Virenscanner läßt sich nicht starten, Viren-/Trojanerbefall

mcosg · 05.09.2013, 09:53

Hallo liebe Trojanerboardler,

ich habe, wie meine Überschrift schon erklärt, ein Problem beim Hochfahren mit meinem Antivirenscanner.

Ein Kollege bat mich um Hilfe, er hätte eine interne E-Mail über Flugdaten zu einer bevorstehenden Reise weitergeleitet bekommen und könne den Anhang nicht öffnen.
Dies war eine gezippte Datei, die von mir entpackt und gestartet wurde in der Erwartung, die PDF-Datei angezeigt zu bekommen.
Als nichts dergleichen geschah, beschlich mich der Verdacht, dass diese E-Mail doch nicht intern gesendet wurde.
Bei genauer Betrachtung der Mail stellte sich heraus, dass dies eine gefälschte Mail war.
Da es sich um einen Netzwerkrechner handelt entschloss ich mich, den Rechner doch am nächsten Vormittag vom Netz zu nehmen.
Alle Analysen wurden offline gemacht, der Rechner bleibt vom Netzt getrennt.

Was kann ich tun um meinen Rechner von diesem Fehler zu befreien?

Ich bitte um eure Hilfe.

Hier die Logs

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:16 on 05/09/2013 (chriba)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-09-2013
Ran by chriba (administrator) on WS03_1 on 05-09-2013 09:44:07
Running from C:\Users\chriba\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Intel Corporation) C:\Program Files\Intel\Services\IPT\jhi_service.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\ntrtscan.exe
() C:\Program Files\Common Files\Sennheiser\SecomUpdateService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\tmlisten.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\TmProxy.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\BM\TMBMSRV.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
(Advanced Micro Devices Inc.) c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(Dell Computer Corporation) C:\dell\DBRM\Reminder\DbrmTrayicon.exe
(Tobit.Software) C:\Windows\System32\DV4TS.EXE
(Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\PccNTMon.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\PccNT.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Farbar) C:\Users\chriba\Desktop\FRST (32).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [StartCCC] - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-02-18] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RemoteControl9] - C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-01] (CyberLink Corp.)
HKLM\...\Run: [PDVD9LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-17] (CyberLink Corp.)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [RoxWatchTray] - C:\Program Files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM\...\Run: [Desktop Disc Tool] - C:\Program Files\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM\...\Run: [DBRMTray] - C:\Dell\DBRM\Reminder\DbrmTrayIcon.exe [227328 2011-03-08] (Dell Computer Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [DV4TS.EXE] - c:\windows\system32\DV4TS.EXE [183808 2011-04-14] (Tobit.Software)
HKLM\...\Run: [HSUWatchDog] -  [x]
HKLM\...\Run: [OfficeScanNT Monitor] - C:\Program Files\Trend Micro\Security Agent\pccntmon.exe [1373056 2013-01-02] (Trend Micro Inc.)
HKLM\...\RunOnce: [DBRMTray] - C:\Dell\DBRM\Reminder\TrayApp.exe [7168 2010-02-05] (Microsoft)
HKU\chriba.ZIM\...\Run: [Greenshot] - C:\Program Files\Greenshot\Greenshot.exe [ 2010-07-12] ()
HKU\chriba.ZIM\...\Run: [Akamai NetSession Interface] - C:\Users\chriba.ZIM\AppData\Local\Akamai\netsession_win.exe [ 2013-06-05] (Akamai Technologies, Inc.)
HKU\chriba.ZIM\...\Run: [HeadSetupApp] -  [x]
HKU\chriba.ZIM\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [ 2012-01-20] (Microsoft Corporation)
HKU\chriba.ZIM\...\Run: [defyhlp] - C:\Users\chriba.ZIM\AppData\Roaming\defyhlp.exe [ 2013-09-05] (Enemyseed Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Communication Assistant.lnk
ShortcutTarget: Communication Assistant.lnk -> C:\Program Files\Panasonic\Communication Assistant\Communication Assistant.exe (Panasonic System Networks Co., Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\David.fx.LNK
ShortcutTarget: David.fx.LNK -> C:\Program Files\Tobit InfoCenter\DVWIN32.EXE (Tobit.Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Mozilla Thunderbird.lnk
ShortcutTarget: Mozilla Thunderbird.lnk -> C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USREL/8
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USREL/8
SearchScopes: HKLM - DefaultScope {0FB58B71-A39D-4FC1-8C40-8CEF449165A1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {0FB58B71-A39D-4FC1-8C40-8CEF449165A1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLRDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKCU - DefaultScope {0FB58B71-A39D-4FC1-8C40-8CEF449165A1} URL = 
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\Security Agent\TmIEPlg.dll (Trend Micro Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\Security Agent\TmIEPlg.dll (Trend Micro Inc.)
Tcpip\..\Interfaces\{7A927D17-F837-4A3C-9F1A-80A137F8944D}: [NameServer]192.168.1.10,192.168.1.1

