Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   BKA Trojaner: FRST, was nun? (https://www.trojaner-board.de/145076-bka-trojaner-frst.html)

schak 23.11.2013 21:27
BKA Trojaner: FRST, was nun?
 
Guten Abend!

Auf meinem Laptop hat sich ein BKA-Trojaner eingeschlichen... Betriebssystem ist Windows 7. Ein Boot im abgesicherten Modus war nicht möglich. FRST habe ich durchgeführt und Ergebnis hochgeladen:

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2013 03
Ran by SYSTEM on MININT-QS4BRRI on 22-11-2013 21:03:49
Running from H:\
Windows 7 Professional (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [380776 2009-12-11] (Lenovo.)
HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [36864 2009-10-13] ()
HKLM\...\Run: [cssauth] - C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [5879608 2009-08-26] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2097960 2010-04-22] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo dCute] - C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dcute.exe [686080 2010-02-26] (Lenovo)
HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe [415816 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2093128 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4271688 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.Exe [236544 2008-10-10] (Logitech, Inc.)
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [62312 2010-07-27] (Lenovo Group Limited)
HKLM\...\Run: [Bdagent] - C:\Program Files\BitDefender\Bitdefender\bdagent.exe [1738968 2013-10-23] (Bitdefender)
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [1101672 2010-01-05] (Lenovo Group Limited)
HKLM-x32\...\Run: [Message Center Plus] - C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe [49976 2009-05-27] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2010-07-12] (Nullsoft, Inc.)
HKLM-x32\...\Run: [LWS] - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [165208 2010-05-07] (Logitech Inc.)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [273544 2011-02-25] (RealNetworks, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35736 2011-01-30] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1564872 2012-06-06] (Ask)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2349392 2013-10-31] (LogMeIn Inc.)
HKU\Default\...\RunOnce: [wlstart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-08-19] (Microsoft Corporation)
HKU\Default\...\RunOnce: [] - [x]
HKU\Default\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
HKU\Default User\...\RunOnce: [wlstart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-08-19] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [] - [x]
HKU\Default User\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
Lsa: [Notification Packages] scecli ACGina

==================== Services (Whitelisted) =================

S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe [77120 2013-10-14] (Bitdefender)
S2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377104 2013-10-11] (LogMeIn, Inc.)
S2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-06-02] (Symantec Corporation)
S2 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
S2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [126392 2011-11-07] (Symantec Corporation)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-10-01] ()
S2 QDLService2kLenovo; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe [331512 2010-02-05] (QUALCOMM, Inc.)
S2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [94624 2013-07-08] (Bitdefender)
S2 ScrProj; C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dqscrproj.exe [88576 2010-02-26] ()
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22888 2013-09-17] ()
S2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1019904 2009-08-28] (Lenovo Group Limited)
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-07-06] (Lenovo Group Limited)
S2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [67320 2013-10-07] (Bitdefender)
S2 VSSERV; C:\Program Files\Bitdefender\Bitdefender\vsserv.exe [1506736 2013-10-23] (Bitdefender)
S2 Winmgmt; C:\ProgramData\rzj29j6jw.pss [60516 2013-11-23] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ALvldr; C:\Windows\System32\DRIVERS\ALvldr.sys [28736 2010-02-26] (Lenovo Soft Corporation(32))
S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
S3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
S1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
S1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
S1 Bdvedisk; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
S1 dqBridge; C:\Windows\System32\DRIVERS\dqbridge.sys [57408 2010-02-26] ()
S3 dqusb; C:\Windows\System32\DRIVERS\dqusb.sys [29688 2009-08-06] (Lenovo)
S0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
S3 lvlddrv; C:\Windows\System32\DRIVERS\lvlddrv.sys [94784 2010-02-26] (Lenovo Soft Corporation(32))
S3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 qcfilterlno2k; C:\Windows\System32\DRIVERS\qcfilterlno2k.sys [6400 2010-02-05] (QUALCOMM Incorporated)
S3 qcusbnetlno2k; C:\Windows\System32\DRIVERS\qcusbnetlno2k.sys [241664 2010-02-05] (QUALCOMM Incorporated)
S3 qcusbserlno2k; C:\Windows\System32\DRIVERS\qcusbserlno2k.sys [121600 2010-02-05] (QUALCOMM Incorporated)
S3 s1029bus; C:\Windows\System32\DRIVERS\s1029bus.sys [116264 2009-05-25] (MCCI Corporation)
S3 s1029mdfl; C:\Windows\System32\DRIVERS\s1029mdfl.sys [19496 2009-05-25] (MCCI Corporation)
S3 s1029mdm; C:\Windows\System32\DRIVERS\s1029mdm.sys [158760 2009-05-25] (MCCI Corporation)
S3 s1029mgmt; C:\Windows\System32\DRIVERS\s1029mgmt.sys [139304 2009-05-25] (MCCI Corporation)
S3 s1029nd5; C:\Windows\System32\DRIVERS\s1029nd5.sys [34856 2009-05-25] (MCCI Corporation)
S3 s1029obex; C:\Windows\System32\DRIVERS\s1029obex.sys [135208 2009-05-25] (MCCI Corporation)
S3 s1029unic; C:\Windows\System32\DRIVERS\s1029unic.sys [151592 2009-05-25] (MCCI Corporation)
S1 TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [13104 2010-01-05] ()
S0 Trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [12728 2009-09-29] ()
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 PCDSRVC{127174DC-C366ED8B-06000000}_0; \??\c:\program files\pc-doctor\pcdsrvc_x64.pkms [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-23 10:57 - 2013-11-23 10:57 - 00003224 ____N C:\bootsqm.dat
2013-11-23 09:15 - 2013-10-12 00:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-11-23 09:15 - 2013-10-12 00:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-11-23 09:15 - 2013-10-12 00:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-11-23 09:15 - 2013-10-12 00:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-11-23 09:15 - 2013-10-12 00:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-11-23 09:15 - 2013-10-11 23:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-23 09:15 - 2013-10-11 23:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-23 09:15 - 2013-10-11 23:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-23 09:15 - 2013-10-11 22:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-11-23 09:15 - 2013-10-11 22:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-23 09:15 - 2013-10-11 21:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-11-23 09:15 - 2013-10-11 21:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-23 09:14 - 2013-10-11 23:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-23 09:08 - 2013-11-23 09:08 - 00000291 _____ C:\ProgramData\rzj29j6jw.reg
2013-11-23 09:07 - 2013-11-23 09:07 - 00208896 _____ (Корпорация Майкрософт) C:\ProgramData\wj6j92jzr.dss
2013-11-23 09:07 - 2013-11-23 09:07 - 00060516 ____T (Microsoft Corporation) C:\ProgramData\rzj29j6jw.pss
2013-11-23 09:07 - 2013-11-22 11:40 - 95025368 ____T C:\ProgramData\rzj29j6jw.bxx
2013-11-23 09:07 - 2013-11-22 11:40 - 00000000 _____ C:\ProgramData\rzj29j6jw.fvv
2013-11-23 09:00 - 2013-10-05 12:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-11-23 09:00 - 2013-10-05 11:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-23 09:00 - 2013-10-03 18:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\System32\SmartcardCredentialProvider.dll
2013-11-23 09:00 - 2013-10-03 18:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\credui.dll
2013-11-23 09:00 - 2013-10-03 18:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-11-23 09:00 - 2013-10-03 17:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-23 09:00 - 2013-10-03 17:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-23 09:00 - 2013-10-03 17:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-23 09:00 - 2013-09-27 17:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2013-11-23 08:59 - 2013-10-11 18:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\System32\nshwfp.dll
2013-11-23 08:59 - 2013-10-11 18:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\IKEEXT.DLL
2013-11-23 08:59 - 2013-10-11 18:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\System32\FWPUCLNT.DLL
2013-11-23 08:59 - 2013-10-11 18:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-23 08:59 - 2013-10-11 18:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-23 08:59 - 2013-10-02 18:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\System32\gdi32.dll
2013-11-23 08:59 - 2013-10-02 18:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-23 08:59 - 2013-09-24 18:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2013-11-23 08:59 - 2013-09-24 18:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2013-11-23 08:59 - 2013-09-24 18:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2013-11-23 08:59 - 2013-09-24 18:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2013-11-23 08:59 - 2013-09-24 18:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2013-11-23 08:59 - 2013-09-24 18:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2013-11-23 08:59 - 2013-09-24 18:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2013-11-23 08:59 - 2013-09-24 18:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2013-11-23 08:59 - 2013-09-24 17:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-23 08:59 - 2013-09-24 17:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-23 08:59 - 2013-09-24 17:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-23 08:59 - 2013-09-24 17:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-23 08:59 - 2013-09-24 17:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2013-11-23 08:59 - 2013-07-04 04:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2013-11-22 21:03 - 2013-11-22 21:03 - 00000000 ____D C:\FRST
2013-11-08 10:02 - 2013-11-23 09:22 - 00003216 _____ C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3112642421-3913958396-2466649522-1007
2013-11-08 09:33 - 2013-11-08 09:33 - 00789754 _____ C:\ProgramData\1383930215.bdinstall.bin
2013-11-08 09:18 - 2013-11-08 09:19 - 00000000 ____D C:\ProgramData\BDLogging
2013-11-08 09:18 - 2013-11-08 09:18 - 00000684 ____H C:\bdr-cf01
2013-11-08 09:18 - 2013-11-08 09:18 - 00000000 ____H C:\Windows\System32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-11-08 09:17 - 2013-07-23 06:50 - 00082824 _____ (BitDefender SRL) C:\Windows\System32\Drivers\bdsandbox.sys
2013-11-08 09:17 - 2013-07-19 08:08 - 00601360 _____ (BitDefender) C:\Windows\System32\Drivers\avckf.sys
2013-11-08 09:17 - 2013-07-19 08:04 - 00727592 _____ (BitDefender) C:\Windows\System32\Drivers\avc3.sys
2013-11-08 09:17 - 2013-02-22 09:46 - 00093600 _____ (BitDefender LLC) C:\Windows\System32\Drivers\BdfNdisf6.sys
2013-11-08 09:17 - 2012-11-02 04:17 - 00261056 _____ (BitDefender) C:\Windows\System32\Drivers\avchv.sys
2013-11-08 09:17 - 2012-04-17 04:34 - 00076944 _____ (BitDefender) C:\Windows\System32\Drivers\bdvedisk.sys
2013-11-08 09:17 - 2007-04-11 01:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2013-11-08 09:09 - 2013-11-08 09:18 - 00253404 ____H C:\bdr-ld01
2013-11-08 09:09 - 2013-11-08 09:18 - 00009216 ____H C:\bdr-ld01.mbr
2013-11-08 09:09 - 2013-09-24 06:38 - 46879860 ____H C:\bdr-im01.gz
2013-11-08 09:09 - 2013-08-13 03:38 - 03271472 ____H C:\bdr-bz01
2013-11-08 09:03 - 2013-08-23 03:48 - 00150256 _____ (BitDefender LLC) C:\Windows\System32\Drivers\gzflt.sys
2013-11-08 09:03 - 2013-08-07 03:46 - 00389240 _____ (BitDefender S.R.L.) C:\Windows\System32\Drivers\trufos.sys
2013-11-08 08:57 - 2013-11-08 09:00 - 00000000 _____ C:\Windows\System32\獷楬汢捯污
2013-11-04 07:53 - 2013-11-04 07:53 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-02 11:07 - 2013-09-04 04:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
2013-11-02 11:07 - 2013-09-04 04:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
2013-11-02 11:07 - 2013-09-04 04:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
2013-11-02 11:07 - 2013-09-04 04:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
2013-11-02 11:07 - 2013-09-04 04:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
2013-11-02 11:07 - 2013-09-04 04:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys
2013-11-02 11:07 - 2013-09-04 04:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys
2013-11-02 11:04 - 2013-11-02 11:04 - 00004865 _____ C:\WirelessDiagLog.csv
2013-11-02 10:12 - 2012-01-13 20:41 - 00068864 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\stream.sys
2013-11-02 10:10 - 2013-11-02 10:10 - 00000030 _____ C:\Windows\success32.log
2013-11-02 10:09 - 2013-11-02 10:09 - 00000030 _____ C:\Windows\success64.log

