Mein Laptop zeigt nach dem hochfahren ganz kurz den Desktop an,und danach nur noch ein weises Bild.Die Maus kann ich sehen und auch bewegen. Strg+Alt+Entf funktioniert, aber der Taskmanager nicht, dann kommt wieder nur das weise Bild.Im abgesichertem Modus fährt er hoch,aber dann automatisch wieder runter. Habe schon wie hier beschrieben mit FRST einen scan gemacht. Ich hoffe ich mache das mit dem posten jetzt richtig hier,und hoffe auch das mir einer von euch helfen kann.. Danke schon mal im vorraus.
Code:
Alles auswählen Aufklappen ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by brAAA (administrator) on BRAAA-BOX on 16-10-2013 21:13:35
Running from G:\
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Safe Mode (minimal)
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\system32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe [474168 2008-11-05] (Conexant Systems, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1430824 2009-02-06] (Synaptics Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [281768 2011-01-10] (Avira GmbH)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$2869c73602d1af074c9f11e787e6dc97\n. ATTENTION! ====> ZeroAccess?
HKLM\...\Policies\Explorer\Run: [csrcs] - C:\Windows\system32\csrcs.exe [1196112 2010-11-20] ( ())
HKCU\...\Run: [Messenger (Yahoo!)] - C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe [5252408 2010-06-01] (Yahoo! Inc.)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files\DAEMON Tools Lite\DTLite.exe [4910912 2011-08-02] (DT Soft Ltd)
HKCU\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKCU\...\Run: [Ugziipom] - C:\Users\brAAA\AppData\Roaming\Numy\neyg.exe [262144 2012-07-20] ()
HKCU\...\Run: [Windows Update Server] - C:\Users\brAAA\1os0ieiryvktk-10083.exe [50176 2013-05-06] ()
HKCU\...\Winlogon: [Shell] explorer.exe,C:\Users\brAAA\AppData\Roaming\skype.dat [77312 2010-11-20] () <==== ATTENTION
HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-1277417896-4029102762-3608986815-1001\$2869c73602d1af074c9f11e787e6dc97\n. ATTENTION! ====> ZeroAccess/Alureon?
HKU\123\...\Winlogon: [Shell] C:\Users\123\AppData\Roaming\gema\gema.exe,Explorer.exe, <==== ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about :blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF3AA2F4C2304CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
URLSearchHook: YTNavAssist.YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)
SearchScopes: HKCU - {30F240BE-B4BA-45E3-9621-6192C2D09C88} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=A0088610-2DEF-4ACB-8F0F-85DC6429DA9D&apn_sauid=2B91FA50-487F-48D2-B91F-38923A9D9154
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}
BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
BHO: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
Toolbar: HKLM - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
Toolbar: HKLM - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU -Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GRA32A~1.DLL (Microsoft Corporation)
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office12\GR469A~1.DLL [2210608 2006-10-27] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\brAAA\AppData\Roaming\Mozilla\Firefox\Profiles\b5wxekq9.default
FF user.js: detected! => C:\Users\brAAA\AppData\Roaming\Mozilla\Firefox\Profiles\b5wxekq9.default\user.js
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\brAAA\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
FF SearchPlugin: C:\Users\brAAA\AppData\Roaming\Mozilla\Firefox\Profiles\b5wxekq9.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Ask Toolbar - C:\Users\brAAA\AppData\Roaming\Mozilla\Firefox\Profiles\b5wxekq9.default\Extensions\toolbar@ask.com
FF Extension: No Name - C:\Users\brAAA\AppData\Roaming\Mozilla\Firefox\Profiles\b5wxekq9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Iminent WebBooster - C:\Program Files\Mozilla Firefox\extensions\webbooster@iminent.com
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF HKLM\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\brAAA\AppData\Roaming\10016
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\brAAA\AppData\Roaming\10016
========================== Services (Whitelisted) =================
S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [136360 2011-04-30] (Avira GmbH)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [269480 2011-07-03] (Avira GmbH)
S4 ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [246584 2010-06-21] ()
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
==================== Drivers (Whitelisted) ====================
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-07-03] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-07-03] (Avira GmbH)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2013-02-15] (DT Soft Ltd)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [443448 2011-08-26] (Duplex Secure Ltd.)