========================== Services (Whitelisted) =================

R2 Akamai; c:\program files\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-02] (Akamai Technologies, Inc.)
R2 jhi_service; C:\Program Files\Intel\Services\IPT\jhi_service.exe [212944 2011-02-24] (Intel Corporation)
S2 KMService; C:\Windows\system32\srvany.exe [8192 2012-03-23] ()
R2 ntrtscan; C:\Program Files\Trend Micro\Security Agent\ntrtscan.exe [2275336 2013-01-02] (Trend Micro Inc.)
S3 RoxMediaDB12OEM; C:\Program Files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [1116656 2010-11-25] (Sonic Solutions)
S2 RoxWatch12; C:\Program Files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [219632 2010-11-25] (Sonic Solutions)
R2 SecomUpdateService; C:\Program Files\Common Files\Sennheiser\SecomUpdateService.exe [274432 2010-02-16] ()
R3 TMBMServer; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [345648 2012-10-30] (Trend Micro Inc.)
R2 tmlisten; C:\Program Files\Trend Micro\Security Agent\tmlisten.exe [2288976 2013-01-02] (Trend Micro Inc.)
R3 TmProxy; C:\Program Files\Trend Micro\Security Agent\TmProxy.exe [689712 2012-08-08] (Trend Micro Inc.)
S2 USBDLM; \\zim-Daten\part-1\EDV\Tools\usbdlm\USBDLM.EXE [x]