==================== One Month Modified Files and Folders =======

2013-11-23 11:23 - 2009-07-13 21:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-23 10:57 - 2013-11-23 10:57 - 00003224 ____N C:\bootsqm.dat
2013-11-23 09:29 - 2011-02-25 11:06 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-23 09:23 - 2010-11-10 13:45 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{729EE656-F272-42D3-AAC6-5756CB503C55}
2013-11-23 09:22 - 2013-11-08 10:02 - 00003216 _____ C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3112642421-3913958396-2466649522-1007
2013-11-23 09:20 - 2011-02-25 11:06 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-23 09:20 - 2009-07-24 09:29 - 00000000 ____D C:\Windows\Panther
2013-11-23 09:13 - 2013-08-15 04:32 - 00000000 ____D C:\Windows\System32\MRT
2013-11-23 09:10 - 2010-07-07 11:50 - 82896128 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-11-23 09:10 - 2010-04-24 21:09 - 04031904 _____ C:\Windows\System32\perfh007.dat
2013-11-23 09:10 - 2010-04-24 21:09 - 01225272 _____ C:\Windows\System32\perfc007.dat
2013-11-23 09:10 - 2009-07-13 21:13 - 00006264 _____ C:\Windows\System32\PerfStringBackup.INI
2013-11-23 09:08 - 2013-11-23 09:08 - 00000291 _____ C:\ProgramData\rzj29j6jw.reg
2013-11-23 09:07 - 2013-11-23 09:07 - 00208896 _____ (Корпорация Майкрософт) C:\ProgramData\wj6j92jzr.dss
2013-11-23 09:07 - 2013-11-23 09:07 - 00060516 ____T (Microsoft Corporation) C:\ProgramData\rzj29j6jw.pss
2013-11-23 08:44 - 2012-10-24 12:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-22 21:03 - 2013-11-22 21:03 - 00000000 ____D C:\FRST
2013-11-22 11:59 - 2010-04-24 11:19 - 02058211 _____ C:\Windows\WindowsUpdate.log
2013-11-22 11:52 - 2009-07-13 20:45 - 00020704 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-22 11:52 - 2009-07-13 20:45 - 00020704 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-22 11:45 - 2010-12-10 12:13 - 00000000 ____D C:\Windows\SysWOW64\logishrd
2013-11-22 11:45 - 2010-12-10 12:13 - 00000000 ____D C:\Windows\System32\logishrd
2013-11-22 11:45 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-22 11:44 - 2013-10-22 10:08 - 00006694 _____ C:\Windows\setupact.log
2013-11-22 11:40 - 2013-11-23 09:07 - 95025368 ____T C:\ProgramData\rzj29j6jw.bxx
2013-11-22 11:40 - 2013-11-23 09:07 - 00000000 _____ C:\ProgramData\rzj29j6jw.fvv
2013-11-22 11:40 - 2010-07-25 07:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-12 05:33 - 2012-10-24 12:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-12 05:33 - 2012-10-24 12:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-12 05:33 - 2011-06-08 09:42 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-08 12:00 - 2010-04-24 11:55 - 00000340 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-11-08 10:29 - 2013-10-04 04:44 - 00000000 ____D C:\ProgramData\LogMeIn
2013-11-08 09:48 - 2010-11-08 08:39 - 00000000 ____D C:\ProgramData\BitDefender
2013-11-08 09:33 - 2013-11-08 09:33 - 00789754 _____ C:\ProgramData\1383930215.bdinstall.bin
2013-11-08 09:19 - 2013-11-08 09:18 - 00000000 ____D C:\ProgramData\BDLogging
2013-11-08 09:18 - 2013-11-08 09:18 - 00000684 ____H C:\bdr-cf01
2013-11-08 09:18 - 2013-11-08 09:18 - 00000000 ____H C:\Windows\System32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-11-08 09:18 - 2013-11-08 09:09 - 00253404 ____H C:\bdr-ld01
2013-11-08 09:18 - 2013-11-08 09:09 - 00009216 ____H C:\bdr-ld01.mbr
2013-11-08 09:09 - 2010-11-08 08:47 - 00000000 ____D C:\Program Files\BitDefender
2013-11-08 09:00 - 2013-11-08 08:57 - 00000000 _____ C:\Windows\System32\獷楬汢捯污
2013-11-08 09:00 - 2010-11-08 08:39 - 00073192 _____ C:\ProgramData\bdinstall.bin
2013-11-04 07:53 - 2013-11-04 07:53 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-03 09:58 - 2010-07-25 01:19 - 00000000 ____D C:\ProgramData\debugout
2013-11-02 11:04 - 2013-11-02 11:04 - 00004865 _____ C:\WirelessDiagLog.csv
2013-11-02 11:01 - 2010-04-24 11:54 - 00000000 ____D C:\ProgramData\PCDr
2013-11-02 10:10 - 2013-11-02 10:10 - 00000030 _____ C:\Windows\success32.log
2013-11-02 10:10 - 2010-04-24 11:59 - 00000000 ____D C:\Program Files\Common Files\Lenovo
2013-11-02 10:10 - 2010-04-24 11:26 - 00000000 ____D C:\Program Files\Lenovo
2013-11-02 10:09 - 2013-11-02 10:09 - 00000030 _____ C:\Windows\success64.log

Files to move or delete:
====================
C:\ProgramData\hpe80D2.dll
C:\ProgramData\rzj29j6jw.bxx
C:\ProgramData\rzj29j6jw.fvv
C:\ProgramData\rzj29j6jw.pss
C:\ProgramData\rzj29j6jw.reg
C:\ProgramData\wj6j92jzr.dss
C:\Users\Warcraft III\bncache.dat
C:\Users\Warcraft III\BNUpdate.exe
C:\Users\Warcraft III\Frozen Throne.exe
C:\Users\Warcraft III\Frozen_Throne.exe
C:\Users\Warcraft III\game.dll
C:\Users\Warcraft III\ijl15.dll
C:\Users\Warcraft III\Kopie von Frozen Throne.exe
C:\Users\Warcraft III\Mss32.dll
C:\Users\Warcraft III\Storm.dll
C:\Users\Warcraft III\war3.exe
C:\Users\Warcraft III\War3TFT_120e_121a_Deutsch.exe
C:\Users\Warcraft III\Warcraft_III.exe
C:\Users\Warcraft III\World Editor.exe
C:\Users\Warcraft III\worldedit.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

12
Restore point made on: 2013-10-22 04:30:35
Restore point made on: 2013-10-22 08:07:20
Restore point made on: 2013-10-22 08:08:31
Restore point made on: 2013-10-22 08:09:21
Restore point made on: 2013-10-22 08:11:17
Restore point made on: 2013-10-29 06:44:44
Restore point made on: 2013-11-02 10:11:57
Restore point made on: 2013-11-02 10:24:15
Restore point made on: 2013-11-02 11:07:48
Restore point made on: 2013-11-08 09:56:30
Restore point made on: 2013-11-12 05:37:13
Restore point made on: 2013-11-23 09:10:27

==================== Memory info ===========================

Percentage of memory in use: 19%
Total physical RAM: 3956.55 MB
Available physical RAM: 3203.32 MB
Total Pagefile: 3954.7 MB
Available Pagefile: 3195.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:263.9 GB) (Free:181 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Lars) (Fixed) (Total:190.92 GB) (Free:133.15 GB) NTFS
Drive f: (Lenovo_Recovery) (Fixed) (Total:9.77 GB) (Free:2.23 GB) NTFS
Drive h: (STORE N GO) (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM_DRV) (Fixed) (Total:1.17 GB) (Free:0.45 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: BE9C27D8)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=264 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=191 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=10 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=2 GB) - (Type=0E)


LastRegBack: 2013-11-01 04:25

==================== End Of Log ============================
Vielen Dank vorab schon für die Hilfe!

