing (Enabled)
CHR - default_search_provider: search_url = hxxp://www.bing.com/search?setmkt=de-DE&q={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://api.bing.com/osjson.aspx?query={searchTerms}&language={language}
CHR - homepage: hxxp://www.google.com/ig/redirectdomain?brand=LEND&bmod=LEND
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.75\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.75\pdf.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.1_0\McChPlg.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: McAfee SecurityCenter (Enabled) = c:\progra~2\mcafee\msc\npmcsn~1.dll
CHR - Extension: SiteAdvisor = C:\Users\Daniel\AppData\Local\jGoogle\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.1_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O2 - BHO: (BHO) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [UMonit] C:\Windows\SysWOW64\UMonit.exe ()
O4:64bit: - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [Fastboot] C:\Program Files (x86)\Lenovo\Rapidboot\FBConsole.exe (Lenovo)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [jmekey] C:\Windows\jmesoft\hotkey.exe (Lenovo)
O4 - HKLM..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe ()
O4 - HKLM..\Run: [Lenovo Registration] C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe (Lenovo, Inc.)
O4 - HKLM..\Run: [LVT] C:\Program Files\Lenovo\LVT\LJYZ.exe (Lenovo)
O4 - HKLM..\Run: [ModeSwitch] C:\Program Files\Lenovo\Power Control Switch\LitModeSwitch.exe (Lenovo)
O4 - HKLM..\Run: [SetDefaultSCR] C:\Program Files (x86)\Lenovo\Lenovo Screensaver\SetDefaultSCR.exe (Lenovo)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_278_Plugin.exe -update plugin File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 00 00 00 02  [binary data]
O8:64bit: - Extra context menu item: Alles mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dlall.htm ()
O8:64bit: - Extra context menu item: Auswahl mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dlselected.htm ()
O8:64bit: - Extra context menu item: Datei mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dllink.htm ()
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8:64bit: - Extra context menu item: Videos mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Program Files (x86)\Free Download Manager\dlfvideo.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} hxxp://support.lenovo.com/Resources/Lenovo/AutoDetect/Lenovo_AutoDetect2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{091960D9-1195-42D0-9EC2-32B603D6F85A}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\dssrequest - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest - No CLSID value found
O18 - Protocol\Handler\sacore - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.10 00:23:35 | 000,000,000 | ---D | C] -- C:\gdbootcd
[2012.10.08 22:31:27 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJScan
[2012.10.08 22:31:09 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Canon
[2012.10.08 22:25:08 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJMSetup
[2012.10.08 22:25:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5100 series Benutzerregistrierung
[2012.10.08 22:24:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
[2012.10.08 22:24:31 | 000,000,000 | ---D | C] -- C:\Program Files\Canon
[2012.10.08 22:23:49 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonBJ
[2012.10.08 22:23:42 | 000,000,000 | -H-D | C] -- C:\Windows\SysNative\CanonIJ Uninstaller Information
[2012.10.08 22:23:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5100 series
[2012.10.08 22:22:31 | 000,000,000 | -H-D | C] -- C:\Program Files\CanonBJ
[2012.10.08 22:08:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEGV
[2012.10.08 22:08:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5100 series Manual
[2012.10.08 22:08:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Canon
[2012.10.04 18:26:36 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Wireshark
[2012.10.04 18:20:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2012.10.04 18:20:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinPcap
[2012.10.04 18:20:20 | 000,000,000 | ---D | C] -- C:\Program Files\Wireshark
[2012.10.01 22:58:29 | 000,027,388 | ---- | C] (Immersion Corporation) -- C:\Windows\SysWow64\drivers\ihidfilt.sys
[2012.10.01 22:58:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Logitech
[2012.10.01 22:58:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2012.10.01 22:58:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Logitech
[2012.10.01 20:06:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Packet Tracer
[2012.10.01 20:06:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco Packet Tracer 5.3.3
[2012.09.30 20:13:42 | 000,000,000 | ---D | C] -- C:\Alte FP
[2012.09.25 21:54:55 | 000,000,000 | ---D | C] -- C:\Windows Isos
[2012.09.25 20:30:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.09.25 20:28:47 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.09.25 20:27:36 | 000,000,000 | ---D | C] -- C:\AMD
[2012.09.24 23:49:16 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Microsoft Game Studios
[2012.09.24 23:06:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Documents\Flight Simulator X-Dateien
[2012.09.24 23:01:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2012.09.24 23:01:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Microsoft Games
[2012.09.24 22:19:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Games
[2012.09.24 21:14:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Iometer.org
[2012.09.23 20:15:29 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\pdfforge
[2012.09.23 20:15:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.09.23 20:15:25 | 000,096,768 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
[2012.09.23 20:15:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PDFCreator
[2012.09.20 20:31:38 | 000,016,504 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys
[2012.09.20 20:31:36 | 000,106,648 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys
[2012.09.20 20:28:58 | 000,010,792 | ---- | C] (G Data Software AG) -- C:\Windows\SysWow64\GdScrSv.de.dll
[2012.09.20 20:18:28 | 000,060,320 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys
[2012.09.20 20:18:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity
[2012.09.20 20:17:50 | 000,126,880 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys
[2012.09.20 20:17:50 | 000,064,376 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys
[2012.09.20 20:17:49 | 000,064,416 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys
[2012.09.20 20:17:49 | 000,054,176 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys
[2012.09.20 20:17:49 | 000,031,448 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GdNetMon64.sys
[2012.09.20 20:17:39 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA
[2012.09.20 20:17:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\G Data
[2012.09.20 20:17:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\G Data
[2012.09.20 20:16:27 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Downloaded Installations
[2012.09.20 19:59:52 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Desktop\Mcafee deinstallieren und entfernen-Dateien
[2012.09.20 16:32:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StoppUhr
[2012.09.19 22:03:54 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Mozilla
[2012.09.19 20:04:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.09.19 20:04:36 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.09.17 22:43:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
[2012.09.12 22:55:12 | 000,000,000 | ---D | C] -- C:\Lenovo-Sicherung
[2012.09.11 23:11:33 | 001,707,520 | ---- | C] (www.sw4you.de Siegfried Weckmann) -- C:\Windows\SwSetupu.exe
[2012.07.15 20:37:34 | 001,178,624 | ---- | C] (CPUID) -- C:\Users\Daniel\AppData\Roaming\siw_sdk.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.10 20:42:32 | 000,031,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 20:42:32 | 000,031,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.10 20:35:17 | 000,000,828 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
[2012.10.10 20:35:13 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.10 20:35:04 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat
[2012.10.10 20:35:00 | 2118,316,031 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.10 19:22:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.10 19:13:43 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.10.10 19:11:43 | 000,000,000 | ---- | M] () -- C:\Users\Daniel\defogger_reenable
[2012.10.10 18:51:01 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.10 18:46:46 | 000,820,642 | ---- | M] () -- C:\Windows\SysWow64\sig.bin
[2012.10.10 18:46:46 | 000,044,794 | ---- | M] () -- C:\Windows\SysWow64\nmp.map
[2012.10.09 19:43:56 | 000,007,611 | ---- | M] () -- C:\Users\Daniel\AppData\Local\Resmon.ResmonCfg
[2012.10.09 18:57:08 | 001,178,624 | ---- | M] (CPUID) -- C:\Users\Daniel\AppData\Roaming\siw_sdk.dll
[2012.10.08 23:33:17 | 000,000,008 | ---- | M] () -- C:\Users\Daniel\Documents\lmscfg
[2012.10.08 22:29:15 | 001,614,036 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.08 22:29:15 | 000,697,072 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.08 22:29:15 | 000,652,390 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.08 22:29:15 | 000,148,110 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.08 22:29:15 | 000,121,064 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.08 22:24:18 | 000,002,360 | ---- | M] () -- C:\Users\Public\Desktop\Canon MG5100 series Online-Handbuch.lnk
[2012.10.04 18:20:40 | 000,001,533 | ---- | M] () -- C:\Users\Public\Desktop\Wireshark.lnk
[2012.10.03 19:33:33 | 000,002,288 | ---- | M] () -- C:\Users\Public\Desktop\Lenovo Rescue System.lnk
[2012.10.03 11:41:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
[2012.10.01 23:22:28 | 000,020,668 | ---- | M] () -- C:\Users\Daniel\Documents\HDTune_Error_Scan2_WDC_WD7500AAKS-00RBA.png
[2012.10.01 20:06:44 | 000,001,247 | ---- | M] () -- C:\Users\Daniel\Desktop\Cisco Packet Tracer.lnk
[2012.10.01 00:12:20 | 000,045,736 | ---- | M] () -- C:\Users\Daniel\Documents\HDTune_Benchmark_WDC_WD7500AAKS-00RBA.png
[2012.10.01 00:12:16 | 000,046,611 | ---- | M] () -- C:\Users\Daniel\Documents\HDTune_Info_WDC_WD7500AAKS-00RBA.png
[2012.10.01 00:12:12 | 000,049,534 | ---- | M] () -- C:\Users\Daniel\Documents\HDTune_Health_WDC_WD7500AAKS-00RBA.png
[2012.10.01 00:12:08 | 000,036,732 | ---- | M] () -- C:\Users\Daniel\Documents\HDTune_Error_Scan_WDC_WD7500AAKS-00RBA.png
[2012.09.26 19:37:01 | 000,060,320 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys
[2012.09.25 19:34:31 | 000,126,880 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys
[2012.09.25 19:34:31 | 000,064,416 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys
[2012.09.25 19:34:31 | 000,054,176 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys
[2012.09.25 18:52:55 | 000,289,200 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.09.20 20:31:38 | 000,016,504 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys
[2012.09.20 20:31:36 | 000,106,648 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys
[2012.09.20 20:29:06 | 000,064,376 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys
[2012.09.20 20:17:49 | 000,031,448 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GdNetMon64.sys
[2012.09.20 20:17:47 | 000,002,134 | ---- | M] () -- C:\Users\Public\Desktop\G Data InternetSecurity.lnk
[2012.09.20 20:09:33 | 000,001,554 | ---- | M] () -- C:\Users\Daniel\Documents\cc_20120920_200930.reg
[2012.09.20 20:09:22 | 000,004,730 | ---- | M] () -- C:\Users\Daniel\Documents\cc_20120920_200917.reg
[2012.09.20 19:59:52 | 000,048,120 | ---- | M] () -- C:\Users\Daniel\Desktop\Mcafee deinstallieren und entfernen.htm
[2012.09.20 16:32:56 | 000,001,011 | ---- | M] () -- C:\Users\Daniel\Desktop\StoppUhr.lnk
[2012.09.19 20:07:05 | 000,015,140 | ---- | M] () -- C:\Users\Daniel\Documents\cc_20120919_200701.reg
[2012.09.19 20:06:50 | 000,058,466 | ---- | M] () -- C:\Users\Daniel\Documents\cc_20120919_200643.reg
[2012.09.19 20:04:41 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.09.17 22:43:28 | 000,001,076 | ---- | M] () -- C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
 