==================== Drivers (Whitelisted) ====================

R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [41088 2010-10-20] (Intel Corporation)
S3 netvsc; C:\Windows\System32\DRIVERS\netvsc60.sys [126464 2010-11-20] (Microsoft Corporation)
S3 SynthVid; C:\Windows\System32\DRIVERS\VMBusVideoM.sys [19456 2010-11-20] (Microsoft Corporation)
R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [74600 2012-10-30] (Trend Micro Inc.)
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [258976 2012-11-13] (Trend Micro Inc.)
R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [62728 2012-10-30] (Trend Micro Inc.)
R2 TmFilter; C:\Program Files\Trend Micro\Security Agent\TmXPFlt.sys [264504 2012-12-04] (Trend Micro Inc.)
R2 TmPreFilter; C:\Program Files\Trend Micro\Security Agent\TmPreFlt.sys [36664 2012-12-04] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [90448 2011-08-31] (Trend Micro Inc.)
R3 vpcbus; C:\Windows\System32\DRIVERS\vpchbus.sys [165376 2009-09-23] (Microsoft Corporation)
R1 vpcnfltr; C:\Windows\System32\DRIVERS\vpcnfltr.sys [55040 2009-09-23] (Microsoft Corporation)
R3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [78336 2009-09-23] (Microsoft Corporation)
R1 vpcvmm; C:\Windows\System32\drivers\vpcvmm.sys [294912 2009-09-23] (Microsoft Corporation)
R2 VSApiNt; C:\Program Files\Trend Micro\Security Agent\VSApiNt.sys [1515232 2012-12-04] (Trend Micro Inc.)
U5 mbamchameleon; C:\Windows\System32\Drivers\mbamchameleon.sys [77528 2013-09-05] (MalwareBytes)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-05 09:41 - 2013-09-05 09:41 - 00000000 ____D C:\FRST
2013-09-05 09:16 - 2013-09-05 09:16 - 00000000 _____ C:\Users\chriba\defogger_reenable
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ___RD C:\Users\chriba\Virtual Machines
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Roaming\Tobit
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Roaming\Thunderbird
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Roaming\Mozilla
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Local\Thunderbird
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Local\Panasonic
2013-09-05 08:47 - 2013-09-05 08:47 - 00224256 _____ (Enemyseed Inc.) C:\Users\chriba.ZIM\AppData\Roaming\defyhlp.exe
2013-09-05 08:44 - 2013-09-05 09:12 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-05 08:43 - 2013-09-05 08:57 - 00077528 _____ (MalwareBytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-04 18:11 - 2013-09-05 09:12 - 00000000 ____D C:\Users\chriba.ZIM\Downloads\mbar
2013-09-04 18:11 - 2012-08-23 16:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-09-04 18:11 - 2012-08-23 16:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-09-04 18:11 - 2012-08-23 16:41 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-09-04 18:11 - 2012-08-23 16:40 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-09-04 18:11 - 2012-08-23 16:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-04 18:11 - 2012-08-23 16:10 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-04 18:11 - 2012-08-23 15:52 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-09-04 18:11 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-09-04 18:11 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-09-04 18:11 - 2012-08-23 15:32 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-09-04 18:11 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-09-04 18:11 - 2012-08-23 13:40 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-09-04 18:11 - 2012-08-23 13:32 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-09-04 18:11 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-09-04 18:11 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-09-04 18:11 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-09-04 18:11 - 2012-08-23 12:08 - 02739712 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-09-04 18:11 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-09-04 17:49 - 2012-08-24 19:05 - 00136560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-09-04 17:49 - 2012-08-24 19:02 - 00369856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-09-04 17:49 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-09-04 17:49 - 2012-08-24 18:56 - 01039360 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-09-04 17:49 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-09-04 17:40 - 2013-09-05 09:37 - 00002611 _____ C:\Windows\setupact.log
2013-09-04 17:40 - 2013-09-04 18:23 - 00005868 _____ C:\Windows\PFRO.log
2013-09-04 17:40 - 2013-09-04 17:40 - 00000000 _____ C:\Windows\setuperr.log
2013-09-04 17:35 - 2013-09-04 17:35 - 04454952 _____ (Piriform Ltd) C:\Users\chriba.ZIM\Downloads\ccsetup405.exe
2013-09-04 17:35 - 2013-09-04 17:35 - 00000000 ____D C:\Program Files\CCleaner
2013-09-04 16:09 - 2013-09-04 16:09 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-09-04 16:09 - 2013-09-04 16:09 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-09-04 16:09 - 2013-09-04 16:09 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-09-04 16:09 - 2013-09-04 16:09 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-09-04 16:09 - 2013-09-04 16:09 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-09-04 16:09 - 2013-09-04 16:09 - 00000000 ____D C:\Program Files\Java
2013-09-04 16:07 - 2013-09-05 08:51 - 00134448 _____ C:\Windows\system32\TmInstall.log
2013-09-04 16:07 - 2013-09-05 08:06 - 00014234 _____ C:\Windows\cfgall.ini
2013-09-04 16:07 - 2013-09-04 16:07 - 00000000 ____D C:\Windows\system32\log
2013-09-04 16:07 - 2013-09-04 16:07 - 00000000 _____ C:\Windows\system32\diagnostic.log
2013-09-04 16:06 - 2013-09-04 17:42 - 00000032 _____ C:\Windows\system32\cache.dat
2013-09-04 16:06 - 2013-09-04 17:42 - 00000000 ____D C:\ProgramData\Trend Micro
2013-09-04 16:05 - 2013-09-04 17:43 - 00000000 ____D C:\Program Files\Trend Micro
2013-09-04 14:25 - 2013-09-04 14:25 - 00000000 ____D C:\Program Files\7-Zip
2013-08-19 08:44 - 2013-08-19 08:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-14 17:03 - 2013-08-14 17:04 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 17:01 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 17:01 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 17:01 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 17:01 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 17:01 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 17:01 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 17:01 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 17:01 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 17:01 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 07:28 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 07:28 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 07:28 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 07:28 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 07:28 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 07:28 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 07:28 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 07:28 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 07:28 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 07:28 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 07:27 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 07:27 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-05 09:41 - 2013-09-05 09:41 - 00000000 ____D C:\FRST
2013-09-05 09:37 - 2013-09-04 17:40 - 00002611 _____ C:\Windows\setupact.log
2013-09-05 09:35 - 2013-09-05 09:43 - 01080319 _____ (Farbar) C:\Users\chriba\Desktop\FRST (32).exe
2013-09-05 09:16 - 2013-09-05 09:16 - 00000000 _____ C:\Users\chriba\defogger_reenable
2013-09-05 09:16 - 2012-02-14 09:39 - 00000000 ____D C:\Users\chriba
2013-09-05 09:15 - 2010-11-20 23:01 - 01669744 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-05 09:12 - 2013-09-05 08:44 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-05 09:12 - 2013-09-04 18:11 - 00000000 ____D C:\Users\chriba.ZIM\Downloads\mbar
2013-09-05 08:57 - 2013-09-05 08:43 - 00077528 _____ (MalwareBytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-09-05 08:57 - 2009-07-14 06:34 - 00020496 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-05 08:57 - 2009-07-14 06:34 - 00020496 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ___RD C:\Users\chriba\Virtual Machines
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Roaming\Tobit
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Roaming\Thunderbird
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Roaming\Mozilla
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Local\Thunderbird
2013-09-05 08:54 - 2013-09-05 08:54 - 00000000 ____D C:\Users\chriba\AppData\Local\Panasonic
2013-09-05 08:54 - 2012-02-14 09:40 - 00155784 _____ C:\Users\chriba\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-05 08:54 - 2012-01-18 20:23 - 00000000 ____D C:\ProgramData\Sonic
2013-09-05 08:53 - 2012-01-18 20:04 - 01535509 _____ C:\Windows\WindowsUpdate.log
2013-09-05 08:51 - 2013-09-04 16:07 - 00134448 _____ C:\Windows\system32\TmInstall.log
2013-09-05 08:50 - 2012-05-07 14:12 - 00000000 ____D C:\Program Files\Common Files\Akamai
2013-09-05 08:50 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-05 08:47 - 2013-09-05 08:47 - 00224256 _____ (Enemyseed Inc.) C:\Users\chriba.ZIM\AppData\Roaming\defyhlp.exe
2013-09-05 08:47 - 2012-02-14 10:42 - 00000250 ___SH C:\Users\chriba.ZIM\ntuser.ini
2013-09-05 08:06 - 2013-09-04 16:07 - 00014234 _____ C:\Windows\cfgall.ini
2013-09-05 07:51 - 2012-02-14 10:42 - 00000000 ____D C:\Users\chriba.ZIM
2013-09-05 07:46 - 2012-02-14 09:59 - 00000096 _____ C:\Windows\system32\config\netlogon.ftl
2013-09-04 18:39 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-04 18:23 - 2013-09-04 17:40 - 00005868 _____ C:\Windows\PFRO.log
2013-09-04 18:22 - 2010-11-21 02:46 - 00000000 ____D C:\Windows\system32\Drivers\de-DE
2013-09-04 18:22 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-04 18:12 - 2013-09-04 18:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-04 17:43 - 2013-09-04 16:05 - 00000000 ____D C:\Program Files\Trend Micro
2013-09-04 17:42 - 2013-09-04 16:06 - 00000032 _____ C:\Windows\system32\cache.dat
2013-09-04 17:42 - 2013-09-04 16:06 - 00000000 ____D C:\ProgramData\Trend Micro
2013-09-04 17:40 - 2013-09-04 17:40 - 00000000 _____ C:\Windows\setuperr.log
2013-09-04 17:40 - 2012-05-07 14:11 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-09-04 17:36 - 2011-02-12 04:26 - 00000000 ____D C:\Windows\panther
2013-09-04 17:35 - 2013-09-04 17:35 - 04454952 _____ (Piriform Ltd) C:\Users\chriba.ZIM\Downloads\ccsetup405.exe
2013-09-04 17:35 - 2013-09-04 17:35 - 00000000 ____D C:\Program Files\CCleaner
2013-09-04 17:27 - 2012-02-17 10:11 - 00000000 ____D C:\Program Files\Kaspersky Lab
2013-09-04 17:07 - 2012-02-14 10:54 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-09-04 16:09 - 2013-09-04 16:09 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-09-04 16:09 - 2013-09-04 16:09 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-09-04 16:09 - 2013-09-04 16:09 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-09-04 16:09 - 2013-09-04 16:09 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-09-04 16:09 - 2013-09-04 16:09 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-09-04 16:09 - 2013-09-04 16:09 - 00000000 ____D C:\Program Files\Java
2013-09-04 16:09 - 2012-01-18 20:13 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-09-04 16:07 - 2013-09-04 16:07 - 00000000 ____D C:\Windows\system32\log
2013-09-04 16:07 - 2013-09-04 16:07 - 00000000 _____ C:\Windows\system32\diagnostic.log
2013-09-04 14:25 - 2013-09-04 14:25 - 00000000 ____D C:\Program Files\7-Zip
2013-08-28 17:00 - 2012-03-23 16:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-19 08:44 - 2013-08-19 08:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-15 07:53 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-08-15 07:16 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-14 17:04 - 2013-08-14 17:03 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 17:03 - 2012-03-23 14:38 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Files to move or delete:
====================
C:\Users\Administrator\AppData\Local\Temp\TOBITCLT.DLL
C:\Users\Administrator\AppData\Local\Temp\Setup000008d8\ose00000.exe
C:\Users\Administrator\AppData\Local\Temp\Setup000008d8\OSETUP.DLL
C:\Users\Administrator\AppData\Local\Temp\Setup000008d8\OSETUPUI.DLL