S3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [114176 2011-02-23] ()
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
S3 stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [21072 2009-07-14] ()
R3 swenum; C:\Windows\system32\drivers\swenum.sys [12240 2009-07-14] ()
R3 SynTP; C:\Windows\System32\DRIVERS\SynTP.sys [205232 2009-02-06] ()
R0 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1290112 2010-11-20] ()
S3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1290112 2010-11-20] ()
S2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [35328 2010-11-20] ()
S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [18432 2010-11-20] ()
S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [24576 2010-11-20] ()
S1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [74752 2010-11-20] ()
R1 TermDD; C:\Windows\system32\drivers\termdd.sys [53120 2010-11-20] ()
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [31232 2010-11-20] ()
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [52224 2010-11-20] ()
S3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [108544 2010-11-20] ()
S3 uagp35; C:\Windows\system32\DRIVERS\uagp35.sys [55888 2009-07-14] ()
S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [246784 2010-11-20] ()
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [57424 2009-07-14] ()
R3 umbus; C:\Windows\system32\drivers\umbus.sys [39936 2010-11-20] ()
S3 UmPass; C:\Windows\system32\DRIVERS\umpass.sys [8192 2009-07-14] ()
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [75776 2010-11-20] ()
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [86016 2009-07-14] ()
R3 usbehci; C:\Windows\system32\drivers\usbehci.sys [42496 2010-11-20] ()
R3 usbhub; C:\Windows\system32\drivers\usbhub.sys [258560 2010-11-20] ()
S3 usbohci; C:\Windows\system32\DRIVERS\usbohci.sys [20480 2009-07-14] ()
S3 usbprint; C:\Windows\system32\DRIVERS\usbprint.sys [19968 2009-07-14] ()
R3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [76288 2010-11-20] ()
R3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [24064 2009-07-14] ()
S3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [146432 2010-11-20] ()
R0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [32832 2009-07-14] ()
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [26112 2009-07-14] ()
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [25088 2009-07-14] ()
S3 vhdmp; C:\Windows\system32\drivers\vhdmp.sys [160128 2010-11-20] ()
S3 viaagp; C:\Windows\system32\drivers\viaagp.sys [53328 2009-07-14] ()
S3 ViaC7; C:\Windows\system32\DRIVERS\viac7.sys [52736 2009-07-14] ()
S3 viaide; C:\Windows\system32\drivers\viaide.sys [16976 2009-07-14] ()
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [53120 2010-11-20] ()
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [297040 2009-07-14] ()
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [245632 2010-11-20] ()
S3 vsmraid; C:\Windows\system32\DRIVERS\vsmraid.sys [141904 2009-07-14] ()
S3 vwifibus; C:\Windows\System32\DRIVERS\vwifibus.sys [19968 2009-07-14] ()
S1 vwififlt; C:\Windows\System32\DRIVERS\vwififlt.sys [48128 2009-07-14] ()
S3 WacomPen; C:\Windows\system32\DRIVERS\wacompen.sys [21632 2009-07-14] ()
S3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [63488 2010-11-20] ()
S1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [63488 2010-11-20] ()
S3 Wd; C:\Windows\system32\DRIVERS\wd.sys [19024 2009-07-14] ()
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [445008 2009-07-14] ()
S1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [9728 2009-07-14] ()
S3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [19008 2009-07-14] ()
S3 WinUsb; C:\Windows\System32\DRIVERS\WinUsb.sys [35968 2010-11-20] ()
R3 WmiAcpi; C:\Windows\system32\drivers\wmiacpi.sys [11264 2009-07-14] ()
S4 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [16384 2009-07-14] ()
R3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [92672 2010-11-20] ()
S3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [132224 2010-11-20] ()
S2 10083; \??\C:\Users\brAAA\AppData\Local\Temp\10083.sys [x]
U5 fe8c5976a499541; C:\Windows\System32\Drivers\fe8c5976a499541.sys [59392 2013-02-15] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-16 21:13 - 2013-10-16 21:13 - 00000000 ____D C:\FRST
2013-10-16 21:05 - 2013-10-16 21:05 - 00000000 ____D C:\Users\brAAA\AppData\Local\{5D575B21-3A82-4361-86DA-5644FE057140}