========== Files Created - No Company Name ==========
 
[2012.10.10 19:11:43 | 000,000,000 | ---- | C] () -- C:\Users\Daniel\defogger_reenable
[2012.10.08 22:23:37 | 000,012,800 | ---- | C] () -- C:\Windows\SysWow64\CNC1748D.TBL
[2012.10.08 22:23:37 | 000,012,800 | ---- | C] () -- C:\Windows\SysNative\CNC1748D.TBL
[2012.10.08 22:08:25 | 000,002,360 | ---- | C] () -- C:\Users\Public\Desktop\Canon MG5100 series Online-Handbuch.lnk
[2012.10.04 18:20:40 | 000,001,545 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
[2012.10.04 18:20:40 | 000,001,533 | ---- | C] () -- C:\Users\Public\Desktop\Wireshark.lnk
[2012.10.01 23:22:28 | 000,020,668 | ---- | C] () -- C:\Users\Daniel\Documents\HDTune_Error_Scan2_WDC_WD7500AAKS-00RBA.png
[2012.10.01 22:58:27 | 000,040,079 | ---- | C] () -- C:\Windows\SysWow64\LXLCore.VxD
[2012.10.01 22:58:27 | 000,034,272 | ---- | C] () -- C:\Windows\SysWow64\Ljoy.VxD
[2012.10.01 22:58:27 | 000,022,659 | ---- | C] () -- C:\Windows\SysWow64\Lserial.VxD
[2012.10.01 22:58:27 | 000,019,620 | ---- | C] () -- C:\Windows\SysWow64\LJoyFrc.vxd
[2012.10.01 22:58:27 | 000,016,680 | ---- | C] () -- C:\Windows\SysWow64\LDigital.VxD
[2012.10.01 22:58:27 | 000,011,428 | ---- | C] () -- C:\Windows\SysWow64\LUsbVxd.vxd
[2012.10.01 22:58:27 | 000,009,196 | ---- | C] () -- C:\Windows\SysWow64\LJoyV.VxD
[2012.10.01 22:58:27 | 000,006,243 | ---- | C] () -- C:\Windows\SysWow64\LAnalog.VxD
[2012.10.01 20:06:44 | 000,001,247 | ---- | C] () -- C:\Users\Daniel\Desktop\Cisco Packet Tracer.lnk
[2012.10.01 00:12:20 | 000,045,736 | ---- | C] () -- C:\Users\Daniel\Documents\HDTune_Benchmark_WDC_WD7500AAKS-00RBA.png
[2012.10.01 00:12:16 | 000,046,611 | ---- | C] () -- C:\Users\Daniel\Documents\HDTune_Info_WDC_WD7500AAKS-00RBA.png
[2012.10.01 00:12:12 | 000,049,534 | ---- | C] () -- C:\Users\Daniel\Documents\HDTune_Health_WDC_WD7500AAKS-00RBA.png
[2012.10.01 00:12:07 | 000,036,732 | ---- | C] () -- C:\Users\Daniel\Documents\HDTune_Error_Scan_WDC_WD7500AAKS-00RBA.png
[2012.09.20 22:23:34 | 000,820,642 | ---- | C] () -- C:\Windows\SysWow64\sig.bin
[2012.09.20 22:23:34 | 000,044,794 | ---- | C] () -- C:\Windows\SysWow64\nmp.map
[2012.09.20 20:17:47 | 000,002,134 | ---- | C] () -- C:\Users\Public\Desktop\G Data InternetSecurity.lnk
[2012.09.20 20:09:32 | 000,001,554 | ---- | C] () -- C:\Users\Daniel\Documents\cc_20120920_200930.reg
[2012.09.20 20:09:21 | 000,004,730 | ---- | C] () -- C:\Users\Daniel\Documents\cc_20120920_200917.reg
[2012.09.20 19:59:51 | 000,048,120 | ---- | C] () -- C:\Users\Daniel\Desktop\Mcafee deinstallieren und entfernen.htm
[2012.09.20 16:32:56 | 000,001,011 | ---- | C] () -- C:\Users\Daniel\Desktop\StoppUhr.lnk
[2012.09.19 20:07:03 | 000,015,140 | ---- | C] () -- C:\Users\Daniel\Documents\cc_20120919_200701.reg
[2012.09.19 20:06:46 | 000,058,466 | ---- | C] () -- C:\Users\Daniel\Documents\cc_20120919_200643.reg
[2012.09.19 20:04:41 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.09.17 22:43:28 | 000,001,076 | ---- | C] () -- C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
[2012.08.09 17:32:41 | 000,000,784 | ---- | C] () -- C:\Users\Daniel\AppData\Local\CHANGE__PASSWORD__HERE - Kopie.js
[2012.07.22 19:36:45 | 000,090,808 | ---- | C] () -- C:\Users\Daniel\AppData\Roaming\SiwPwdSpy.dll
[2012.07.15 18:31:02 | 000,007,611 | ---- | C] () -- C:\Users\Daniel\AppData\Local\Resmon.ResmonCfg
[2012.07.15 18:26:33 | 000,000,000 | ---- | C] () -- C:\Windows\firstboot.dat
[2012.05.10 15:01:55 | 001,640,718 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.05.10 14:55:12 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.05.10 14:54:09 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2012.05.10 14:53:33 | 000,139,264 | ---- | C] () -- C:\Windows\SysWow64\ustor.dll
[2012.05.10 14:53:33 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\UMonit.exe
[2012.05.10 14:53:31 | 000,172,097 | ---- | C] () -- C:\Windows\SysWow64\NoMSGuninstall.exe
[2012.05.10 14:53:31 | 000,000,840 | ---- | C] () -- C:\Windows\SysWow64\ProductName.ini
[2012.05.10 14:53:30 | 000,000,187 | ---- | C] () -- C:\Windows\SysWow64\IconCfg0.ini
[2012.02.22 10:48:49 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.22 10:48:49 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.02.22 10:48:48 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2012.02.14 22:27:38 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.12.08 16:14:58 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.10.08 22:31:27 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Canon
[2012.09.19 20:06:20 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Free Download Manager
[2012.07.15 18:27:27 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Leadertech
[2012.10.08 23:32:20 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\NetSpeedMonitor
[2012.09.23 20:15:29 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\pdfforge
[2012.07.16 00:24:24 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\SoftGrid Client
[2012.07.16 00:12:49 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\TP
[2012.10.04 18:26:36 | 000,000,000 | ---D | M] -- C:\Users\Daniel\AppData\Roaming\Wireshark
 
========== Purity Check ==========
 
 

< End of report >
         
Extras.txt:
Code:
ATTFilter
OTL Extras logfile created on: 10.10.2012 20:41:56 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Normal\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,96 Gb Total Physical Memory | 5,70 Gb Available Physical Memory | 71,56% Memory free
15,93 Gb Paging File | 13,38 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 454,89 Gb Total Space | 252,58 Gb Free Space | 55,52% Space Free | Partition Type: NTFS
Drive D: | 451,35 Gb Total Space | 363,38 Gb Free Space | 80,51% Space Free | Partition Type: NTFS
 