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-02 12:45

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 05-09-2013
Ran by chriba at 2013-09-05 09:44:28
Running from C:\Users\chriba\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

7-Zip 9.20
Adobe Flash Player 11 ActiveX (Version: 11.3.300.268)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Akamai NetSession Interface Service
Autodesk Design Review 2012 (Version: 12.0.0.98)
Autodesk Design Review Browser Add-on v1.2  (Version: 1.2.0)
Catalyst Control Center - Branding (Version: 1.00.0000)
Catalyst Control Center (Version: 1.00.0000)
Catalyst Control Center (Version: 2011.0218.1838.33398)
Catalyst Control Center Graphics Previews Common (Version: 2011.0218.1838.33398)
Catalyst Control Center InstallProxy (Version: 2011.0218.1838.33398)
Catalyst Control Center Localization All (Version: 2011.0218.1838.33398)
Catalyst Control Center Profiles Desktop (Version: 2011.0218.1838.33398)
CCC Help Chinese Standard (Version: 2011.0218.1837.33398)
CCC Help Chinese Traditional (Version: 2011.0218.1837.33398)
CCC Help Czech (Version: 2011.0218.1837.33398)
CCC Help Danish (Version: 2011.0218.1837.33398)
CCC Help Dutch (Version: 2011.0218.1837.33398)
CCC Help English (Version: 2011.0218.1837.33398)
CCC Help Finnish (Version: 2011.0218.1837.33398)
CCC Help French (Version: 2011.0218.1837.33398)
CCC Help German (Version: 2011.0218.1837.33398)
CCC Help Greek (Version: 2011.0218.1837.33398)
CCC Help Hungarian (Version: 2011.0218.1837.33398)
CCC Help Italian (Version: 2011.0218.1837.33398)
CCC Help Japanese (Version: 2011.0218.1837.33398)
CCC Help Korean (Version: 2011.0218.1837.33398)
CCC Help Norwegian (Version: 2011.0218.1837.33398)
CCC Help Polish (Version: 2011.0218.1837.33398)
CCC Help Portuguese (Version: 2011.0218.1837.33398)
CCC Help Russian (Version: 2011.0218.1837.33398)
CCC Help Spanish (Version: 2011.0218.1837.33398)
CCC Help Swedish (Version: 2011.0218.1837.33398)
CCC Help Thai (Version: 2011.0218.1837.33398)
CCC Help Turkish (Version: 2011.0218.1837.33398)
ccc-utility (Version: 2011.0218.1838.33398)
CCleaner (Version: 4.05)
Communication Assistant (Version: 3.0.32.0)
Conexant HD Audio (Version: 8.50.4.0)
CyberLink PowerDVD 9.5 (Version: 9.5.1.4418)
D3DX10 (Version: 15.4.2368.0902)
David Client  (Version: 11.00a)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell Backup and Recovery Manager (Version: 1.3.1)
Dell Edoc Viewer (Version: 1.0.0)
DirectX 9 Runtime (Version: 1.00.0000)
DWG TrueView 2012 (Version: 18.2.51.0)
gotomaxx PDFMAILER (Version: 5.1.67)
Greenshot
HeadSetup (Version: 2.7.0)
IGS Viewer 2.3
Intel(R) Identity Protection Technology 1.1.2.0 (Version: 1.1.2.0)
Intel(R) Management Engine Components (Version: 7.0.0.1144)
IrfanView (remove only) (Version: 4.32)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.5.1)
Junk Mail filter update (Version: 15.4.3502.0922)
KX-NCS8100 IP Softphone (Version: 3.0.18.0)
Mesh Runtime (Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (Version: 10.0.30319)
Mozilla Firefox 23.0.1 (x86 de) (Version: 23.0.1)
Mozilla Maintenance Service (Version: 17.0.5)
Mozilla Thunderbird 17.0.5 (x86 de) (Version: 17.0.5)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
PhotoShowExpress (Version: 2.0.063)
Revo Uninstaller 1.94 (Version: 1.94)
Roxio Activation Module (Version: 1.0)
Roxio BackOnTrack (Version: 1.3.3)
Roxio Burn (Version: 1.8)
Roxio Creator Starter (Version: 1.0.439)
Roxio Creator Starter (Version: 12.1.77.0)
Roxio Creator Starter (Version: 5.0.0)
Roxio Express Labeler 3 (Version: 3.2.2)
Roxio File Backup (Version: 1.3.2)
Sonic CinePlayer Decoder Pack (Version: 4.3.0)
Trend Micro Worry-Free Business Security Agent (Version: 18.0.1282)
Trend Micro Worry-Free Business Security Agent (Version: 8.0)
UBitMenuDE (Version: 01.04)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3508.1109)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows XP Mode (Version: 1.3.7600.16422)
Winmail Opener 1.4 (Version: 1.4)
 