Gruß

Bootsektor 23.11.2013 22:40
:hallo:

Mein Name ist Sandra, ich habe dein Thema in Arbeit und melde mich so schnell wie möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld :)

Bootsektor 24.11.2013 00:18
Hallo schak,

Startet der Rechner nach diesem Fix normal?

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
S2 Winmgmt; C:\ProgramData\rzj29j6jw.pss [60516 2013-11-23] (Microsoft Corporation)
C:\ProgramData\hpe80D2.dll
C:\ProgramData\rzj29j6jw.bxx
C:\ProgramData\rzj29j6jw.fvv
C:\ProgramData\rzj29j6jw.pss
C:\ProgramData\rzj29j6jw.reg
C:\ProgramData\wj6j92jzr.dss
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

schak 24.11.2013 09:06
Guten Morgen Sandra!

Zunächst vielen lieben Dank für Deine schnelle Hilfe!

Der Rechner startet wieder normal, hier die Fixlog:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-11-2013 03
Ran by SYSTEM at 2013-11-23 08:17:12 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
S2 Winmgmt; C:\ProgramData\rzj29j6jw.pss [60516 2013-11-23] (Microsoft Corporation)
C:\ProgramData\hpe80D2.dll
C:\ProgramData\rzj29j6jw.bxx
C:\ProgramData\rzj29j6jw.fvv
C:\ProgramData\rzj29j6jw.pss
C:\ProgramData\rzj29j6jw.reg
C:\ProgramData\wj6j92jzr.dss
*****************

Winmgmt => Service restored successfully.
C:\ProgramData\hpe80D2.dll => Moved successfully.
C:\ProgramData\rzj29j6jw.bxx => Moved successfully.
C:\ProgramData\rzj29j6jw.fvv => Moved successfully.
C:\ProgramData\rzj29j6jw.pss => Moved successfully.
C:\ProgramData\rzj29j6jw.reg => Moved successfully.
C:\ProgramData\wj6j92jzr.dss => Moved successfully.

==== End of Fixlog ====
Wie geht`s weiter?;)

Beste Grüße

Bootsektor 24.11.2013 21:03
Hallo schak,
sehr schön, :daumenhoc
dann ab jetzt alle Scans im Normalmodus.

Schritt 1
Verschiebe nun die FRST.exe von Deinem USB-Stick auf den Desktop Deines Rechners.
Starte jetzt noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

schak 24.11.2013 22:47
Okay, hier gehts weiter:


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2013 03
Ran by Lars (administrator) on LARSEWENS-THINK on 23-11-2013 21:54:49
Running from L:\Benutzer\Lars\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Bitdefender) C:\Program Files\BitDefender\Bitdefender\vsserv.exe
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
() C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dqscrproj.exe
(AMD) C:\Windows\System32\atieclxx.exe
(lenovo) C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dqscrproxy.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dcute.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\bdagent.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\pmbxag.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\antispam32\bdapppassmgr.exe
() C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Logitech Inc.) C:\Program Files\Logitech\SetPoint II\SetPointII.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL2\KHALMNPR.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\LVPrS64H.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe
() C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(QUALCOMM, Inc.) C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\updatesrv.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender Safebox\safeboxservice.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\LWS\LU\LULnchr.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\LWS\LU\LogitechUpdate.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [380776 2009-12-11] (Lenovo.)
HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [36864 2009-10-13] ()
HKLM\...\Run: [cssauth] - C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [5879608 2009-08-26] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2097960 2010-04-22] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo dCute] - C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dcute.exe [686080 2010-02-26] (Lenovo)
HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe [415816 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2093128 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4271688 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.Exe [236544 2008-10-10] (Logitech, Inc.)
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [62312 2010-07-27] (Lenovo Group Limited)
HKLM\...\Run: [Bdagent] - C:\Program Files\BitDefender\Bitdefender\bdagent.exe [1738968 2013-10-23] (Bitdefender)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1820584 2013-10-30] (Valve Corporation)
HKCU\...\Run: [Bitdefender-Geldbörse-Agent] - C:\Program Files\BitDefender\Bitdefender\pmbxag.exe [564256 2013-10-28] (Bitdefender)
HKCU\...\Run: [Bitdefender-Geldbörse] - C:\Program Files\BitDefender\Bitdefender\pwdmanui.exe [1004608 2013-10-23] (Bitdefender)
HKCU\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] - C:\Program Files\BitDefender\Bitdefender\antispam32\bdapppassmgr.exe [621448 2013-10-23] (Bitdefender)
MountPoints2: {9258b6fc-c4f4-11df-8710-c80aa9699b50} - E:\Startme.exe
MountPoints2: {c6feec91-4fd5-11df-8e04-806e6f6e6963} - Q:\LenovoQDrive.exe
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [1101672 2010-01-05] (Lenovo Group Limited)
HKLM-x32\...\Run: [Message Center Plus] - C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe [49976 2009-05-27] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2010-07-12] (Nullsoft, Inc.)
HKLM-x32\...\Run: [LWS] - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [165208 2010-05-07] (Logitech Inc.)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [273544 2011-02-25] (RealNetworks, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1564872 2012-06-06] (Ask)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2349392 2013-10-31] (LogMeIn Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-03] (Adobe Systems Incorporated)
HKU\TEMP\...\RunOnce: [wlstart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-08-20] (Microsoft Corporation)
HKU\TEMP\...\RunOnce: [] - [x]
HKU\TEMP\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
Lsa: [Notification Packages] scecli ACGina
Startup: L:\Benutzer\Lars\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rzj29j6jw.lnk
ShortcutTarget: rzj29j6jw.lnk -> C:\PROGRA~3\wj6j92jzr.dss (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM-x32 - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
URLSearchHook: HKLM-x32 - Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
URLSearchHook: HKLM-x32 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
URLSearchHook: HKLM-x32 - ClipGrab Toolbar - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
URLSearchHook: HKCU - Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
URLSearchHook: HKCU - ClipGrab Toolbar - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM-x32 - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - DefaultScope {4D8BCBCF-4540-43F7-9E8C-EB9E79B28834} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - Plasmoo URL = hxxp://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}
SearchScopes: HKCU - {4D8BCBCF-4540-43F7-9E8C-EB9E79B28834} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {AFC2BF4F-5C2A-4FB0-93FA-F7AB7A69A795} URL =
SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - {F2D23918-A637-4C02-9C89-587BA12CE829} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_uid=DF6B39F1-7969-4660-BFCA-22FE34B41625&apn_sauid=8CE077B7-431F-4882-BD96-D1A698932911
SearchScopes: HKCU - {FD834812-E2BD-4CB0-8E4A-1802DF895B5B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2536373
BHO: Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\BitDefender\Bitdefender\pmbxie.dll (Bitdefender)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\BitDefender\Bitdefender\antispam32\pmbxie.dll (Bitdefender)
BHO-x32: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
BHO-x32: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO-x32: ICQ Sparberater - {5A0D6E4B-B0DF-4148-8B1E-F7A430FF5E24} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: IePasswordManagerHelper Class - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files (x86)\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: ClipGrab Toolbar - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
Toolbar: HKLM-x32 - No Name - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - ClipGrab Toolbar - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} -  No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {E36DF325-3F4B-476F-8F89-123BC5D51A30} -  No File
DPF: HKLM-x32 {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cab
DPF: HKLM-x32 {A6616B31-4860-41E2-98E3-CA7649AF172F} file:///D:/launch.ocx
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File

Chrome:
=======
CHR HomePage: hxxp://plasmoo.com
CHR RestoreOnStartup: "hxxp://plasmoo.com"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Extension: (Bitdefender Wallet) - L:\Benutzer\Lars\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccahoghmggldkcdjiebjkidpfongdfbl\17.19.0_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - L:\Benutzer\Lars\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3
CHR Extension: (Skype Extension) - L:\Benutzer\Lars\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0
CHR HKLM-x32\...\Chrome\Extension: [ccahoghmggldkcdjiebjkidpfongdfbl] - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxcr.crx
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.0.601.crx

==================== Services (Whitelisted) =================

S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe [77120 2013-10-15] (Bitdefender)
S2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377104 2013-10-11] (LogMeIn, Inc.)
R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-06-02] (Symantec Corporation)
R2 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [126392 2011-11-07] (Symantec Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-10-01] ()
R2 QDLService2kLenovo; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe [331512 2010-02-05] (QUALCOMM, Inc.)
R2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [94624 2013-07-08] (Bitdefender)
R2 ScrProj; C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dqscrproj.exe [88576 2010-02-26] ()
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22888 2013-09-17] ()
S2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1019904 2009-08-28] (Lenovo Group Limited)
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-07-06] (Lenovo Group Limited)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [67320 2013-10-07] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender\vsserv.exe [1506736 2013-10-23] (Bitdefender)

