Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   OTL logfile auswerten verdacht auf virus (https://www.trojaner-board.de/126151-otl-logfile-auswerten-verdacht-virus.html)

roket 26.10.2012 13:05
OTL logfile auswerten verdacht auf virus
 
moin könntet ihr hier mal drüberschauen? bitte dankeschön :)
denn seit kurzem ist meine web verbidnung auf diesen rechner sehr gebremst, egal ob mit kabel oder w-lan andere rechner im web sind mit gewohntem speed unterwegs

OTL Logfile:
Code:
OTL logfile created on: 25.10.2012 20:52:05 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\*****\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,83 Gb Available Physical Memory | 85,53% Memory free
15,96 Gb Paging File | 14,71 Gb Available in Paging File | 92,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,54 Gb Total Space | 417,59 Gb Free Space | 89,70% Space Free | Partition Type: NTFS
Drive D: | 7,59 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 999,53 Mb Total Space | 998,91 Mb Free Space | 99,94% Space Free | Partition Type: FAT
 
Computer Name: *****-PC | User Name: ***** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.25 20:46:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
PRC - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2010.09.02 17:01:36 | 000,125,216 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe
PRC - [2010.09.02 14:26:08 | 000,456,976 | ---- | M] (DeviceVM, Inc.) -- C:\Program Files (x86)\DeviceVM\SmartView Software Updater\WCUService.exe
PRC - [2009.07.14 03:14:47 | 000,254,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.11.26 04:54:12 | 000,203,776 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.10.22 17:53:51 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpda teService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.11 03:04:37 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011.07.04 15:19:30 | 000,395,136 | R--- | M] (cFos Software GmbH) [Auto | Running] -- C:\Programme\ASRock\XFast LAN\spd.exe -- (cFosSpeedS)
SRV - [2010.10.22 02:00:00 | 000,376,832 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010.09.02 17:01:36 | 000,125,216 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe -- (SmartViewService)
SRV - [2010.09.02 14:26:08 | 000,456,976 | ---- | M] (DeviceVM, Inc.) [Auto | Running] -- C:\Program Files (x86)\DeviceVM\SmartView Software Updater\WCUService.exe -- (WCUService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.10.19 21:52:58 | 000,015,936 | ---- | M] (FNet Co., Ltd.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\FNETURPX.SYS -- (FNETURPX)
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.07.29 05:40:57 | 000,079,104 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronXHCI.sys -- (EtronXHCI)
DRV:64bit: - [2011.07.29 05:40:56 | 000,056,960 | ---- | M] (Etron Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\EtronHub3.sys -- (EtronHub3)
DRV:64bit: - [2011.07.04 15:19:34 | 001,632,128 | ---- | M] (cFos Software GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cfosspeed6.sys -- (cFosSpeed)
DRV:64bit: - [2011.05.10 16:28:48 | 000,017,192 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AsrAppCharger.sys -- (AsrAppCharger)
DRV:64bit: - [2011.04.21 20:17:04 | 000,471,144 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.26 06:20:20 | 008,120,320 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.11.26 04:16:46 | 000,289,792 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.11.17 14:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010.10.25 02:00:00 | 000,714,368 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusbn.sys -- (fwlanusbn)
DRV:64bit: - [2010.10.25 02:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.02.03 11:21:56 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2009.11.18 01:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBfilt64.sys -- (MBfilt)
DRV:64bit: - [2009.11.06 08:40:26 | 000,838,136 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmwlhigh664.sys -- (BCMH43XX)
DRV:64bit: - [2009.10.19 14:45:54 | 000,039,480 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3D 49 73 39 61 AF CD 01 [binary data]
IE - HKCU\..\URLSearchHook: {0F3DC9E0-C459-4a40-BCF8-747BD9322E10} - C:\Program Files (x86)\DeviceVM\SmartView\AddressBarSearch.dll (DeviceVM, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=ASRK
IE - HKCU\..\SearchScopes\{713321C8-5AB6-4693-A097-B9F1F8977F77}: "URL" = - Google Search 3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AF FFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF %3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFO RID%3A1&hl=de&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_40 2_287.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_40 2_287.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla FireFox 16.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla FireFox\components [2012.10.20 18:13:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla FireFox 16.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla FireFox\plugins
 