==================== Restore Points  =========================

04-09-2013 15:26:14 Revo Uninstaller's restore point - Kaspersky Lab Administrationsagent
04-09-2013 15:27:51 Revo Uninstaller's restore point - Adobe Reader X (10.1.5) - Deutsch
04-09-2013 15:28:53 Revo Uninstaller's restore point - Trend Micro Worry-Free Business Security Agent
04-09-2013 15:29:22 Removed Trend Micro Worry-Free Business Security Agent
04-09-2013 15:41:44 Installed Trend Micro Worry-Free Business Security Agent
04-09-2013 16:05:07 Windows Update
04-09-2013 16:22:02 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0D9B5D92-3A22-486D-A887-3AA21597CF27} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {0EF092E3-AACE-4D62-8637-8657213076C0} - System32\Tasks\{D7C6D066-906B-42EF-8A66-DBF2D57EBE49} => N:\Clients\SETUP.EXE
Task: {6F792385-BF7B-4DD2-A919-8952E956DD23} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {8E600F40-83A6-4A56-A673-F165F8C08539} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {97CCDEB1-494A-406F-B156-11DCFD6B467B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {B995A3A1-01D9-49C0-9138-4BB979645198} - System32\Tasks\JavaUpdateSched => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-05-04] (Sun Microsystems, Inc.)
Task: {FEEDCAFD-8159-4621-9C0F-E9B793AC7EF5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd)