Computer Name: LENOVO-PC | User Name: Daniel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0F6D5A75-C8DF-4207-BE2C-2DFB16B8189D}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{26C2BDF7-7E62-4AE6-8987-4BAE3D06D10E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2965772A-84C5-42A6-AB97-D581E9E853E6}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{429259DC-F013-4E35-8A0E-E6B1743198E5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{4FE468BE-61A1-4F09-9146-DAEFAC5B3094}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{5517F0D2-3F18-4E06-8426-0CB95F5A9022}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5D7503EC-DD7A-4532-8F71-A212B86BC3CB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{61556947-CC26-4A97-962E-97865DB33E45}" = rport=445 | protocol=6 | dir=out | app=system | 
"{63312EFE-7A28-4E88-8A53-A324D19284DF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{65EE25AA-B118-4078-9D10-96A6D1E03204}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{6CC6EEC7-591A-44DF-8D5B-B0E223379D6E}" = rport=138 | protocol=17 | dir=out | app=system | 
"{74FBC188-3137-4E8D-9E6C-08FAB453D4E1}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{79005605-98F3-42A3-8D0E-077FFCDE306A}" = lport=445 | protocol=6 | dir=in | app=system | 
"{831AB7DE-B8A9-4001-8887-3D4634CCDB7A}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{84E6FFEE-B88A-4FDE-8D5F-68F051D56CF4}" = lport=137 | protocol=17 | dir=in | app=system | 
"{8A3091D5-E664-424D-8138-833575561098}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8E017B69-4DDD-42A6-87CF-C64F9DFF2B4F}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{948669A1-C2E4-4E86-8A8C-EE9E03A6630C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{97A038D8-3969-40C2-A0EA-9C98D122D19E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{98D80E9B-3194-4A14-8E3C-2D3682EF035B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A3A5A166-21C0-46F6-ACB9-0060F45698D9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BD05D7C7-9475-4B40-9A8B-34A6F0BB2236}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{BF4468F9-4A45-480D-9D81-94E69B0F56BB}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{C2EF6071-8F05-4AD4-BB21-8A2534512B23}" = lport=139 | protocol=6 | dir=in | app=system | 
"{C3583310-40FB-4554-9C3E-45FF3E80F9D1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{CB15F971-F86D-46AA-B70D-3EFAD0D14D0D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{CC1B1E2E-A6FD-4376-9A26-FC939524DCFA}" = rport=137 | protocol=17 | dir=out | app=system | 
"{CC2E65C0-FEEB-49EC-AD63-2DA257DB40C2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E519C35E-51FA-4C40-988A-5BD5C231AF22}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{EA313FD6-7E71-4D30-B423-89D65A829F8D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{EA91B2D5-BC54-4698-B58B-5B72E97A38CC}" = rport=139 | protocol=6 | dir=out | app=system | 
"{EE3DCEA2-64C5-479C-A1F4-4C675B986E0E}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DD914C3-3F8C-4E05-8304-13C36820F451}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{10D3A91B-4330-48A6-A144-F990C4D91E7D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{299915AD-7A25-46CA-A066-522CE4880947}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3EF40702-D3A5-40BA-A052-51AB9D1D80CB}" = protocol=6 | dir=out | app=system | 
"{410476FC-4138-47B2-BC84-9D0BCDF412BE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{427417A9-92CF-4107-BBF8-C423059994BE}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{50CAB6BA-FFD8-40DA-9FAF-044700114D9F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{5300D73B-0870-4389-9FDB-46464F1506DE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{599B8493-128C-4B7F-B6A1-9B8D20677D0D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{775D2979-C4EE-4FBF-B8D8-84F3ACE1ABE0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{942AFAB0-6956-4619-9826-D45DA9837AF6}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{96C141A5-C591-41AB-A4F1-2D16C27A3A32}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{A4D4DE27-A75F-4013-90EB-50A66C4E266D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A693CC4E-D14F-4856-B0E9-3923EA0715F3}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{AB4DB1E5-E278-4408-8B0D-63FB4CB3ED6F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B0997847-9F0F-4E7F-8761-37F96DB7F153}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{BA5934E5-3326-44A4-B657-BBF9AF545D7B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{CC5393B9-E5AC-4227-B08A-582B45FBC9E5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{D0B9D362-6DBA-4A44-B35A-2075ECC9604D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D7E8E716-F8DF-4252-9210-CA76481167AC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{EA3254FA-8021-4C4B-977F-E06930F59D0F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{EE288513-A3DB-44D2-85D5-B82B260C2BCF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F19A421E-7ED7-4CDA-9114-73A31373D954}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series" = Canon MG5100 series MP Drivers
"{1AAF3A3B-7B32-4DDF-8ABB-438DAEB46EEC}" = Windows Live Family Safety
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{1C55470A-7C9E-4C63-B466-6AFFC69E94E9}" = Windows Live Family Safety
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit)
"{43B74FAB-FB58-447D-8D3A-5F638AF36FD1}" = Netzmanager
"{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}" = Windows Live Family Safety
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo Rescue System
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{6199B534-A1B6-46ED-873B-97B0ECF8F81E}" = Intel® Trusted Connect Service Client
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{81D00339-968D-15D1-3499-8431658E896F}" = AMD Catalyst Install Manager
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{883F56F3-B9E7-4B07-8F6D-2BEF6291DF16}" = Oracle VM VirtualBox 4.1.22