==================== Drivers (Whitelisted) ====================

R0 ALvldr; C:\Windows\System32\DRIVERS\ALvldr.sys [28736 2010-02-26] (Lenovo Soft Corporation(32))
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
R1 Bdvedisk; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
R1 dqBridge; C:\Windows\System32\DRIVERS\dqbridge.sys [57408 2010-02-26] ()
S3 dqusb; C:\Windows\System32\DRIVERS\dqusb.sys [29688 2009-08-06] (Lenovo)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
R3 lvlddrv; C:\Windows\System32\DRIVERS\lvlddrv.sys [94784 2010-02-26] (Lenovo Soft Corporation(32))
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 qcfilterlno2k; C:\Windows\System32\DRIVERS\qcfilterlno2k.sys [6400 2010-02-05] (QUALCOMM Incorporated)
R3 qcusbnetlno2k; C:\Windows\System32\DRIVERS\qcusbnetlno2k.sys [241664 2010-02-05] (QUALCOMM Incorporated)
R3 qcusbserlno2k; C:\Windows\System32\DRIVERS\qcusbserlno2k.sys [121600 2010-02-05] (QUALCOMM Incorporated)
S3 s1029bus; C:\Windows\System32\DRIVERS\s1029bus.sys [116264 2009-05-25] (MCCI Corporation)
S3 s1029mdfl; C:\Windows\System32\DRIVERS\s1029mdfl.sys [19496 2009-05-25] (MCCI Corporation)
S3 s1029mdm; C:\Windows\System32\DRIVERS\s1029mdm.sys [158760 2009-05-25] (MCCI Corporation)
S3 s1029mgmt; C:\Windows\System32\DRIVERS\s1029mgmt.sys [139304 2009-05-25] (MCCI Corporation)
S3 s1029nd5; C:\Windows\System32\DRIVERS\s1029nd5.sys [34856 2009-05-25] (MCCI Corporation)
S3 s1029obex; C:\Windows\System32\DRIVERS\s1029obex.sys [135208 2009-05-25] (MCCI Corporation)
S3 s1029unic; C:\Windows\System32\DRIVERS\s1029unic.sys [151592 2009-05-25] (MCCI Corporation)
R1 TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [13104 2010-01-05] ()
R0 Trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [12728 2009-09-29] ()
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 PCDSRVC{127174DC-C366ED8B-06000000}_0; \??\c:\program files\pc-doctor\pcdsrvc_x64.pkms [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-23 21:54 - 2013-11-23 21:55 - 00025595 _____ L:\Benutzer\Lars\Desktop\FRST.txt
2013-11-23 21:54 - 2013-11-23 20:56 - 01958396 _____ (Farbar) L:\Benutzer\Lars\Desktop\FRST64.exe
2013-11-23 19:57 - 2013-11-23 19:57 - 00003224 ____N C:\bootsqm.dat
2013-11-23 18:15 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-23 18:15 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-23 18:15 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-23 18:15 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-23 18:15 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-23 18:15 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-23 18:15 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-23 18:15 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-23 18:15 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-23 18:15 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-23 18:14 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-23 18:00 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-23 18:00 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-23 18:00 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-23 18:00 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-23 18:00 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-23 18:00 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-23 18:00 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-23 18:00 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-23 18:00 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-23 17:59 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-23 17:59 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-23 17:59 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-23 17:59 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-23 17:59 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-23 17:59 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-23 17:59 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-23 17:59 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-23 17:59 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-23 17:59 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-23 17:59 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-23 17:59 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-23 17:59 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-23 17:59 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-23 17:59 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-23 17:59 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-23 17:59 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-23 17:59 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-23 17:59 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-23 17:59 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-23 17:59 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-23 09:50 - 2013-11-23 09:50 - 00000774 _____ C:\Windows\PFRO.log
2013-11-23 08:40 - 2013-11-23 09:58 - 00000134 _____ L:\Benutzer\Lars\Desktop\Internet Explorer Troubleshooting.url
2013-11-23 08:39 - 2013-11-23 09:59 - 00013474 _____ C:\Windows\IE11_main.log
2013-11-23 08:26 - 2013-11-23 08:26 - 00001896 _____ L:\Benutzer\Öffentlich\Desktop\Adobe Reader X.lnk
2013-11-23 08:26 - 2013-11-23 08:26 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-23 06:03 - 2013-11-23 06:03 - 00000000 ____D C:\FRST
2013-11-08 19:02 - 2013-11-23 18:22 - 00003216 _____ C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3112642421-3913958396-2466649522-1007
2013-11-08 18:18 - 2013-11-08 18:18 - 00002069 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Safepay.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00001960 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Total Security.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00000684 ____H C:\bdr-cf01
2013-11-08 18:18 - 2013-11-08 18:18 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-11-08 18:17 - 2013-07-23 15:50 - 00082824 _____ (BitDefender SRL) C:\Windows\system32\Drivers\bdsandbox.sys
2013-11-08 18:17 - 2013-07-19 17:08 - 00601360 _____ (BitDefender) C:\Windows\system32\Drivers\avckf.sys
2013-11-08 18:17 - 2013-07-19 17:04 - 00727592 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys
2013-11-08 18:17 - 2013-02-22 18:46 - 00093600 _____ (BitDefender LLC) C:\Windows\system32\Drivers\BdfNdisf6.sys
2013-11-08 18:17 - 2012-11-02 13:17 - 00261056 _____ (BitDefender) C:\Windows\system32\Drivers\avchv.sys
2013-11-08 18:17 - 2012-04-17 13:34 - 00076944 _____ (BitDefender) C:\Windows\system32\Drivers\bdvedisk.sys
2013-11-08 18:17 - 2007-04-11 10:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2013-11-08 18:09 - 2013-11-08 18:18 - 00253404 ____H C:\bdr-ld01
2013-11-08 18:09 - 2013-11-08 18:18 - 00009216 ____H C:\bdr-ld01.mbr
2013-11-08 18:09 - 2013-09-24 15:38 - 46879860 ____H C:\bdr-im01.gz
2013-11-08 18:09 - 2013-08-13 12:38 - 03271472 ____H C:\bdr-bz01
2013-11-08 18:03 - 2013-08-23 12:48 - 00150256 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2013-11-08 18:03 - 2013-08-07 12:46 - 00389240 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2013-11-08 17:57 - 2013-11-08 18:00 - 00000000 _____ C:\Windows\system32\獷楬汢捯污
2013-11-04 16:53 - 2013-11-04 16:53 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-02 20:07 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-11-02 20:04 - 2013-11-02 20:04 - 00004865 _____ C:\WirelessDiagLog.csv
2013-11-02 19:12 - 2013-11-02 19:12 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\Tvsukernel
2013-11-02 19:12 - 2012-01-14 05:41 - 00068864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2013-11-02 19:10 - 2013-11-02 19:10 - 00000030 _____ C:\Windows\success32.log
2013-11-02 19:09 - 2013-11-02 19:09 - 00000030 _____ C:\Windows\success64.log
2013-10-28 21:40 - 2013-06-23 15:56 - 00002357 _____ L:\Benutzer\Lars\Desktop\Skype.lnk

==================== One Month Modified Files and Folders =======

2013-11-23 21:55 - 2013-11-23 21:54 - 00025595 _____ L:\Benutzer\Lars\Desktop\FRST.txt
2013-11-23 21:54 - 2010-12-02 17:15 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\LogMeIn Hamachi
2013-11-23 21:52 - 2010-12-10 21:13 - 00000000 ____D C:\Windows\SysWOW64\logishrd
2013-11-23 21:52 - 2010-12-10 21:13 - 00000000 ____D C:\Windows\system32\logishrd
2013-11-23 21:52 - 2010-07-25 16:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-23 21:51 - 2013-10-22 19:08 - 00007198 _____ C:\Windows\setupact.log
2013-11-23 21:51 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-23 20:56 - 2013-11-23 21:54 - 01958396 _____ (Farbar) L:\Benutzer\Lars\Desktop\FRST64.exe
2013-11-23 20:23 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-23 19:57 - 2013-11-23 19:57 - 00003224 ____N C:\bootsqm.dat
2013-11-23 18:29 - 2011-02-25 20:06 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-23 18:23 - 2010-11-10 22:45 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{729EE656-F272-42D3-AAC6-5756CB503C55}
2013-11-23 18:22 - 2013-11-08 19:02 - 00003216 _____ C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3112642421-3913958396-2466649522-1007
2013-11-23 18:20 - 2011-02-25 20:06 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-23 18:20 - 2009-07-24 18:29 - 00000000 ____D C:\Windows\Panther
2013-11-23 18:13 - 2013-08-15 13:32 - 00000000 ____D C:\Windows\system32\MRT
2013-11-23 18:10 - 2010-07-07 20:50 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-23 18:07 - 2010-07-25 15:19 - 00000000 ___RD L:\Benutzer\Lars\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 17:44 - 2012-10-24 21:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-23 11:10 - 2010-04-24 20:19 - 01202525 _____ C:\Windows\WindowsUpdate.log
2013-11-23 11:09 - 2009-07-14 05:45 - 00020704 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-23 11:09 - 2009-07-14 05:45 - 00020704 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-23 11:07 - 2010-04-25 06:09 - 04081962 _____ C:\Windows\system32\perfh007.dat
2013-11-23 11:07 - 2010-04-25 06:09 - 01241442 _____ C:\Windows\system32\perfc007.dat
2013-11-23 11:07 - 2009-07-14 06:13 - 00006264 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-23 09:59 - 2013-11-23 08:39 - 00013474 _____ C:\Windows\IE11_main.log
2013-11-23 09:58 - 2013-11-23 08:40 - 00000134 _____ L:\Benutzer\Lars\Desktop\Internet Explorer Troubleshooting.url
2013-11-23 09:50 - 2013-11-23 09:50 - 00000774 _____ C:\Windows\PFRO.log
2013-11-23 08:26 - 2013-11-23 08:26 - 00001896 _____ L:\Benutzer\Öffentlich\Desktop\Adobe Reader X.lnk
2013-11-23 08:26 - 2013-11-23 08:26 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-23 06:03 - 2013-11-23 06:03 - 00000000 ____D C:\FRST
2013-11-12 14:34 - 2010-07-25 16:30 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\Adobe
2013-11-12 14:33 - 2012-10-24 21:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-12 14:33 - 2012-10-24 21:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-12 14:33 - 2011-06-08 18:42 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-08 21:00 - 2010-04-24 20:55 - 00000340 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-11-08 18:19 - 2010-11-08 17:48 - 00000000 ____D L:\Benutzer\Lars\AppData\Roaming\BitDefender
2013-11-08 18:18 - 2013-11-08 18:18 - 00002069 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Safepay.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00001960 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Total Security.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00000684 ____H C:\bdr-cf01
2013-11-08 18:18 - 2013-11-08 18:18 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-11-08 18:18 - 2013-11-08 18:09 - 00253404 ____H C:\bdr-ld01
2013-11-08 18:18 - 2013-11-08 18:09 - 00009216 ____H C:\bdr-ld01.mbr
2013-11-08 18:09 - 2010-11-08 17:47 - 00000000 ____D C:\Program Files\BitDefender
2013-11-08 18:00 - 2013-11-08 17:57 - 00000000 _____ C:\Windows\system32\獷楬汢捯污
2013-11-04 16:53 - 2013-11-04 16:53 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-03 18:40 - 2010-11-26 19:59 - 00000376 _____ L:\Benutzer\Lars\AppData\Roamingprivacy.xml
2013-11-02 20:04 - 2013-11-02 20:04 - 00004865 _____ C:\WirelessDiagLog.csv
2013-11-02 19:12 - 2013-11-02 19:12 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\Tvsukernel
2013-11-02 19:10 - 2013-11-02 19:10 - 00000030 _____ C:\Windows\success32.log
2013-11-02 19:10 - 2010-04-24 20:59 - 00000000 ____D C:\Program Files\Common Files\Lenovo
2013-11-02 19:10 - 2010-04-24 20:26 - 00000000 ____D C:\Program Files\Lenovo
2013-11-02 19:09 - 2013-11-02 19:09 - 00000030 _____ C:\Windows\success64.log
2013-10-29 18:37 - 2010-08-31 18:23 - 00000000 ____D L:\Benutzer\Lars\AppData\Roaming\TS3Client
2013-10-24 13:47 - 2013-03-04 20:53 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\TeamSpeak 3 Client