==================== Loaded Modules (whitelisted) =============

2012-05-07 14:58 - 2012-05-07 14:58 - 00043232 _____ (Autodesk, Inc.) C:\Windows\system32\AcSignIcon.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2012-05-07 14:57 - 2012-05-07 14:57 - 00515808 _____ (Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll
2010-11-22 12:47 - 2010-11-22 12:47 - 00013312 _____ (Sonic Solutions) C:\Program Files\Roxio\OEM\Virtual Drive 12\1031\DC_ShellExt.loc
2012-05-07 14:17 - 2012-05-07 14:17 - 00044872 ____R (Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\DWF Common\de-DE\DWFShellExtensionRes.dll
2010-11-22 12:54 - 2010-11-22 12:54 - 00113136 _____ (Sonic Solutions) C:\Program Files\Roxio\OEM\Virtual Drive 12\DC_ShellExt.dll
2010-11-17 11:36 - 2010-11-17 11:36 - 00145904 _____ (TODO: <Company name>) C:\Program Files\Roxio\OEM\Roxio Burn\RB_ContextMenu.dll
2010-05-07 16:52 - 2010-05-07 16:52 - 00184320 _____ (gotomaxx software gmbh) C:\Program Files\gotomaxx\maxxPDFMAILER\PDFMailerShellExt32.dll
2013-01-02 22:10 - 2013-01-02 22:10 - 00314216 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\TmdShell.dll
2012-05-07 14:17 - 2012-05-07 14:17 - 01891248 ____R (Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\DWF Common\DWFShellExtension.dll
2012-05-07 14:17 - 2012-05-07 14:17 - 00731568 _____ (Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\DWF Common\dwfcore_wt.1.6.0.dll
2012-05-07 14:17 - 2012-05-07 14:17 - 01826224 _____ (Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\DWF Common\dwftk_wt.7.6.0.dll
2012-05-07 14:17 - 2012-05-07 14:17 - 00882608 _____ (Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\DWF Common\w3dtk_wt.1.6.1555.dll
2012-05-07 14:17 - 2012-05-07 14:17 - 00759728 _____ (Autodesk, Inc.) C:\Program Files\Common Files\Autodesk Shared\DWF Common\whiptk_wt.7.12.601.dll
2012-05-07 14:57 - 2012-05-07 14:57 - 00131808 _____ (Autodesk) C:\Program Files\Common Files\Autodesk Shared\AcShellEx\AcShellExtension.dll
2010-11-09 12:59 - 2010-11-09 12:59 - 04479472 _____ (Sonic Solutions) C:\Program Files\Roxio\OEM\Roxio Burn\AS_Storage_w32.dll
2012-11-28 08:30 - 2012-10-16 09:39 - 00561664 _____ (Microsoft Corporation) C:\Windows\AppPatch\AcLayers.DLL
2010-11-24 23:34 - 2010-11-24 23:34 - 00632304 _____ (Sonic Solutions) c:\program files\common files\roxio shared\dllshared\homepermitsconfig13.dll
2010-11-22 14:27 - 2010-11-22 14:27 - 00190960 _____ (Roxio, Inc.) c:\program files\common files\roxio shared\dllshared\rsl.dll
2010-11-24 23:44 - 2010-11-24 23:44 - 00375280 _____ () c:\program files\common files\roxio shared\dllshared\SQLite352.dll
2010-11-22 14:27 - 2010-11-22 14:27 - 00186864 _____ (Sonic Solutions) c:\program files\common files\roxio shared\dllshared\rcsl.dll
2010-11-24 23:35 - 2010-11-24 23:35 - 00961008 _____ (Sonic Solutions) c:\program files\common files\roxio shared\dllshared\SonicHTTPClient13.dll
2010-11-24 23:35 - 2010-11-24 23:35 - 00712688 _____ (Sonic Solutions) c:\program files\common files\roxio shared\dllshared\SonicLicenseManager13.dll
2012-01-19 04:48 - 2011-03-08 23:52 - 00073728 _____ (Dell Computer Corporation) C:\dell\DBRM\Reminder\de\DBRM_Toaster.resources.dll
2012-01-19 04:48 - 2011-03-08 23:52 - 00180224 _____ (Dell Computer Corporation) C:\dell\DBRM\Reminder\de-DE\DBRM_Toaster.resources.dll
2013-01-02 22:08 - 2013-01-02 22:08 - 00058776 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\OfcPlugInAPI.dll
2013-01-02 22:06 - 2013-01-02 22:06 - 00099976 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\libCNTProdRes.dll
2013-01-02 22:10 - 2013-01-02 22:10 - 00075256 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\TimeString.dll
2013-01-02 22:08 - 2013-01-02 22:08 - 00198856 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\OfcPIPC.dll
2013-01-02 22:11 - 2013-01-02 22:11 - 00170016 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\TmPac.dll
2013-01-02 22:08 - 2013-01-02 22:08 - 00137056 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\ofc_loadhttp.dll
2013-01-08 11:25 - 2013-01-08 11:25 - 00157656 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\FlowControl.dll
2013-01-02 22:11 - 2013-01-02 22:11 - 00223576 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\utilJsonHandle.dll
2013-01-08 14:04 - 2013-01-08 14:04 - 03840936 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\ntmonres.dll
2013-01-02 22:08 - 2013-01-02 22:08 - 00091736 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\OfcPlugInMain.dll
2013-01-02 22:08 - 2013-01-02 22:08 - 00058776 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\OfcPlugInTray.dll
2013-01-08 14:06 - 2013-01-08 14:06 - 00083496 _____ (Trend Micro Inc.) C:\Program Files\Trend Micro\Security Agent\NTSvcRes.dll
2011-02-18 19:33 - 2011-02-18 19:33 - 00290816 _____ (Advanced Mirco Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.dll
2011-02-18 19:33 - 2011-02-18 19:33 - 00167936 _____ (Advanced Mirco Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Shared.dll
2009-01-20 14:51 - 2009-01-20 14:51 - 00007168 _____ ( ) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atixclib.dll
2011-02-18 19:37 - 2011-02-18 19:37 - 00023552 _____ (Advanced Mirco Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.AMDHome.Graphics.Dashboard.dll
2011-02-18 19:36 - 2011-02-18 19:36 - 00243712 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-08-26 17:12 - 2010-08-26 17:12 - 00016384 ____R () c:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll

==================== Alternate Data Streams (whitelisted) ==========


==================== Faulty Device Manager Devices =============

Name: WPD-Dateisystem-Volumetreiber
Description: WPD-Dateisystem-Volumetreiber
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Microsoft
Service: WUDFRd
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: H:\
Description: MS/MS-Pro       
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Generic-
Service: WUDFRd
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: E:\
Description: SD/MMC          
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Generic-
Service: WUDFRd
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: G:\
Description: SM/xD Picture   
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Generic-
Service: WUDFRd
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