[2012.10.20 18:14:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions
[2012.10.25 20:04:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\FireFox\Pr ofiles\s1t978lx.default\extensions
[2012.10.20 18:13:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla FireFox\extensions
[2012.10.11 03:05:24 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla FireFox\components\browsercomps.dll
[2012.10.11 04:10:32 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla FireFox\searchplugins\amazondotcom-de.xml
[2012.10.11 04:10:32 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla FireFox\searchplugins\bing.xml
[2012.10.11 04:10:32 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla FireFox\searchplugins\eBay-de.xml
[2012.10.11 04:10:32 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla FireFox\searchplugins\leo_ende_de.xml
[2012.10.11 04:10:32 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla FireFox\searchplugins\wikipedia-de.xml
[2012.10.11 04:10:32 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla FireFox\searchplugins\yahoo-de.xml
 
========== Chrome ==========
 
CHR - homepage: Google
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ }{google:acceptedSuggestion}{google riginalQueryF orSuggestion}{google:searchFieldtrialParameter}sou rceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldt rialParameter}client=chrome&hl={language}&q={searc hTerms}
CHR - homepage: Google
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (SmartView VisualBookmark) - {0E5680D1-BF44-4929-94AF-FD30D784AD1D} - C:\Program Files (x86)\DeviceVM\SmartView\SmartView.dll (DeviceVM, Inc.)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [THXCfg64] C:\Windows\SysNative\THXCfg64.DLL (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [XFast LAN] C:\Programme\ASRock\XFast LAN\cfosspeed.exe (cFos Software GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [SmartViewAgent] C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [THX TruStudio NB Settings] C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [XFast USB] C:\Program Files (x86)\XFast USB\XFastUsb.exe (FNet Co., Ltd.)
O4 - HKCU..\Run: [ASRockXTU] File not found
O4 - HKCU..\Run: [zASRockInstantBoot] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{0674A90A-CDFC-4B02-AD0E-9375F32B43E9}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{62D77606-7A3D-4FC2-BBB3-1A520EB48BD0}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{AB6EC3A3-A492-42AB-881B-CF565A443C32}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.12.01 13:15:56 | 000,206,657 | R--- | M] () - D:\Autorun.ico -- [ CDFS ]
O32 - AutoRun File - [2012.05.14 15:03:14 | 000,000,106 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{adea6460-1acf-11e2-bf7e-bc5ff41dc41d}\Shell - "" = AutoRun
O33 - MountPoints2\{adea6460-1acf-11e2-bf7e-bc5ff41dc41d}\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv onServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.25 20:51:29 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2012.10.22 17:54:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.10.22 17:54:17 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Google
[2012.10.22 17:54:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2012.10.21 12:02:17 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.10.20 21:26:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.10.20 18:28:35 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\CrashDumps
[2012.10.20 18:27:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games
[2012.10.20 18:27:24 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Origin
[2012.10.20 18:25:03 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Origin
[2012.10.20 18:25:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2012.10.20 18:25:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2012.10.20 18:25:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2012.10.20 18:23:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin
[2012.10.20 18:17:12 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Macromedia
[2012.10.20 18:16:50 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012.10.20 18:16:49 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.10.20 18:14:11 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Mozilla
[2012.10.20 18:14:11 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Mozilla
[2012.10.20 18:13:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.10.20 18:13:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.10.20 18:13:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla FireFox
[2012.10.20 18:08:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!WLAN
[2012.10.20 18:08:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\avmwlanstick
[2012.10.20 18:07:33 | 000,714,368 | ---- | C] (AVM GmbH) -- C:\Windows\SysNative\drivers\fwlanusbn.sys
[2012.10.20 18:07:33 | 000,099,328 | ---- | C] (AVM Berlin) -- C:\Windows\SysNative\fwusbnci.dll
[2012.10.20 18:07:30 | 000,014,120 | ---- | C] (AVM Berlin) -- C:\Windows\SysNative\drivers\avmeject.sys
[2012.10.20 18:07:30 | 000,000,000 | ---D | C] -- C:\Windows\AVM_Driver
[2012.10.20 18:07:24 | 000,000,000 | ---D | C] -- C:\Users\*****\AVM_Driver
[2012.10.19 22:59:04 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Diagnostics