Files to move or delete:
====================
L:\Benutzer\Öffentlich\ts2_client_rc2_2032.exe
L:\Benutzer\Öffentlich\winamp5581_full_emusic-7plus_en-us.exe


Some content of TEMP:
====================
L:\Benutzer\Lars\AppData\Local\Temp\~tmf6789691553120257873.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-01 13:25

==================== End Of Log ============================
--- --- ---

--- --- ---


Addition:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-11-2013 03
Ran by Lars at 2013-11-23 21:55:46
Running from L:\Benutzer\Lars\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Bitdefender Antivirus (Enabled - Up to date) {9B5F5313-CAF9-DD97-C460-E778420237B4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Bitdefender Spyware-Schutz (Enabled - Up to date) {203EB2F7-ECC3-D219-FED0-DC0A39857D09}
FW: Bitdefender Firewall (Enabled) {A364D236-8096-DCCF-EF3F-4E4DBCD170CF}

==================== Installed Programs ======================

 Registry Patch to arrange icons in Device and Printers folder of Windows 7 (Version: 1.00)
Access Help (x32 Version: 3.00)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.152)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Anzeige am Bildschirm (Version: 6.70.00)
Apple Application Support (x32 Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (x32 Version: 2.1.3.127)
Ask Toolbar (x32 Version: 1.15.4.0)
Ask Toolbar Updater (HKCU Version: 1.2.2.23821)
ATI Catalyst Install Manager (Version: 3.0.778.0)
ATI Uninstaller (Version: 8.70-100113a-095272C-Lenovo)
Bing Bar (x32 Version: 7.0.850.0)
Bitdefender Total Security (Version: 17.21.0.925)
Bonjour (Version: 3.0.0.10)
Burn.Now 4.5 (x32 Version: 4.5.0)
Call of Duty: Modern Warfare 2 - Multiplayer (x32)
CameraHelperMsi (x32 Version: 13.10.1217.0)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0527.1242.20909)
Catalyst Control Center InstallProxy (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center InstallProxy (x32 Version: 2010.0527.1242.20909)
Catalyst Control Center Localization All (x32 Version: 2010.0527.1242.20909)
CCC Help English (x32 Version: 2010.0527.1241.20909)
ccc-core-static (x32 Version: 2010.0527.1242.20909)
ccc-utility64 (Version: 2010.0527.1242.20909)
CCleaner (Version: 3.21)
Client Security - Password Manager (Version: 8.30.0023.00)
ClipGrab Toolbar (x32 Version: 6.8.10.0)
Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6612.1000)
Corel Burn.Now Lenovo Edition (x32 Version: 4.5.0)
Corel DVD MovieFactory 7 (x32 Version: 7.0.0)
Corel DVD MovieFactory Lenovo Edition (x32 Version: 7.0.0)
Cossacks - European Wars (x32)
Cossacks - The Art Of War (x32)
Counter-Strike (x32)
Counter-Strike 1.6 (x32 Version: 1.00.0000)
Counter-Strike(TM) (x32 Version: 1.0.0.0)
Create Recovery Media (x32 Version: 1.20.0.00)
Direct DiscRecorder (x32 Version: 1.00.0000)
Dota 2 (x32)
Driver Whiz (x32 Version: 8.1)
DVDVideoSoftTB Toolbar (x32 Version: )
erLT (x32 Version: 1.20.0137)
erLT (x32 Version: 1.20.138.34)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0)
Free Audio CD Burner version 1.4.8 (x32)
Free Video to MP3 Converter version 4.2.12 (x32)
Free YouTube to MP3 Converter version 3.10.14.1206 (x32)
G9x User's Guide (Version: 1.10.0000)
Google Chrome (x32 Version: 30.0.1599.101)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
HP Deskjet 2050 J510 series - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Deskjet 2050 J510 series Hilfe (x32 Version: 140.0.61.61)
HP Photo Creations (x32 Version: 1.0.0.3781)
HP Update (x32 Version: 5.002.006.003)
iCloud (Version: 3.0.2.163)
ICQ Sparberater (x32 Version: 1.0.601)
ICQ7.5 (x32 Version: 7.5)
Integrated Camera Driver Installer Package Ver.1.0.1.2 (x32 Version: 1.0.1.2)
Integrated Camera TWAIN (x32 Version: 1.0.8.601)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) PROSet/Wireless WiFi-Software (Version: 13.00.0000)
Intel(R) Rapid Storage Technology (x32 Version: 9.5.7.1002)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.00.01.1002)
InterVideo WinDVD 8 (x32 Version: 8.0.20.178)
iTunes (Version: 11.1.0.126)
Java Auto Updater (x32 Version: 2.0.7.2)
Java(TM) 6 Update 17 (64-bit) (Version: 6.0.170)
Java(TM) 6 Update 37 (x32 Version: 6.0.370)
JNLP (HKCU)
Junk Mail filter update (x32 Version: 14.0.8089.726)
Lenovo Patch Utility (x32 Version: 1.4.0.4)
Lenovo Patch Utility 64 bit (Version: 1.3.0.9)
Lenovo System Interface Driver (Version: 1.05)
Lenovo System Update (x32 Version: 5.03.0005)
Lenovo ThinkVantage Toolbox (Version: 6.0.5450.10)
Lenovo Warranty Information (x32 Version: 1.0.0004.00)
Lenovo Welcome (x32 Version: 2.0.023.0)
Logitech GamePanel Software 3.04.143 (Version: 3.04.143)
Logitech SetPoint 5.10 (Version: 5.10)
Logitech Vid HD (x32 Version: 7.2 (7240))
Logitech Webcam Software (x32 Version: 2.0)
LogMeIn Hamachi (x32 Version: 2.2.0.58)
LWS Facebook (x32 Version: 13.10.1216.0)
LWS Gallery (x32 Version: 13.10.1216.0)
LWS Help_main (x32 Version: 13.10.1224.0)
LWS Launcher (x32 Version: 13.10.1224.0)
LWS Motion Detection (x32 Version: 13.10.1218.0)
LWS Pictures And Video (x32 Version: 13.10.1218.0)
LWS Twitter (x32 Version: 13.00.1216.0)
LWS Video Mask Maker (x32 Version: 13.10.1216.0)
LWS VideoEffects (Version: 13.00.1774.0)
LWS Webcam Software (x32 Version: 13.00.1774.0)
LWS WLM Plugin (x32 Version: 1.10.1222.0)
LWS YouTube Plugin (x32 Version: 13.10.1216.0)
MAGIX Music Maker SE (x32 Version: 16.0.2.6)
MAGIX Online Druck Service (x32 Version: 3.4.3.0)
MAGIX Screenshare (x32 Version: 4.3.6.1987)
MAGIX Speed 2 (MSI) (x32 Version: 6.0.1.4)
Media Go (x32 Version: 1.3.227)
Message Center Plus (x32 Version: 2.0.0012.00)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2003 Web Components (x32 Version: 11.0.8003.0)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Small Business Connectivity Components (x32 Version: 2.0.7024.0)
Microsoft Office Standard Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Research AutoCollage Touch 2009 (x32 Version: 2.00.2009)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server Native Client (Version: 9.00.4035.00)
Microsoft SQL Server VSS Writer (Version: 9.00.4035.00)
Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mobile Broadband Connect (x32 Version: 3.5.0009)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Norton PC Checkup (x32 Version: 2.0.17.20)
Norton PC Checkup (x32 Version: 3.0.2.122.0)
PlayStation(R)Store (x32 Version: 2.7.6.06777)
Qualcomm Gobi 2000 Package for Lenovo (x32 Version: 1.1.120)
QuickTime (x32 Version: 7.74.80.86)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealPlayer (x32)
Realtek Ethernet Controller Driver For Windows Vista and Later (x32 Version: 1.00.0010)
Realtek HDMI Audio Driver for ATI (x32 Version: 6.0.1.5992)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6000)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30113)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (Version: 1.00)
Rescue and Recovery (x32 Version: 4.30.0025.00)
Safari (x32 Version: 5.34.57.2)
Skype Toolbars (x32 Version: 5.3.7555)
Skype™ 6.3 (x32 Version: 6.3.107)
SolidWorks Explorer 2012 SP03 (x32 Version: 20.30.66)
Steam (x32 Version: 1.0.0.0)
Studie zur Verbesserung von HP Deskjet 2050 J510 series Produkten (Version: 22.50.231.0)
TeamSpeak 3 Client (HKCU Version: 3.0.13.1)
TeamSpeak 3 Client (x32)
Text-To-Speech-Runtime (x32 Version: 1.0.0.0)
ThinkPad Bluetooth with Enhanced Data Rate Software (Version: 6.2.1.1400)
ThinkPad Energie-Manager (x32 Version: 3.12)
ThinkPad Power Management Driver (Version: 1.60.0.4)
ThinkPad UltraNav Driver (Version: 15.0.18.0)
ThinkPad USB Port Replicator (Version: 2.0.15.0)
ThinkPad USB Port Replicator with Digital Video (Version: 2.0.15.0)
ThinkVantage Access Connections (x32 Version: 5.61)
ThinkVantage Communications Utility (Version: 1.42)
ThinkVantage GPS (x32 Version: 2.50)
ThinkVantage System für aktiven Festplattenschutz (Version: 1.71)
TouchCopy 12 (x32 Version: 12.05)
TrackMania Nations Forever (x32)
Überwachungstool für die Intel® Turbo-Boost-Technik (Version: 1.0.186.3)
Uninstall 1.0.0.1 (x32)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (x32 Version: 9.00.4035.00)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
VLC media player 1.1.10 (x32 Version: 1.1.10)
Winamp (x32 Version: 5.581 )
Winamp Detector Plug-in (HKCU Version: 1.0.0.1)
Winamp Toolbar (x32)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (02/25/2010 6.2.0.9419) (Version: 02/25/2010 6.2.0.9419)
Windows Driver Package - Broadcom Bluetooth  (01/19/2010 6.2.0.1417) (Version: 01/19/2010 6.2.0.1417)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows XP Mode (Version: 1.3.7600.16422)
Windows-Treiberpaket - Intel hdc  (06/04/2009 7.0.0.1013) (Version: 06/04/2009 7.0.0.1013)
Windows-Treiberpaket - Intel System  (06/04/2009 1.0.0.0002) (Version: 06/04/2009 1.0.0.0002)
Windows-Treiberpaket - Intel System  (10/28/2009 9.1.1.1022) (Version: 10/28/2009 9.1.1.1022)
Windows-Treiberpaket - Intel USB  (08/20/2009 9.1.1.1020) (Version: 08/20/2009 9.1.1.1020)
Windows-Treiberpaket - Lenovo 1.60.0.4 (11/18/2009 1.60.0.4) (Version: 11/18/2009 1.60.0.4)
Windows-Treiberpaket - Realtek Semiconductor Corp. HD Audio Driver (12/01/2009 5.10.0.5992) (Version: 12/01/2009 5.10.0.5992)
Windows-Treiberpaket - Realtek Semiconductor Corp. HD Audio Driver (12/01/2009 6.0.1.5992) (Version: 12/01/2009 6.0.1.5992)
Windows-Treiberpaket - Realtek Semiconductor Corp. HD Audio Driver (12/10/2009 6.0.1.6000) (Version: 12/10/2009 6.0.1.6000)
YAWLE 0.5b (x32)