"{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}" = NetSpeedMonitor 2.5.4.0 x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E1F8138F-41E7-F39B-EA3E-735EC73F8889}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{036F7816-8EC9-22F9-1E43-7123DB870B30}" = CCC Help Danish
"{0474AACF-1A71-7209-E6A6-C1F70C76EDAA}" = CCC Help Swedish
"{0A3B7EBA-E498-253E-CAF0-D9821A29A470}" = CCC Help Greek
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1E4ED7C6-74B9-EB9C-AB39-8FDBD8F5695F}" = CCC Help German
"{1E943FE6-F628-08B4-DD29-A12101B042C1}" = CCC Help Spanish
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{240C3DDD-C5E9-4029-9DF7-95650D040CF2}" = Intel(R) USB 3.0 eXtensible Host Controller Driver
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29BD817E-1563-1746-EAD9-70291A2F2D4D}" = CCC Help Turkish
"{2F7C2130-B132-5236-1A12-E0301471D830}" = CCC Help Chinese Traditional
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C592481-FC0C-EAF8-6EB2-3DEE01C36072}" = CCC Help Korean
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Lenovo Power2Go
"{41DD6ED5-3F94-47F4-B28C-10A4ADA037ED}" = Education Portal
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F78AE55-4886-97C6-2CC9-AB177F523B26}" = CCC Help Dutch
"{50076563-CF6F-6C29-09BA-8730A54DE9F9}" = CCC Help English
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{6006059E-013D-4B77-BC5C-4DD5E4A6570D}" = G Data InternetSecurity 2012
"{619E87FD-26F9-B282-5E46-D17093AAA22D}" = CCC Help Finnish
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65F7FB65-3BCC-0A39-9E7D-C3660E38C9CB}" = CCC Help Chinese Standard
"{6707C034-ED6B-4B6A-B21F-969B3606FBDE}" = Lenovo Registration
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A8139D8-B5D4-B778-4FEB-A3B720DB30E1}" = Catalyst Control Center
"{6CF2CB52-46B6-FAE4-5921-BAB59D05CAE7}" = CCC Help Polish
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration
"{803E6DED-5050-4E3D-B26A-5915397362CD}" = Lenovo Screensaver
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{816F9A97-9889-43DA-A394-7AA45DD68BA0}" = Power Control Switch
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{8743A446-E143-FDE1-BEC8-09A8B7F0A131}" = Catalyst Control Center Localization All
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{959B7F35-2819-40C5-A0CD-3C53B5FCC935}" = Genesys USB Mass Storage Device
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C02C624-48D6-E6DE-52AF-0A88E0DB7D38}" = CCC Help Italian
"{9D3D8C60-A55F-4123-B2B9-173F09590E16}" = REALTEK Wireless LAN Driver
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E3469A6-443A-452C-BF44-8D7CE3A9A7E2}" = LVT
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A6C48A9F-694A-4234-B3AA-62590B668927}" = Intel(R) Manageability Engine Firmware Recovery Agent
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW 2011 Home Edition
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AD372173-A8D6-6F21-3642-A05DE64E81CA}" = CCC Help Czech
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B266E062-D6C5-485B-B426-51B152B041A6}" = Lenovo Blacksilk USB Keyboard Driver
"{B627299E-DC01-B818-42C1-CF1CAEB82301}" = CCC Help Portuguese
"{B9242864-2841-4ADE-86E0-8F90F91B04DD}" = Logitech Gaming Software
"{BEEED310-7C16-49F5-FDCE-4484F6F256D2}" = CCC Help Hungarian
"{BFECCF2A-F094-4066-8BFA-29CCBB7F6602}" = Driver & Application Installation
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C5A03F82-CCFE-06B4-428D-0BEB66AFBE8F}" = CCC Help Japanese
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D79429AB-E078-CDD0-0F25-F7206BBC1713}" = CCC Help Norwegian
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE1718B6-64F0-2F98-7FF2-7E4CA3526169}" = CCC Help French
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DFFABF09-4BD5-4258-B191-117B1B743732}" = Catalyst Control Center - Branding
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E763F193-D288-5854-791A-EA95D8858769}" = CCC Help Russian
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29CBF73-C211-4616-898A-379A2679F990}" = ThemeWallpaper
"{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X
"{F8A10A25-D8DD-4661-9A1E-7F6DBAAA3C5E}" = inSSIDer
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FB50A7F5-2FF9-CEA4-6149-47F84D3E10B8}" = CCC Help Thai
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF60F8C4-5073-A43B-5BF4-A7BC3098C533}" = Catalyst Control Center Profiles Desktop
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Canon MG5100 series Benutzerregistrierung" = Canon MG5100 series Benutzerregistrierung
"CanonMyPrinter" = Canon My Printer
"Cisco Packet Tracer 5.3.3_is1" = Cisco Packet Tracer 5.3.3
"FlightSim_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Microsoft Flight Simulator X: Acceleration
"Free Download Manager_is1" = Free Download Manager 3.9
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Lenovo Power2Go
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo Rescue System
"InstallShield_{F535B2CF-C9BB-4162-B03A-02D6971F32CC}" = Microsoft Flight Simulator X
"Mozilla Firefox 16.0 (x86 de)" = Mozilla Firefox 16.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"Netzmanager" = Netzmanager
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Rapidboot Advanced" = Rapidboot Advanced
"RTMshadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X
"Secunia PSI" = Secunia PSI (3.0.0.3001)
"SP1shadow_{7D606567-5047-451A-B49E-29FCB6012B4E}" = Flight Simulator X Service Pack 1
"StoppUhr" = StoppUhr
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"Wireshark" = Wireshark 1.8.3 (64-bit)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.09.2012 08:33:04 | Computer Name = Lenovo-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.09.2012 13:46:36 | Computer Name = Lenovo-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 23.09.2012 15:08:15 | Computer Name = Lenovo-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: a90    Startzeit: 01cd99b324815ebf    Endzeit: 0    Anwendungspfad: C:\Windows\Explorer.EXE