[2012.10.19 22:43:47 | 000,281,104 | ---- | C] (CACE Technologies, Inc.) -- C:\Windows\SysWow64\wpcap.dll
[2012.10.19 22:43:47 | 000,096,784 | ---- | C] (CACE Technologies, Inc.) -- C:\Windows\SysWow64\Packet.dll
[2012.10.19 22:43:47 | 000,047,632 | ---- | C] (CACE Technologies, Inc.) -- C:\Windows\SysNative\drivers\npf.sys
[2012.10.19 22:43:31 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\InstallShield
[2012.10.19 22:33:45 | 000,025,312 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\drivers\SCMNdisP.sys
[2012.10.19 22:32:09 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Adobe
[2012.10.19 22:26:48 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.10.19 22:17:48 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Mainboard
[2012.10.19 22:17:15 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\ATI
[2012.10.19 22:17:15 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\ATI
[2012.10.19 22:17:15 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.10.19 22:14:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2012.10.19 22:13:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012.10.19 22:12:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2012.10.19 22:12:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2012.10.19 22:12:05 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.10.19 22:11:21 | 000,000,000 | ---D | C] -- C:\AMD
[2012.10.19 22:02:34 | 000,000,000 | ---D | C] -- C:\ProgramData\DeviceVM
[2012.10.19 22:00:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012.10.19 21:59:10 | 000,000,000 | ---D | C] -- C:\ProgramData\NortonInstaller
[2012.10.19 21:59:06 | 000,000,000 | -H-D | C] -- C:\ProgramData\{8533ADFA-85F0-4dc1-946A-2A0BA58E78E3}
[2012.10.19 21:59:02 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\DeviceVm
[2012.10.19 21:58:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DeviceVM
[2012.10.19 21:58:15 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2012.10.19 21:58:14 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Cyberlink
[2012.10.19 21:55:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2012.10.19 21:55:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
[2012.10.19 21:55:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative
[2012.10.19 21:55:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2012.10.19 21:55:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Macromedia
[2012.10.19 21:55:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Adobe
[2012.10.19 21:54:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.10.19 21:54:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2012.10.19 21:54:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2012.10.19 21:53:14 | 001,632,128 | ---- | C] (cFos Software GmbH) -- C:\Windows\SysNative\drivers\cfosspeed6.sys
[2012.10.19 21:53:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XFast LAN
[2012.10.19 21:53:14 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\cFos
[2012.10.19 21:53:14 | 000,000,000 | ---D | C] -- C:\Program Files\ASRock
[2012.10.19 21:53:07 | 000,000,000 | ---D | C] -- C:\ProgramData\cFos
[2012.10.19 21:52:58 | 000,015,936 | ---- | C] (FNet Co., Ltd.) -- C:\Windows\SysNative\drivers\FNETURPX.SYS
[2012.10.19 21:52:58 | 000,000,000 | ---D | C] -- C:\ProgramData\FNET
[2012.10.19 21:52:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XFast USB
[2012.10.19 21:52:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\XFast USB
[2012.10.19 21:52:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ASRock Utility
[2012.10.19 21:52:29 | 000,017,192 | ---- | C] (Windows (R) Win 7 DDK provider) -- C:\Windows\SysNative\drivers\AsrAppCharger.sys
[2012.10.19 21:52:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASRock Utility
[2012.10.19 21:52:29 | 000,000,000 | ---D | C] -- C:\Program Files\ASRock Utility
[2012.10.19 21:52:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Etron Technology
[2012.10.19 21:51:10 | 000,471,144 | ---- | C] (Realtek ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
[2012.10.19 21:50:33 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2012.10.19 21:50:33 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2012.10.19 21:50:08 | 002,601,816 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll
[2012.10.19 21:50:08 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2012.10.19 21:50:08 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2012.10.19 21:50:08 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2012.10.19 21:50:08 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2012.10.19 21:50:07 | 002,197,264 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll
[2012.10.19 21:50:07 | 002,085,440 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2012.10.19 21:50:07 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2012.10.19 21:50:07 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2012.10.19 21:50:07 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2012.10.19 21:50:07 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2012.10.19 21:50:07 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2012.10.19 21:50:07 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2012.10.19 21:50:07 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2012.10.19 21:50:06 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2012.10.19 21:50:06 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012.10.19 21:50:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2012.10.19 21:50:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2012.10.19 21:49:30 | 000,000,000 | ---D | C] -- C:\Program Files\DIFX