==================== Restore Points  =========================

22-10-2013 16:09:16 ICQ Sparberater wird entfernt
22-10-2013 16:11:11 Removed PlayStation(R)Network Downloader.
29-10-2013 14:44:21 Windows Update
02-11-2013 18:11:27 Windows Update
02-11-2013 18:23:46 Windows Update
02-11-2013 19:07:19 Windows Update
08-11-2013 17:56:05 Windows Update
23-11-2013 07:39:14 Windows Update
23-11-2013 07:41:21 Windows Update
23-11-2013 08:56:55 Windows Update
23-11-2013 17:10:07 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {03A464F9-248B-40F7-AA73-2E68CF27D801} - System32\Tasks\{52A05F51-F125-4C93-BA5D-7DC687F33E59} => C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE [2010-06-23] (Microsoft Corporation)
Task: {072605FD-14FE-443A-B6FA-EC92B2E5B3AB} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2013-09-17] ()
Task: {117FACFD-7223-486D-8EF4-447DC650ED7D} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-06-06] ()
Task: {1A15509D-A6AC-4B61-B8E0-E8C81C1437CC} - System32\Tasks\TVT\LaunchRnR => %RR%\rrcmd.exe
Task: {3E6EFB74-3A36-43A7-957F-80658EAFBB20} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-02-25] (Google Inc.)
Task: {433183FA-E810-441E-91FE-979C3308432A} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\pcdr5cuiw32.exe [2010-01-28] (PC-Doctor, Inc.)
Task: {47E4F92E-1EC6-419E-BDAF-13274E1DBBC2} - System32\Tasks\JavaUpdateSched => C:\Windows\SysWOW64\jusched.exe
Task: {5503CD85-5E46-4423-B30D-59FEB6A1DCC9} - System32\Tasks\TVT\ChangePWD => %RR%\rrcmd.exe
Task: {5B9E29F7-A2F9-4E40-B0C8-D45355E80F34} - System32\Tasks\Driver Whiz-RTMScan => C:\Program Files (x86)\Driver Whiz\Driver Whiz\DriverWhiz.exe
Task: {6CA03B29-F549-4279-B105-48BA2A7848BA} - System32\Tasks\Driver Whiz-RTMRules => C:\Program Files (x86)\Driver Whiz\Driver Whiz\DriverWhiz.exe
Task: {6E91677B-22D0-45E6-8505-6447699010F2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-12] (Adobe Systems Incorporated)
Task: {7AAC2B10-F564-4EED-98AE-7EF89317E6F0} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {85C70CDA-E414-4078-A97A-CCB3791F507B} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {8FE9C324-D7CD-4D63-A041-12CB37383743} - System32\Tasks\{E06954A1-3D45-4526-9563-C024DBE01FA4} => C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE [2010-06-23] (Microsoft Corporation)
Task: {92611488-0BFE-43B8-8731-6049D8D5F9E1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9B969DFE-CAA1-4897-895A-0C2084909AB3} - System32\Tasks\{8FE70DDE-F743-4A69-A633-2231878724FE} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-04-19] (Skype Technologies S.A.)
Task: {A4424195-63D2-435F-9227-A7C5E6104069} - System32\Tasks\Driver Whiz-RTMUpdater => C:\Program Files (x86)\Driver Whiz\Driver Whiz\DriverWhiz.exe
Task: {AA1AFB08-68E8-457F-AA74-202323A23801} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PWMIDTSV.EXE [2010-01-05] (Lenovo Group Limited)
Task: {AB0A932D-4D93-45C3-83A2-E726DEFE35BA} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\pcdlauncher.exe [2009-11-20] (PC-Doctor, Inc.)
Task: {C30383B7-7B84-4D98-B671-7D0160A20E8F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-02-25] (Google Inc.)
Task: {CE753147-224D-4C14-A7E7-25255E946E90} - System32\Tasks\HPCustParticipation HP Deskjet 2050 J510 series => C:\Program Files\HP\HP Deskjet 2050 J510 series\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {D3732434-862A-4DC5-8A04-0C6B5F85B52A} - System32\Tasks\{1C98C0E2-37C9-42DC-9269-93B6C0F9EEDC} => C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE [2010-06-23] (Microsoft Corporation)
Task: {E91CBB30-C7E4-4272-A976-DFEA266AAC67} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-07-24] (Piriform Ltd)
Task: {F43665A5-8CA3-4B38-B7AB-57BF20CC6E71} - System32\Tasks\TVT\UpdateRnR => %TVTCOMMON%\Scheduler\tvtsetsched.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\pcdlauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\pcdr5cuiw32.exe

==================== Loaded Modules (whitelisted) =============

2010-04-24 20:34 - 2010-01-05 19:12 - 00041472 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2013-11-08 18:17 - 2013-06-19 11:45 - 00265080 _____ () C:\Program Files\BitDefender\Bitdefender\txmlutil.dll
2010-05-27 11:40 - 2010-05-27 11:40 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-03-01 10:13 - 2010-03-01 10:13 - 00020480 ____N () C:\Program Files (x86)\Lenovo\Access Connections\ACNewBiosHelper.dll
2011-09-27 06:23 - 2011-09-27 06:23 - 00087912 ____N () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 06:22 - 2011-09-27 06:22 - 01242472 ____N () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-11-08 18:17 - 2013-06-19 11:44 - 00204280 _____ () C:\Program Files\BitDefender\Bitdefender\antispam32\txmlutil.dll
2010-05-07 18:35 - 2010-05-07 18:35 - 02143576 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2010-05-07 18:35 - 2010-05-07 18:35 - 07954776 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2010-05-07 18:36 - 2010-05-07 18:36 - 00340824 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2010-05-07 18:36 - 2010-05-07 18:36 - 00921944 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtNetwork4.dll
2010-05-07 18:37 - 2010-05-07 18:37 - 00027480 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2010-05-07 18:37 - 2010-05-07 18:37 - 00126808 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2010-11-12 09:23 - 2010-11-12 09:23 - 00330584 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2010-03-01 10:17 - 2010-03-01 10:17 - 00204800 _____ () C:\Program Files (x86)\Lenovo\Access Connections\acqualcom.dll
2010-03-01 10:15 - 2010-03-01 10:15 - 00094208 _____ () C:\Program Files (x86)\Lenovo\Access Connections\SMSHelper.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Metin2_GameforgeLiveSetup.exe:BDU
AlternateDataStreams: C:\Program Files (x86)\Metin2_GameforgeLiveSetup.exe:BDU
AlternateDataStreams: L:\Benutzer\Lars\Downloads\DJ2050_J510_Basic_x86_231.exe:BDU
AlternateDataStreams: L:\Benutzer\Lars\Downloads\Metin2_GameforgeLiveSetup.exe:BDU
AlternateDataStreams: L:\Benutzer\Lars\Downloads\SetupFASchueler22.exe:BDU
AlternateDataStreams: L:\Benutzer\Lars\Downloads\swexplorer.exe:BDU

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/23/2013 11:07:13 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (11/23/2013 11:07:13 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/23/2013 11:07:13 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/23/2013 09:58:14 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (11/23/2013 09:58:14 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/23/2013 09:58:14 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/23/2013 08:29:03 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (11/23/2013 08:29:03 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/23/2013 08:29:03 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/23/2013 08:10:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: rundll32.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc637
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x02a92230
ID des fehlerhaften Prozesses: 0xfa8
Startzeit der fehlerhaften Anwendung: 0xrundll32.exe0
Pfad der fehlerhaften Anwendung: rundll32.exe1
Pfad des fehlerhaften Moduls: rundll32.exe2
Berichtskennung: rundll32.exe3


System errors:
=============
Error: (11/23/2013 09:52:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LMIGuardianSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/23/2013 09:52:46 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LMIGuardianSvc erreicht.