2013-10-16 20:41 - 2013-10-16 20:41 - 00000000 ____D C:\Users\brAAA\AppData\Local\{15320DF8-EEAF-45D3-BE4F-BE7C8246230D}
2013-10-16 18:22 - 2013-10-16 18:22 - 00000000 ____D C:\Users\brAAA\AppData\Local\{67F6673C-4FB6-4468-AC43-31B334F273D4}
2013-10-16 18:11 - 2013-10-16 18:11 - 00000000 ____D C:\Users\brAAA\AppData\Local\{36A47035-189B-4A67-BA17-2B3F83E10E10}
2013-10-16 18:08 - 2013-10-16 18:08 - 00000000 ____D C:\Users\brAAA\AppData\Local\{390A8BA8-F351-4B99-B336-B1EFB029E53C}
2013-10-16 18:00 - 2013-10-16 18:00 - 00000000 ____D C:\Users\brAAA\AppData\Local\{DF09CD93-D2E0-4B0A-8554-B839C75D131A}
2013-10-16 17:34 - 2013-10-16 17:34 - 00000000 ____D C:\Users\brAAA\AppData\Local\{D62A2297-38BC-4095-8B43-D96C8FB5AA85}
2013-10-16 17:27 - 2013-10-16 17:27 - 00000000 ____D C:\Users\brAAA\AppData\Local\{76C9F636-FBA9-42B6-A8F6-6B64EC07669A}
2013-09-20 19:14 - 2013-09-20 19:14 - 00000000 ____D C:\Users\brAAA\AppData\Local\{57D3F040-E45D-4663-A581-51AA031EEBEA}
==================== One Month Modified Files and Folders =======
2013-10-16 21:13 - 2013-10-16 21:13 - 00000000 ____D C:\FRST
2013-10-16 21:12 - 2011-04-26 17:05 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-16 21:08 - 2011-04-26 17:02 - 00000000 ____D C:\Users\brAAA
2013-10-16 21:07 - 2013-05-06 06:08 - 00000004 _____ C:\Users\brAAA\AppData\Roaming\skype.ini
2013-10-16 21:07 - 2009-07-14 06:39 - 00289652 _____ C:\Windows\setupact.log
2013-10-16 21:05 - 2013-10-16 21:05 - 00000000 ____D C:\Users\brAAA\AppData\Local\{5D575B21-3A82-4361-86DA-5644FE057140}
2013-10-16 21:05 - 2011-04-26 18:26 - 00000000 ____D C:\Users\brAAA\Tracing
2013-10-16 21:05 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-16 20:49 - 2009-07-14 06:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-16 20:49 - 2009-07-14 06:34 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-16 20:41 - 2013-10-16 20:41 - 00000000 ____D C:\Users\brAAA\AppData\Local\{15320DF8-EEAF-45D3-BE4F-BE7C8246230D}
2013-10-16 19:19 - 2012-03-26 16:04 - 00000000 ____D C:\Users\123
2013-10-16 19:19 - 2011-11-30 22:46 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-10-16 19:19 - 2011-08-26 00:25 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2013-10-16 19:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\registration
2013-10-16 18:22 - 2013-10-16 18:22 - 00000000 ____D C:\Users\brAAA\AppData\Local\{67F6673C-4FB6-4468-AC43-31B334F273D4}
2013-10-16 18:11 - 2013-10-16 18:11 - 00000000 ____D C:\Users\brAAA\AppData\Local\{36A47035-189B-4A67-BA17-2B3F83E10E10}
2013-10-16 18:08 - 2013-10-16 18:08 - 00000000 ____D C:\Users\brAAA\AppData\Local\{390A8BA8-F351-4B99-B336-B1EFB029E53C}
2013-10-16 18:00 - 2013-10-16 18:00 - 00000000 ____D C:\Users\brAAA\AppData\Local\{DF09CD93-D2E0-4B0A-8554-B839C75D131A}
2013-10-16 17:34 - 2013-10-16 17:34 - 00000000 ____D C:\Users\brAAA\AppData\Local\{D62A2297-38BC-4095-8B43-D96C8FB5AA85}
2013-10-16 17:27 - 2013-10-16 17:27 - 00000000 ____D C:\Users\brAAA\AppData\Local\{76C9F636-FBA9-42B6-A8F6-6B64EC07669A}
2013-09-20 19:14 - 2013-09-20 19:14 - 00000000 ____D C:\Users\brAAA\AppData\Local\{57D3F040-E45D-4663-A581-51AA031EEBEA}
2013-09-20 19:13 - 2011-04-26 17:31 - 00026584 _____ C:\Windows\PFRO.log
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1277417896-4029102762-3608986815-1001\$2869c73602d1af074c9f11e787e6dc97
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$2869c73602d1af074c9f11e787e6dc97
Files to move or delete:
====================
C:\Users\brAAA\AppData\Roaming\skype.dat
C:\Users\brAAA\AppData\Roaming\skype.ini
C:\ProgramData\go_0molg.pad
C:\Users\brAAA\1os0ieiryvktk-10083.exe
C:\Users\brAAA\SoftonicDownloader_fuer_microsoft-word-viewer.exe
Some content of TEMP:
====================
C:\Users\brAAA\AppData\Local\Temp\APNStub.exe
C:\Users\brAAA\AppData\Local\Temp\contentDATs.exe
C:\Users\brAAA\AppData\Local\Temp\hfgTy68aaa.tmp.exe
C:\Users\brAAA\AppData\Local\Temp\hfgTy68ccc.tmp.exe
C:\Users\brAAA\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\brAAA\AppData\Local\Temp\ockwlcu.exe
C:\Users\brAAA\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\brAAA\AppData\Local\Temp\setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2012-08-14 23:13] - [2010-11-20 04:30] - 0245632 ____A () D41D8CD98F00B204E9800998ECF8427E
C:\Windows\System32\Drivers\volsnap.sys IS INFECTED. <===== ATTENTION!
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
LastRegBack: 2012-10-27 22:12
==================== End Of Log ============================