[2012.10.19 21:49:26 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2012.10.19 21:49:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD
[2012.10.19 21:49:21 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2012.10.19 21:48:47 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.10.19 21:43:04 | 000,000,000 | R--D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Startup
[2012.10.19 21:43:04 | 000,000,000 | R--D | C] -- C:\Users\*****\Searches
[2012.10.19 21:43:04 | 000,000,000 | R--D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Administrative Tools
[2012.10.19 21:42:49 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Identities
[2012.10.19 21:42:29 | 000,000,000 | R--D | C] -- C:\Users\*****\Contacts
[2012.10.19 21:42:19 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\VirtualStore
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Vorlagen
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\AppData\Local\Verlauf
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\AppData\Local\Temporary Internet Files
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Startmenü
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\SendTo
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Recent
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Netzwerkumgebung
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Lokale Einstellungen
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Druckumgebung
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Cookies
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\AppData\Local\Anwendungsdaten
[2012.10.19 21:41:45 | 000,000,000 | -HSD | C] -- C:\Users\*****\Anwendungsdaten
[2012.10.19 21:41:44 | 000,000,000 | --SD | C] -- C:\Users\*****\AppData\Roaming\Microsoft
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Videos
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Saved Games
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Pictures
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Music
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Maintenance
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Links
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Favorites
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Downloads
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Documents
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\Desktop
[2012.10.19 21:41:44 | 000,000,000 | R--D | C] -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Accessories
[2012.10.19 21:41:44 | 000,000,000 | -HSD | C] -- C:\Users\*****\Documents\Eigene Videos
[2012.10.19 21:41:44 | 000,000,000 | -HSD | C] -- C:\Users\*****\Documents\Eigene Musik
[2012.10.19 21:41:44 | 000,000,000 | -HSD | C] -- C:\Users\*****\Eigene Dateien
[2012.10.19 21:41:44 | 000,000,000 | -HSD | C] -- C:\Users\*****\Documents\Eigene Bilder
[2012.10.19 21:41:44 | 000,000,000 | -H-D | C] -- C:\Users\*****\AppData
[2012.10.19 21:41:44 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Temp
[2012.10.19 21:41:44 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Microsoft
[2012.10.19 21:41:44 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Media Center Programs
[2012.10.19 21:41:24 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\Programme
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.10.19 21:41:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.10.19 21:32:20 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.10.19 21:28:36 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.10.19 21:27:35 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.25 20:52:02 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.10.25 20:52:02 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.10.25 20:52:02 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.10.25 20:52:02 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.10.25 20:52:02 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.10.25 20:50:58 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09 _00.Wdf
[2012.10.25 20:46:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\*****\Desktop\OTL.exe
[2012.10.25 20:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.25 20:04:02 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.25 20:01:42 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.25 20:01:35 | 000,001,412 | ---- | M] () -- C:\Users\*****\Desktop\Games.lnk
[2012.10.25 20:00:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.25 19:59:59 | 2131,468,287 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.25 18:51:30 | 000,009,584 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.25 18:51:30 | 000,009,584 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.25 13:29:32 | 000,002,374 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.10.21 12:02:11 | 503,300,731 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.10.20 20:59:43 | 000,266,992 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.10.20 19:58:08 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.10.20 19:58:08 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2012.10.20 18:25:03 | 000,000,979 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[2012.10.20 18:13:59 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla FireFox.lnk