Error: (11/23/2013 09:51:15 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎23.‎11.‎2013 um 11:44:50 unerwartet heruntergefahren.

Error: (11/23/2013 11:01:04 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LMIGuardianSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/23/2013 11:01:04 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LMIGuardianSvc erreicht.

Error: (11/23/2013 10:59:51 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎23.‎11.‎2013 um 10:32:18 unerwartet heruntergefahren.

Error: (11/23/2013 10:01:55 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (11/23/2013 09:52:05 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LMIGuardianSvc" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (11/23/2013 09:52:05 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LMIGuardianSvc erreicht.

Error: (11/23/2013 09:51:01 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎23.‎11.‎2013 um 09:48:11 unerwartet heruntergefahren.


Microsoft Office Sessions:
=========================
Error: (11/23/2013 11:07:13 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (11/23/2013 11:07:13 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/23/2013 11:07:13 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/23/2013 09:58:14 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (11/23/2013 09:58:14 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/23/2013 09:58:14 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/23/2013 08:29:03 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (11/23/2013 08:29:03 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/23/2013 08:29:03 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/23/2013 08:10:07 PM) (Source: Application Error)(User: )
Description: rundll32.exe6.1.7600.163854a5bc637unknown0.0.0.000000000c000000502a92230fa801cee87f98d41904C:\Windows\SysWOW64\rundll32.exeunknowndd4cb1cd-5472-11e3-89cf-b2f93c7de33f


CodeIntegrity Errors:
===================================
  Date: 2013-11-04 17:38:37.996
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-04 17:06:05.674
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-03 18:40:31.603
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-03 17:23:46.578
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-03 17:10:51.647
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-02 20:42:56.148
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-02 20:32:23.481
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-02 19:11:02.596
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-02 19:01:24.153
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-11-02 18:00:01.930
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\BitDefender\BitDefender 2011\Active Virus Control\Midas_00089_019\midas64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 44%
Total physical RAM: 3956.55 MB
Available physical RAM: 2177.85 MB
Total Pagefile: 7911.29 MB
Available Pagefile: 5887.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:263.9 GB) (Free:180.76 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (STORE N GO) (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT
Drive l: (Lars) (Fixed) (Total:190.92 GB) (Free:133.16 GB) NTFS
Drive q: (Lenovo_Recovery) (Fixed) (Total:9.77 GB) (Free:2.23 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: BE9C27D8)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=264 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=191 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=10 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=2 GB) - (Type=0E)

==================== End Of Log ============================
Beste Grüße

Bootsektor 25.11.2013 01:06
Hallo schak,
genau, weiter gehts. ;)
Schritt 1
Bitte deinstalliere folgende Programme:
  • Ask Toolbar
  • Ask Toolbar Updater

Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Programm auswählen --> entfernen

Hast du nach diesem Fix noch Probleme mit dem Rechner?
Schritt 2
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Startup: L:\Benutzer\Lars\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rzj29j6jw.lnk
ShortcutTarget: rzj29j6jw.lnk -> C:\PROGRA~3\wj6j92jzr.dss (No File)
L:\Benutzer\Lars\AppData\Local\Temp\~tmf6789691553120257873.dll
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM-x32 - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - Plasmoo URL = hxxp://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}
SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - {F2D23918-A637-4C02-9C89-587BA12CE829} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_uid=DF6B39F1-7969-4660-
BFCA-22FE34B41625&apn_sauid=8CE077B7-431F-4882-BD96-D1A698932911
SearchScopes: HKCU - {FD834812-E2BD-4CB0-8E4A-1802DF895B5B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2536373
SearchScopes: HKCU - {F2D23918-A637-4C02-9C89-587BA12CE829} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_uid=DF6B39F1-7969-4660-
CHR HomePage: hxxp://plasmoo.com
CHR RestoreOnStartup: "hxxp://plasmoo.com"

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Schritt 3
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Schritt 4
Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern :kaffee:

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 5
Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

schak 26.11.2013 07:03
Guten Morgen Sandra,

es hat zwar ein wenig gedauert, aber hier sind die Logs:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-11-2013 03
Ran by Lars at 2013-11-24 17:39:58 Run:2
Running from L:\Benutzer\Lars\Desktop\Repair
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Startup: L:\Benutzer\Lars\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rzj29j6jw.lnk
ShortcutTarget: rzj29j6jw.lnk -> C:\PROGRA~3\wj6j92jzr.dss (No File)
L:\Benutzer\Lars\AppData\Local\Temp\~tmf6789691553120257873.dll
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKLM-x32 - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - Plasmoo URL = hxxp://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}
SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - {F2D23918-A637-4C02-9C89-587BA12CE829} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_uid=DF6B39F1-7969-4660-
BFCA-22FE34B41625&apn_sauid=8CE077B7-431F-4882-BD96-D1A698932911
SearchScopes: HKCU - {FD834812-E2BD-4CB0-8E4A-1802DF895B5B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2536373
SearchScopes: HKCU - {F2D23918-A637-4C02-9C89-587BA12CE829} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_uid=DF6B39F1-7969-4660-
CHR HomePage: hxxp://plasmoo.com
CHR RestoreOnStartup: "hxxp://plasmoo.com"
*****************

L:\Benutzer\Lars\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rzj29j6jw.lnk => Moved successfully.
C:\PROGRA~3\wj6j92jzr.dss not found.
Could not move "L:\Benutzer\Lars\AppData\Local\Temp\~tmf6789691553120257873.dll" => Scheduled to move on reboot.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Plasmoo => Key deleted successfully.
HKCR\CLSID\Plasmoo => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} => Key deleted successfully.
HKCR\CLSID\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F2D23918-A637-4C02-9C89-587BA12CE829} => Key deleted successfully.
HKCR\CLSID\{F2D23918-A637-4C02-9C89-587BA12CE829} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FD834812-E2BD-4CB0-8E4A-1802DF895B5B} => Key deleted successfully.
HKCR\CLSID\{FD834812-E2BD-4CB0-8E4A-1802DF895B5B} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F2D23918-A637-4C02-9C89-587BA12CE829} => Key not found.
HKCR\CLSID\{F2D23918-A637-4C02-9C89-587BA12CE829} => Key not found.
CHR HomePage: hxxp://plasmoo.com ==> The Chrome "Settings" can be used to fix the entry.
CHR RestoreOnStartup: "hxxp://plasmoo.com" ==> The Chrome "Settings" can be used to fix the entry.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2013-11-24 17:44:35)<=

"L:\Benutzer\Lars\AppData\Local\Temp\~tmf6789691553120257873.dll" => File could not move.

==== End of Fixlog ====
Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.25.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Lars :: LARSEWENS-THINK [Administrator]

24.11.2013 18:03:18
mbam-log-2013-11-24 (18-03-18).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: Heuristiks/Extra | P2P
Durchsuchte Objekte: 37370
Laufzeit: 8 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
L:\Benutzer\Öffentlich\winamp5581_full_emusic-7plus_en-us.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=d2894216ec05a74ba026287df4f07f59
# engine=16018
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-25 01:41:00
# local_time=2013-11-25 02:41:00 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 1413639 136973510 0 0
# scanned=286328
# found=2
# cleaned=0
# scan_time=29744
sh=F8DFAD227FCBAD7755B35DC03391F6E52F71AD45 ft=1 fh=b8ef3f4daeed224c vn="a variant of Win64/Kryptik.FG trojan" ac=I fn="C:\FRST\Quarantine\rzj29j6jw.pss"
sh=D9C61F07F3DD4B499E1F6C639D3CE7A826F01F3A ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="L:\Benutzer\Lars\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\63aba5c6-6a0ceb20"