Berichts-ID:
 018e6981-05b2-11e2-99a9-8c89a5d2aa85  
 
Error - 23.09.2012 15:18:51 | Computer Name = Lenovo-PC | Source = Application Error | ID = 1000
Error - 23.09.2012 18:31:36 | Computer Name = Lenovo-PC | Source = WinMgmt | ID 
= 10
 
Description = 
Error - 23.09.2012 18:38:10 | Computer Name = Lenovo-PC | Source = WinMgmt | ID 
= 10
 
Description = 
Error - 24.09.2012 14:53:46 | Computer Name = Lenovo-PC | Source = WinMgmt | ID 
= 10
 
Description = 
Error - 24.09.2012 15:24:53 | Computer Name = Lenovo-PC | Source = Application Error
 | ID = 1000
 
Description = Name der fehlerhaften Anwendung: Dynamo.exe, Version: 0.0.0.0, Zeitstempel: 0x451d8e1c
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00010000
ID des fehlerhaften Prozesses: 0x73c
Startzeit der fehlerhaften Anwendung: 0x01cd9a89a6b1d58d
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Iometer.org\Iometer 2006.07.27\Dynamo.exe
Pfad des fehlerhaften Moduls: unknown
Berichtskennung: 83d0ede8-067d-11e2-9e57-8c89a5d2aa85
Error - 24.09.2012 15:25:29 | Computer Name = Lenovo-PC | Source = Application Hang
 | ID = 1002
 
Description = Programm Iometer.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 16e8

Startzeit: 01cd9a89a692e3a9

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Iometer.org\Iometer 2006.07.27\Iometer.exe

Berichts-ID: 964f5011-067d-11e2-9e57-8c89a5d2aa85

Error - 24.09.2012 17:50:07 | Computer Name = Lenovo-PC | Source = MSPAC | ID = 
16389
 
Description = 
Error - 24.09.2012 18:07:37 | Computer Name = Lenovo-PC | Source = MSPAC | ID = 
16389
 
Description = 
 
Error encountered while reading event logs.
 