[2012.10.19 22:37:04 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_bcmwlhigh 664_01009.Wdf
[2012.10.19 22:16:00 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2012.10.19 21:55:33 | 000,000,159 | RH-- | M] () -- C:\Windows\ctfile.rfc
[2012.10.19 21:53:14 | 000,000,003 | ---- | M] () -- C:\Users\*****\AppData\Local\user_data.ini
[2012.10.19 21:52:58 | 000,015,936 | ---- | M] (FNet Co., Ltd.) -- C:\Windows\SysNative\drivers\FNETURPX.SYS
[2012.10.19 21:36:04 | 000,056,735 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.10.19 21:36:04 | 000,056,735 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2 C:\Program Files (x86)\*.tmp files -> C:\Program Files (x86)\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.10.25 20:50:58 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09 _00.Wdf
[2012.10.22 17:54:37 | 000,002,374 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.10.22 17:54:22 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.22 17:54:21 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.21 12:02:11 | 503,300,731 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.10.20 21:03:48 | 000,001,439 | ---- | C] () -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Internet Explorer.lnk
[2012.10.20 19:58:08 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.10.20 19:58:08 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.10.20 18:25:03 | 000,000,979 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2012.10.20 18:16:55 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.20 18:13:59 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla FireFox.lnk
[2012.10.20 18:13:59 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla FireFox.lnk
[2012.10.20 18:07:34 | 000,013,202 | ---- | C] () -- C:\Windows\instwcli.inf
[2012.10.20 18:07:33 | 000,015,565 | ---- | C] () -- C:\Windows\SysNative\drivers\fwlanusbn.bin
[2012.10.20 18:04:56 | 000,001,412 | ---- | C] () -- C:\Users\*****\Desktop\Games.lnk
[2012.10.19 22:43:47 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2012.10.19 22:37:04 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_bcmwlhigh 664_01009.Wdf
[2012.10.19 22:16:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.10.19 21:59:02 | 000,001,412 | ---- | C] () -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Social Games.lnk
[2012.10.19 21:55:34 | 000,007,195 | ---- | C] () -- C:\Windows\SysNative\THXCfgUninstall64.ini
[2012.10.19 21:55:34 | 000,006,925 | ---- | C] () -- C:\Windows\SysNative\THXCfg64.ini
[2012.10.19 21:55:34 | 000,001,424 | ---- | C] () -- C:\Windows\THXCfg_SP_APOIM.ini
[2012.10.19 21:55:34 | 000,001,323 | ---- | C] () -- C:\Windows\THXCfg_HP_APOIM.ini
[2012.10.19 21:55:34 | 000,001,323 | ---- | C] () -- C:\Windows\THXCfg_APOIM.ini
[2012.10.19 21:55:33 | 000,246,784 | ---- | C] () -- C:\Windows\SysNative\APOMgr64.DLL
[2012.10.19 21:55:33 | 000,190,464 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2012.10.19 21:55:33 | 000,089,088 | ---- | C] () -- C:\Windows\SysNative\CmdRtr64.DLL
[2012.10.19 21:55:33 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2012.10.19 21:55:33 | 000,000,159 | RH-- | C] () -- C:\Windows\ctfile.rfc
[2012.10.19 21:55:17 | 000,001,009 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat.com.lnk
[2012.10.19 21:54:22 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012.10.19 21:53:14 | 000,000,003 | ---- | C] () -- C:\Users\*****\AppData\Local\user_data.ini
[2012.10.19 21:51:10 | 000,074,272 | ---- | C] () -- C:\Windows\SysNative\RtNicProp64.dll
[2012.10.19 21:50:08 | 002,261,764 | ---- | C] () -- C:\Windows\SysNative\drivers\rtvienna.dat
[2012.10.19 21:43:16 | 000,001,405 | ---- | C] () -- C:\Users\*****\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.10.19 21:35:48 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.10.19 21:35:44 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.10.19 21:27:39 | 2131,468,287 | -HS- | C] () -- C:\hiberfil.sys
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\cls id\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\cls id\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc8 7-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\cl sid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA 9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\cl sid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CD B-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\cl sid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.10.19 21:59:02 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\DeviceVm
[2012.10.20 18:28:06 | 000,000,000 | ---D | M] -- C:\Users\*****\AppData\Roaming\Origin
 
========== Purity Check ==========
 
 
 
< End of report >
--- --- ---

cosinus 26.10.2012 14:46
Schon irgendwelche Scans gemacht? Wenn ja => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

roket 26.10.2012 15:48
avast! hatte bislang nix gefunden

cosinus 26.10.2012 19:58
1. aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.


2. TDSS-Killer

Download TDSS-Killer auf Desktop siehe => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:06 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131