Name: F:\
Description: Compact Flash   
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: Generic-
Service: WUDFRd
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/05/2013 08:52:07 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/05/2013 08:00:34 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: tmlisten.exe, Version: 18.0.0.1282, Zeitstempel: 0x50e43851
Name des fehlerhaften Moduls: TMSOCK.dll, Version: 18.0.0.1282, Zeitstempel: 0x50e43eb5
Ausnahmecode: 0xc000000d
Fehleroffset: 0x00038af2
ID des fehlerhaften Prozesses: 0x808
Startzeit der fehlerhaften Anwendung: 0xtmlisten.exe0
Pfad der fehlerhaften Anwendung: tmlisten.exe1
Pfad des fehlerhaften Moduls: tmlisten.exe2
Berichtskennung: tmlisten.exe3

Error: (09/05/2013 07:51:40 AM) (Source: Microsoft-Windows-Folder Redirection) (User: )
Description: Fehler bei der Richtlinienanwendung und beim Umleiten des Ordners "Documents" nach "\\Zim-daten\User\chriba\Eigene Dateien".
 Umleitungsoptionen=0x9211.
 Der folgende Fehler ist aufgetreten: "Ordner "\\Zim-daten\User\chriba\Eigene Dateien" konnte nicht erstellt werden".
 Fehlerdetails: "Diese Sicherheitskennung kann nicht als Besitzer des Objekts zugeordnet werden.
".

Error: (09/05/2013 07:48:44 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2013 06:25:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2013 06:23:59 PM) (Source: Microsoft-Windows-Folder Redirection) (User: )
Description: Fehler bei der Richtlinienanwendung und beim Umleiten des Ordners "Documents" nach "\\Zim-daten\User\chriba\Eigene Dateien".
 Umleitungsoptionen=0x9211.
 Der folgende Fehler ist aufgetreten: "Ordner "\\Zim-daten\User\chriba\Eigene Dateien" konnte nicht erstellt werden".
 Fehlerdetails: "Diese Sicherheitskennung kann nicht als Besitzer des Objekts zugeordnet werden.
".

Error: (09/04/2013 05:42:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2013 05:41:07 PM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/04/2013 05:41:07 PM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/04/2013 05:41:07 PM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (09/05/2013 08:50:17 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (09/05/2013 08:50:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "USBDLM" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/05/2013 08:50:16 AM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne ZIM aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (09/05/2013 08:00:43 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Trend Micro Security Agent Listener" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (09/05/2013 07:46:52 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "USBDLM" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (09/05/2013 07:46:51 AM) (Source: NETLOGON) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne ZIM aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (09/04/2013 06:38:55 PM) (Source: mbamchameleon) (User: )
Description: C0000022

Error: (09/04/2013 06:34:31 PM) (Source: mbamchameleon) (User: )
Description: C0000022

Error: (09/04/2013 06:34:31 PM) (Source: mbamchameleon) (User: )
Description: C0000022

Error: (09/04/2013 06:34:31 PM) (Source: mbamchameleon) (User: )
Description: C0000022


Microsoft Office Sessions:
=========================
Error: (09/05/2013 08:52:07 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/05/2013 08:00:34 AM) (Source: Application Error)(User: )
Description: tmlisten.exe18.0.0.128250e43851TMSOCK.dll18.0.0.128250e43eb5c000000d00038af280801cea9fb52780e26C:\Program Files\Trend Micro\Security Agent\tmlisten.exeC:\Program Files\Trend Micro\Security Agent\TMSOCK.dll7a32b5a8-15f0-11e3-b913-d067e52679bf

Error: (09/05/2013 07:51:40 AM) (Source: Microsoft-Windows-Folder Redirection)(User: )
Description: Documents\\Zim-daten\User\chriba\Eigene Dateien0x9211Ordner "\\Zim-daten\User\chriba\Eigene Dateien" konnte nicht erstellt werdenDiese Sicherheitskennung kann nicht als Besitzer des Objekts zugeordnet werden.

Error: (09/05/2013 07:48:44 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2013 06:25:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2013 06:23:59 PM) (Source: Microsoft-Windows-Folder Redirection)(User: )
Description: Documents\\Zim-daten\User\chriba\Eigene Dateien0x9211Ordner "\\Zim-daten\User\chriba\Eigene Dateien" konnte nicht erstellt werdenDiese Sicherheitskennung kann nicht als Besitzer des Objekts zugeordnet werden.

Error: (09/04/2013 05:42:33 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/04/2013 05:41:07 PM) (Source: Windows Search Service)(User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/04/2013 05:41:07 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (09/04/2013 05:41:07 PM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 2028.94 MB
Available physical RAM: 1120.25 MB
Total Pagefile: 4057.88 MB
Available Pagefile: 2952.41 MB
Total Virtual: 2047.88 MB
Available Virtual: 1915.14 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:46.83 GB) (Free:13.19 GB) NTFS
Drive e: () (Removable) (Total:1.87 GB) (Free:1.86 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 60 GB) (Disk ID: A80EC765)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=13 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=47 GB) - (Type=07 NTFS)

========================================================
Disk: 5 (Size: 2 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=2 GB) - (Type=06)

==================== End Of Log ============================

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-05 10:12:55
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ADATA_S596_Turbo rev.100730 59,63GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\chriba\AppData\Local\Temp\pwldqpow.sys