< End of report >
         
4. Weiterhin habe ich mir Malwarebytes geholt, installiert und den Vollscan ausgeführt:

Code:
ATTFilter
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.10.10.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Daniel :: LENOVO-PC [Administrator]

10.10.2012 20:59:11
mbam-log-2012-10-10 (20-59-11).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 395010
Laufzeit: 1 Stunde(n), 6 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\Software\Schmidt-Pro (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
5. Aufgrund des Fundes habe ich meine externe Frestplatte (H), auf der sich Windows-Sicherungen befinden, angeschlossen, und erneut einen Vollscan gemacht:

Code:
ATTFilter
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.10.10.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Daniel :: LENOVO-PC [Administrator]

10.10.2012 22:15:18
mbam-log-2012-10-10 (22-15-18).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|H:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 398968
Laufzeit: 1 Stunde(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\Software\Schmidt-Pro (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
6. Heute habe ich es geschafft, mit der GData Boot CD alle Viren, die er findet, zu protokollieren:

Code:
ATTFilter
Virenprüfung mit G Data AntiVirus
Version 10.0 (02.02.2011)
Virensignaturen vom 11.10.2012
Startzeit: 11.10.2012 17:35
Engine(s): EngineA (AVA 22.6391) EngineB (AVB 22.1184) 
Heuristik: Ein
Archive: Ein
Systembereiche: Ein

Prüfe Systembereiche....
Prüfung folgender Verzeichnisse und Dateien:
	/mnt

Objekt: c099986d-9a9d-11e1-816f-806e6f6e6963.vhd
	Pfad: /mnt/F:/WindowsImageBackup/Lenovo-PC/Backup 2012-08-22 095349
	Status: Virus gefunden
	Virus: Win32:Gremo
Objekt: activeos.exe
	Pfad: /mnt/E:/OneKey/main
	Status: Virus gefunden
	Virus: Win32:Malware-gen
Objekt: W7 64 sp1.vdi
	Pfad: /mnt/D:/Users/Daniel/VirtualBox VMs/W7 64 sp1
	Status: Virus gefunden
	Virus: Win32:Adloader-AC [Trj]
Objekt: W8.vdi
	Pfad: /mnt/D:/Users/Daniel/VirtualBox VMs/W8
	Status: Virus gefunden
	Virus: Win32:Small-HUF [Trj]
Objekt: Win8.vdi
	Pfad: /mnt/D:/Users/Daniel/VirtualBox VMs/Win8
	Status: Virus gefunden
	Virus: Win32:Gremo

Analyse vollständig ausgeführt: 11.10.2012 19:23
179444 Dateien geprüft
5 infizierte Dateien gefunden
0 verdächtige Dateien gefunden
         
(Laufwerksbuchstaben siehe oben)

Ich finde es verdächtig, dass sich vier der fünf Funde auf vhd / vdi - Dateien beziehen, daher tippe ich auf einen Fehlalarm ( false positive).
Zur Erklärung: W7 64 SP1 ist eine virtuelle Windows 7 - Maschine, auf der ein paar Programme installiert sind (z.B. Office etc.)
W8 und Win8 sind Maschinen mit reiner Windows 8 Release Prewiew

Was sagt ihr dazu?

Alt 13.10.2012, 13:42   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien - Standard

GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien



Sieht für mich auch eher nach Fehlalarmen aus.

Zitat:
HKCU\Software\Schmidt-Pro (Trojan.Agent)
Das kennst du?

Zitat:
Zur Erklärung: W7 64 SP1 ist eine virtuelle Windows 7 - Maschine,
Daher die VHD-Dateien, sind das die virtuellen Disks der VMs?
Hast du das Wirts-OS gescannt und die Logs sind das Ergebnis oder hast du auch eine der VMs gescannt abgesehen von den VHD-Dateien?
__________________

__________________

Alt 14.10.2012, 21:33   #3
User1578
 
GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien - Standard

GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien



Zitat:
Zitat von cosinus Beitrag anzeigen
Sieht für mich auch eher nach Fehlalarmen aus.

Code:
ATTFilter
HKCU\Software\Schmidt-Pro (Trojan.Agent)
         
Das kennst du?
Ich kann dir leider nicht sagen, was das ist, aber ich habe, seit dieser Schlüssel entfernt wurde, auch keine Veränderung feststellen können.

Zitat:
Zitat von cosinus Beitrag anzeigen
Sieht für mich auch eher nach Fehlalarmen aus.

Daher die VHD-Dateien, sind das die virtuellen Disks der VMs?
Nochmal im Klartext:

Die drei gefundenen .vdi - Dateien sind die von VirtualBox erstellten virtuellen Disks der beschriebenen virtuellen Maschinen. Die einzelne .vhd - Datei ist das von der Windows - Sicherung erstellte Systemabbild und den fünften Fund kann ich nicht so richtig einschätzen, da ich nur raten kann, dass die Partition E: meine OEM-Partition ist und darauf liegen vermutlich die ganzen Recovery - Tools. Übrigens heißt das von Lenovo auf meinem PC vorinstallierte Recovery - Programm "Lenovo OneKey Recovery", daher vermute ich, dass der Fund diesem Programm zuzuordnen ist.

Zitat:
Zitat von cosinus Beitrag anzeigen
Sieht für mich auch eher nach Fehlalarmen aus.

Hast du das Wirts-OS gescannt und die Logs sind das Ergebnis oder hast du auch eine der VMs gescannt abgesehen von den VHD-Dateien?
Sämtliche bisher geposteten Logs und Informationen bezogen sich ausschließlich auf das Wirts - System (Windows 7 Home Premium SP1 64 bit).

Die VMs benutze ich selten und ich hatte sie, abgesehen vom Scan ihrer .vdi - Dateien vom Wirtssystem aus, auch noch nicht gescannt. Vorsichtshalber habe ich jedoch soeben die virtuelle Maschine "W7 64 SP1" per GDATA BootScan auf dieselbe Weise gescannt wie das Wirtssystem. Hier das Ergebnislog:

Code:
ATTFilter
Virenprüfung mit G Data AntiVirus
Version 10.0 (02.02.2011)
Virensignaturen vom 14.10.2012
Startzeit: 14.10.2012 21:20
Engine(s): EngineA (AVA 22.6426) EngineB (AVB 22.1191) 
Heuristik: Ein
Archive: Ein
Systembereiche: Ein

Prüfe Systembereiche....
Prüfung folgender Verzeichnisse und Dateien:
	/mnt/


Analyse vollständig ausgeführt: 14.10.2012 21:55
71625 Dateien geprüft
0 infizierte Dateien gefunden
0 verdächtige Dateien gefunden
         
Übrigends ist der GData - Virenscan des Wirtssystems unter Windows ohne Fund:

Code:
ATTFilter
Virenprüfung mit G Data InternetSecurity 2013
Version 23.0.5.9 (17.09.2012)
Virensignaturen vom 09.10.2012
Startzeit: 09.10.2012 18:51:28
Engine(s): Engine A (AVA 22.6369), Engine B (AVL 22.1241)
Heuristik: Ein
Archive: Ein
Systembereiche: Ein
RootKits prüfen: Ein

Prüfung der Systembereiche...
Prüfung aller im Speicher befindlichen Prozesse und Verweise im Autostart...
Prüfung auf RootKits...
Prüfung aller lokalen Festplatten...
Analyse vollständig durchgeführt: 09.10.2012 19:30:18
    176271 Dateien überprüft
    0 infizierte Dateien gefunden
    0 verdächtige Dateien gefunden


Der Zugriff auf die folgenden Dateien wurde verweigert:
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMsMpPsSession7.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\03c672c9332a61f1e1629caff4dd7367_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\05106cfa2216d2d4dc6d6f5e7e9bf5a2_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0016dac98b10f40171a9497cb009cddc_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0c7895275ea1aa90dbbae804c71660e4_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\105ccbf74b96473cafb8ff5033c7485c_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\12a0c72d4940064d40be65bf19e583e3_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\0d61276fd58abc85b620e1bf9e216d2e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\18fb411aacea181f8a39ae4f38ed18f5_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\1c7f14182476d8a30f09993c04cda80e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2992579982c73275a3a034c656834e3a_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2bee2d803a526872b08f77323b31028d_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\2d04d99a5dfe95334eeda91d3599e23c_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\348b0ed8d8c859a5e5dddbd3e0b0105c_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\351dffbfa2303f774b05739a57197fd2_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\36097ecf2784237bb74a7ee3518d448e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\3ab535b50222b76ba950ea479496bcec_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4540492a359fe9ed9d931b5407b90ca2_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\47541811460572ada13b9a0ab7a5cd74_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\4f3f5bdffea30591d76a821be04d322d_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5206e7eb62f87f96d6e44b2005a8d5ef_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\53bd2eb23b5dbd19f0aa732a640faccb_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\570855bb372cf6407eed4b2f6ffdcb41_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5d8f9ed17c9784af3ae37aac7f294ad0_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\65afad19c8198c84f88db50de04c5041_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\63331267f2962dc1c2db52a08e21b48e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\6c935854942c402fc296cafcc126e0c3_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7032330fcc7f967edb817eacf2baf71c_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\703d10df6e91b4959c344bceffe95241_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\784b512cfac3081c424c3c4d19299f2e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\78527943dbeb0cf7c986c555745d86df_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7339ad4da8041cd8cc06bb1eee9584fd_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7be1ab09cc9eabec56f2547a04030132_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7c27c1326cd1cba193b41211b6b07bb4_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7db7418e278914d3dc86fe3808d2e387_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\826ac8d86ce4083dae182594d328f03f_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\92e333a4e39605ffc262631579153c70_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\95a35a5e1d7e7c53698c9a7bad7fc572_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\970db30e13f22752d0b616381af6d54e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9ecbcf36e110c96b9a66abc0d288f3c2_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9d91d8ea49de04e4c0d40ff1d97cfc59_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a141865289e34592f217672cbffe6517_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a332370874f1669135f85e76accf903d_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a7144e5b44b8e1f7b1e64777263772a4_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\a92cf8d89bed0e8671eba2528611f74a_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ab23c232d0d6f9301e6635d6f299d081_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b021c2bb2d50953dc905956064b8528b_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b0f82f61d41aed5e9763f1a1663f7e0c_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b2829a1fe58d226de8b52e039a3669df_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b2ca6d5d6977ac1d42a0175f915d367c_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\b9f4abae5b7c56c839ae1b7ad7826178_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\bafc11964f75daf47d4037460bf82478_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\bd5cf3b6af4943554be661fa302c3010_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\be41a4761a8f9e8bf389fd1c58f46f40_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c96e749d2e6c5d4a1d9f18cd408e8e87_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c3a5b821df88379ca2aa8424dc34c0da_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\c9fd4331c5a0c7c0ff20f5c8f7a3a008_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\cdaf441f95b4156d06eff708e5a81e0c_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\cebf596b8302798a14563ced4be33950_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d3de91c7eba2c3a8b438f2317d924c07_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d2fadf1613485c0c68767aac468d588b_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ca0eface921f4e2eb87dad6a27269ee1_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d1fad6301d6a02cdfab695f6c413ddf0_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d40282033be66ab0908409b45d9ca0ae_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\d63d38e0496c5031c9ac045b087c80a0_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\da399712eb944769c60b4427c995fb7e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\e63103616bace33eeadd587eb36b0edb_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f2ccb8612d06b5da1efd5c69b399845e_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\eaa6c6d3734707389b3a60f37cdae9f9_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f79ed1428bdbedb5e471068485fdb42d_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\db1b4cdef04c29a7ef98785f2ecf594b_b36b96c0-a8a3-4fe3-86d0-f48dde7d5b42
C:\System Volume Information\Syscache.hve
C:\System Volume Information\Syscache.hve.LOG1
C:\System Volume Information\MountPointManagerRemoteDatabase
C:\System Volume Information\Syscache.hve.LOG2
C:\System Volume Information\WindowsImageBackup\Catalog\BackupGlobalCatalog
C:\System Volume Information\WindowsImageBackup\Catalog\GlobalCatalog
C:\System Volume Information\WindowsImageBackup\SPPMetadataCache\{4883cf1f-620e-4925-b9d8-b82b8d28fcca}
C:\System Volume Information\WindowsImageBackup\SPPMetadataCache\{35f2173a-c3fa-4dc5-b798-07949ebe5c33}
C:\System Volume Information\WindowsImageBackup\SPPMetadataCache\{61794463-fffb-480b-aa11-d077201e02b8}
         