---- System - GMER 2.1 ----

SSDT            85EA849C                                                                                                                ZwCreateKey
SSDT            85EAAF8C                                                                                                                ZwCreateMutant
SSDT            85E1091C                                                                                                                ZwCreateProcess
SSDT            85EA200C                                                                                                                ZwCreateProcessEx
SSDT            85EAAF0C                                                                                                                ZwCreateSymbolicLinkObject
SSDT            85E7041C                                                                                                                ZwCreateThread
SSDT            85E703DC                                                                                                                ZwCreateThreadEx
SSDT            85EA1D8C                                                                                                                ZwCreateUserProcess
SSDT            85EAAE8C                                                                                                                ZwDebugActiveProcess
SSDT            85EAA874                                                                                                                ZwDeleteKey
SSDT            85E70564                                                                                                                ZwDeleteValueKey
SSDT            85EAAECC                                                                                                                ZwDuplicateObject
SSDT            85EAAFCC                                                                                                                ZwLoadDriver
SSDT            85EA824C                                                                                                                ZwOpenProcess
SSDT            85E70524                                                                                                                ZwOpenSection
SSDT            85EA84DC                                                                                                                ZwOpenThread
SSDT            85EAA834                                                                                                                ZwRenameKey
SSDT            85EAA7F4                                                                                                                ZwRestoreKey
SSDT            85EAAF4C                                                                                                                ZwSetSystemInformation
SSDT            85EAA8B4                                                                                                                ZwSetValueKey
SSDT            85EA5B0C                                                                                                                ZwTerminateProcess
SSDT            85E3A484                                                                                                                ZwTerminateThread
SSDT            85E7045C                                                                                                                ZwWriteVirtualMemory

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                                82A7DA15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                  82AB7212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11BF                                                                                     82ABE554 4 Bytes  [9C, 84, EA, 85]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11CF                                                                                     82ABE564 4 Bytes  [8C, AF, EA, 85]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11E3                                                                                     82ABE578 8 Bytes  [1C, 09, E1, 85, 0C, 20, EA, ...]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11FF                                                                                     82ABE594 12 Bytes  JMP E7041C85 
.text           ntkrnlpa.exe!KeRemoveQueueEx + 121B                                                                                     82ABE5B0 4 Bytes  [8C, 1D, EA, 85]
.text           ...                                                                                                                     
.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                                                section is writeable [0x8DE06000, 0x3885B9, 0xE8000020]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                 tmtdi.sys
AttachedDevice  \Driver\tdx \Device\Udp                                                                                                 tmtdi.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                fltmgr.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{6EDE823C-41FE-11E1-ADC4-806E6F6E6963}  1500585984

---- EOF - GMER 2.1 ----

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.09.04.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16660
chriba :: WS03_1 [administrator]

04.09.2013 18:13:00
mbar-log-2013-09-04 (18-13-00).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 271401
Time elapsed: 8 minute(s), 12 second(s)

Memory Processes Detected: 1
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> 1712 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|Load (PUM.UserWLoad) -> Data: c:\users\chriba.zim\dxhkctpui.exe -> Delete on reboot.

Registry Data Items Detected: 1
HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|Load (Trojan.Crypt.NKN) -> Bad: (c:\users\chriba.zim\dxhkctpui.exe) Good: () -> Replace on reboot.

Folders Detected: 0
(No malicious items detected)

Files Detected: 5
C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Delete on reboot.
C:\Users\chriba.ZIM\dxhkctpui.exe (Trojan.Crypt.NKN) -> Delete on reboot.
C:\Users\chriba.ZIM\dxdtdaq.exe (Trojan.Crypt.NKN) -> Delete on reboot.
C:\Users\chriba.ZIM\dxnpisa.exe (Trojan.Crypt.NKN) -> Delete on reboot.
C:\Users\chriba.ZIM\dxodman.exe (Trojan.Crypt.NKN) -> Delete on reboot.

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.09.04.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16660
chriba :: WS03_1 [administrator]

04.09.2013 18:25:45
mbar-log-2013-09-04 (18-25-45).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 270992
Time elapsed: 8 minute(s), 49 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.09.05.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16660
chriba :: WS03_1 [administrator]

05.09.2013 08:44:10
mbar-log-2013-09-05 (08-44-10).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 45521
Time elapsed: 3 minute(s), 9 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.09.05.03

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16660
chriba :: WS03_1 [administrator]

05.09.2013 08:58:05
mbar-log-2013-09-05 (08-58-05).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 269669
Time elapsed: 7 minute(s), 5 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Das sind alle Logs die ich erstellt habe.

Danke!

schrauber · 05.09.2013, 09:55

hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

mcosg · 05.09.2013, 10:07

Danke für deine Hilfe!

Mein Kollege formatiert schon die Platte.

Schönen Tag noch!

schrauber · 05.09.2013, 11:03

ok

05.09.2013, 11:03	#4
schrauber /// the machine /// TB-Ausbilder	Virenscanner läßt sich nicht starten, Viren-/Trojanerbefall ok __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Virenscanner läßt sich nicht starten, Viren-/Trojanerbefall

Plagegeister aller Art und deren Bekämpfung: Virenscanner läßt sich nicht starten, Viren-/Trojanerbefall