Wie geht es nun weiter?
__________________

Geändert von User1578 (14.10.2012 um 22:10 Uhr)

Alt 15.10.2012, 11:26   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien - Standard

GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien



Also wie schon gesagt, für mich sieht das nach Fehlalarmen aus

Zitat:
Wie geht es nun weiter?
Deswegen nix weiter - oder hast du gute Argumente dafür?
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 15.10.2012, 20:10   #5
User1578
 
GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien - Standard

GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien



Zitat:
Zitat von cosinus Beitrag anzeigen
Also wie schon gesagt, für mich sieht das nach Fehlalarmen aus

Zitat:
Wie geht es nun weiter?
Deswegen nix weiter - oder hast du gute Argumente dafür?
So gesehen habe ich keine weitere Argumente. Ich wollte ja nur wissen, ob die zuletzt geposteten Logs noch irgendwelche Hinweise lieferten.

Auch wenn es nur um Fehlalarme ging, möchte ich mich hier nochmal in aller Form bei dir, Cosinus, und bei allen anderen hier im Team für die Bearbeitung und der Service hier bedanken.
Ihr seid ein Super Team und das hier ist ein sehr empfehlenswertes Board


Antwort

Themen zu GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien
autorun, bho, error, fehlalarm, firefox, flash player, format, free download, helper, home, homepage, infizierte dateien, internet, internet security 2013, laufwerksbuchstabe, logfile, microsoft office starter 2010, mozilla, nodrives, plug-in, problem, realtek, registry, rundll, scan, secunia psi, security, siteadvisor, software, starten, svchost.exe, usb, usb 2.0, usb 3.0, viren, win32:adloader-ac [trj], win32:gremo, win32:malware-gen, win32:small-huf [trj]




Ähnliche Themen: GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien


  1. Windows 10 bootet nicht (Reboot and select proper boot device or insert boot media in selected boot device and press a key)
    Alles rund um Windows - 18.10.2015 (4)
  2. Windows 8 / GData findet verschlüsselte Einträge, zehn Tage ohne Virenschutz gesurft
    Log-Analyse und Auswertung - 07.09.2015 (22)
  3. GData findet Trojan.Doc.DropperA in gelöschter Mail
    Plagegeister aller Art und deren Bekämpfung - 03.06.2015 (9)
  4. Windows 7: GData findet mindestens 25 Viren. Virenfreiheit möglich?
    Log-Analyse und Auswertung - 19.02.2015 (29)
  5. GData meldet Win32.Adware.OpenCandy.C
    Log-Analyse und Auswertung - 25.12.2014 (5)
  6. GDATA: Win32.Adware.Conduit.B lässt sich nicht desinfizieren & viele andere Viren in Quarantäne
    Log-Analyse und Auswertung - 26.09.2014 (17)
  7. AntiVir findet nichts doch Malwarebytes findet 22 infizierte Dateien
    Plagegeister aller Art und deren Bekämpfung - 04.09.2012 (21)
  8. GData findet Trojaner Trojan.JS.wpress.A
    Plagegeister aller Art und deren Bekämpfung - 06.02.2012 (17)
  9. GData Boot Cd findet 17 Viren Int 13-512
    Plagegeister aller Art und deren Bekämpfung - 01.08.2011 (0)
  10. Gdata zeigt sehr viele zugriff verweigert dateien an...
    Antiviren-, Firewall- und andere Schutzprogramme - 02.03.2010 (5)
  11. Gdata kann Dateien nicht öffnen
    Log-Analyse und Auswertung - 17.01.2010 (2)
  12. Trojaner: Win32:Trojan-gen {Other} von Gdata auf Pcwelt cd gefunden
    Plagegeister aller Art und deren Bekämpfung - 08.01.2009 (0)
  13. resylcled\boot.com ist keine zulässige Win32-Anwendung & andere Probleme
    Mülltonne - 26.11.2008 (0)
  14. trojan.win32.patched.dn bei GData
    Plagegeister aller Art und deren Bekämpfung - 05.11.2008 (3)
  15. Win32 Trojan-Gen oder falscher Alarm GDATA?
    Log-Analyse und Auswertung - 08.10.2008 (6)
  16. GDATA findet Trojaner BAT.Ftp.ab
    Antiviren-, Firewall- und andere Schutzprogramme - 26.09.2008 (10)
  17. Frage zu: GData hat Trojan.Win32.VB.aqt gemeldet
    Plagegeister aller Art und deren Bekämpfung - 26.01.2008 (0)

Zum Thema GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien - Hallo, meine Geschichte der Reihe nach: 1. Ich bin GData Internet Security 2013 - Nutzer und habe vorgestern aus Neugier und um sicherzugehen, dass alles in Ordnung ist (habe keine - GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien...
Archiv
Du betrachtest: GData Boot CD findet Win32: Gremo und andere in .vhd / .vdi - Dateien auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.