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-11-2013 03
Ran by Lars (administrator) on LARSEWENS-THINK on 25-11-2013 06:54:54
Running from L:\Benutzer\Lars\Desktop\Repair
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Bitdefender) C:\Program Files\BitDefender\Bitdefender\vsserv.exe
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
() C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dqscrproj.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(lenovo) C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dqscrproxy.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\LVPrS64H.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe
() C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(QUALCOMM, Inc.) C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\updatesrv.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender Safebox\safeboxservice.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Client Security Solution\cssauth.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dcute.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\bdagent.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\pmbxag.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\antispam32\bdapppassmgr.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Logitech Inc.) C:\Program Files\Logitech\SetPoint II\SetPointII.exe
() C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL2\KHALMNPR.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint II\LU\LuLnchr.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\LWS\LU\LULnchr.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\LWS\LU\LogitechUpdate.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Apple Inc.) C:\Program Files (x86)\Safari\Safari.exe
(Apple Inc.) C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Bitdefender) C:\Program Files\BitDefender\Bitdefender\seccenter.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [380776 2009-12-11] (Lenovo.)
HKLM\...\Run: [AcWin7Hlpr] - C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [36864 2009-10-13] ()
HKLM\...\Run: [cssauth] - C:\Program Files\Lenovo\Client Security Solution\cssauth.exe [5879608 2009-08-26] (Lenovo Group Limited)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2097960 2010-04-22] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo dCute] - C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dcute.exe [686080 2010-02-26] (Lenovo)
HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe [415816 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2093128 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4271688 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.Exe [236544 2008-10-10] (Logitech, Inc.)
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [62312 2010-07-27] (Lenovo Group Limited)
HKLM\...\Run: [Bdagent] - C:\Program Files\BitDefender\Bitdefender\bdagent.exe [1738968 2013-10-23] (Bitdefender)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1820584 2013-10-30] (Valve Corporation)
HKCU\...\Run: [Bitdefender-Geldbörse-Agent] - C:\Program Files\BitDefender\Bitdefender\pmbxag.exe [564256 2013-10-28] (Bitdefender)
HKCU\...\Run: [Bitdefender-Geldbörse] - C:\Program Files\BitDefender\Bitdefender\pwdmanui.exe [1004608 2013-10-23] (Bitdefender)
HKCU\...\Run: [Bitdefender-Geldbörse-Anwendungs-Agent] - C:\Program Files\BitDefender\Bitdefender\antispam32\bdapppassmgr.exe [621448 2013-10-23] (Bitdefender)
MountPoints2: {9258b6fc-c4f4-11df-8710-c80aa9699b50} - E:\Startme.exe
MountPoints2: {c6feec91-4fd5-11df-8e04-806e6f6e6963} - Q:\LenovoQDrive.exe
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [1101672 2010-01-05] (Lenovo Group Limited)
HKLM-x32\...\Run: [Message Center Plus] - C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe [49976 2009-05-27] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2010-07-12] (Nullsoft, Inc.)
HKLM-x32\...\Run: [LWS] - C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [165208 2010-05-07] (Logitech Inc.)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [273544 2011-02-25] (RealNetworks, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2349392 2013-10-31] (LogMeIn Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-03] (Adobe Systems Incorporated)
HKU\TEMP\...\RunOnce: [wlstart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-08-20] (Microsoft Corporation)
HKU\TEMP\...\RunOnce: [] - [x]
HKU\TEMP\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
Lsa: [Notification Packages] scecli ACGina

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM-x32 - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
URLSearchHook: HKLM-x32 - Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
URLSearchHook: HKLM-x32 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
URLSearchHook: HKLM-x32 - (No Name) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - No File
URLSearchHook: HKCU - Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
URLSearchHook: HKCU - (No Name) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {4D8BCBCF-4540-43F7-9E8C-EB9E79B28834} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {4D8BCBCF-4540-43F7-9E8C-EB9E79B28834} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {AFC2BF4F-5C2A-4FB0-93FA-F7AB7A69A795} URL =
BHO: Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\BitDefender\Bitdefender\pmbxie.dll (Bitdefender)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\BitDefender\Bitdefender\antispam32\pmbxie.dll (Bitdefender)
BHO-x32: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
BHO-x32: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: IePasswordManagerHelper Class - {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} - C:\Program Files (x86)\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
Toolbar: HKLM-x32 - No Name - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - No Name - {e36df325-3f4b-476f-8f89-123bc5d51a30} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} -  No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {E36DF325-3F4B-476F-8F89-123BC5D51A30} -  No File
DPF: HKLM-x32 {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cab
DPF: HKLM-x32 {A6616B31-4860-41E2-98E3-CA7649AF172F} file:///D:/launch.ocx
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://plasmoo.com
CHR RestoreOnStartup: "hxxp://plasmoo.com"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Extension: (Bitdefender Wallet) - L:\Benutzer\Lars\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccahoghmggldkcdjiebjkidpfongdfbl\17.19.0_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - L:\Benutzer\Lars\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3
CHR Extension: (Skype Extension) - L:\Benutzer\Lars\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0
CHR HKLM-x32\...\Chrome\Extension: [ccahoghmggldkcdjiebjkidpfongdfbl] - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxcr.crx
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [nmpllndkedbnmonoomepeeglghdelffo] - C:\Program Files (x86)\icq\Chrome\icq-1.0.601.crx

==================== Services (Whitelisted) =================

S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe [77120 2013-10-15] (Bitdefender)
S2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377104 2013-10-11] (LogMeIn, Inc.)
R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-06-02] (Symantec Corporation)
R2 OMSI download service; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [90112 2009-04-30] ()
R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [126392 2011-11-07] (Symantec Corporation)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-10-01] ()
R2 QDLService2kLenovo; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe [331512 2010-02-05] (QUALCOMM, Inc.)
R2 SafeBox; C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe [94624 2013-07-08] (Bitdefender)
R2 ScrProj; C:\Program Files\Lenovo\ThinkPad USB Port Replicator with Digital Video\dqscrproj.exe [88576 2010-02-26] ()
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22888 2013-09-17] ()
R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1019904 2009-08-28] (Lenovo Group Limited)
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1475896 2010-07-06] (Lenovo Group Limited)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [67320 2013-10-07] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender\vsserv.exe [1506736 2013-10-23] (Bitdefender)

==================== Drivers (Whitelisted) ====================

R0 ALvldr; C:\Windows\System32\DRIVERS\ALvldr.sys [28736 2010-02-26] (Lenovo Soft Corporation(32))
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-07-19] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-07-19] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-02-22] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-07-23] (BitDefender SRL)
R1 Bdvedisk; C:\Windows\System32\DRIVERS\bdvedisk.sys [76944 2012-04-17] (BitDefender)
R1 dqBridge; C:\Windows\System32\DRIVERS\dqbridge.sys [57408 2010-02-26] ()
S3 dqusb; C:\Windows\System32\DRIVERS\dqusb.sys [29688 2009-08-06] (Lenovo)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
R3 lvlddrv; C:\Windows\System32\DRIVERS\lvlddrv.sys [94784 2010-02-26] (Lenovo Soft Corporation(32))
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 qcfilterlno2k; C:\Windows\System32\DRIVERS\qcfilterlno2k.sys [6400 2010-02-05] (QUALCOMM Incorporated)
R3 qcusbnetlno2k; C:\Windows\System32\DRIVERS\qcusbnetlno2k.sys [241664 2010-02-05] (QUALCOMM Incorporated)
R3 qcusbserlno2k; C:\Windows\System32\DRIVERS\qcusbserlno2k.sys [121600 2010-02-05] (QUALCOMM Incorporated)
S3 s1029bus; C:\Windows\System32\DRIVERS\s1029bus.sys [116264 2009-05-25] (MCCI Corporation)
S3 s1029mdfl; C:\Windows\System32\DRIVERS\s1029mdfl.sys [19496 2009-05-25] (MCCI Corporation)
S3 s1029mdm; C:\Windows\System32\DRIVERS\s1029mdm.sys [158760 2009-05-25] (MCCI Corporation)
S3 s1029mgmt; C:\Windows\System32\DRIVERS\s1029mgmt.sys [139304 2009-05-25] (MCCI Corporation)
S3 s1029nd5; C:\Windows\System32\DRIVERS\s1029nd5.sys [34856 2009-05-25] (MCCI Corporation)
S3 s1029obex; C:\Windows\System32\DRIVERS\s1029obex.sys [135208 2009-05-25] (MCCI Corporation)
S3 s1029unic; C:\Windows\System32\DRIVERS\s1029unic.sys [151592 2009-05-25] (MCCI Corporation)
R1 TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [13104 2010-01-05] ()
R0 Trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-08-07] (BitDefender S.R.L.)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [12728 2009-09-29] ()
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 PCDSRVC{127174DC-C366ED8B-06000000}_0; \??\c:\program files\pc-doctor\pcdsrvc_x64.pkms [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-24 18:20 - 2013-11-24 18:20 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-24 17:52 - 2013-11-24 17:52 - 00000000 ____D L:\Benutzer\Lars\AppData\Roaming\Malwarebytes
2013-11-24 17:51 - 2013-11-24 17:51 - 00000994 _____ L:\Benutzer\Öffentlich\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-24 17:51 - 2013-11-24 17:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-24 17:51 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-24 17:36 - 2013-11-25 06:54 - 00000000 ____D L:\Benutzer\Lars\Desktop\Repair
2013-11-23 19:57 - 2013-11-23 19:57 - 00003224 ____N C:\bootsqm.dat
2013-11-23 18:15 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-23 18:15 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-23 18:15 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-23 18:15 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-23 18:15 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-23 18:15 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-23 18:15 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-23 18:15 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-23 18:15 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-23 18:15 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-23 18:15 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-23 18:15 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-23 18:14 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-23 18:00 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-23 18:00 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-23 18:00 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-23 18:00 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-23 18:00 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-23 18:00 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-23 18:00 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-23 18:00 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-23 18:00 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-23 17:59 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-23 17:59 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-23 17:59 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-23 17:59 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-23 17:59 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-23 17:59 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-23 17:59 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-23 17:59 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-23 17:59 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-23 17:59 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-23 17:59 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-23 17:59 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-23 17:59 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-23 17:59 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-23 17:59 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-23 17:59 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-23 17:59 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-23 17:59 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-23 17:59 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-23 17:59 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-23 17:59 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-23 09:50 - 2013-11-24 18:14 - 00001144 _____ C:\Windows\PFRO.log
2013-11-23 08:40 - 2013-11-23 09:58 - 00000134 _____ L:\Benutzer\Lars\Desktop\Internet Explorer Troubleshooting.url
2013-11-23 08:39 - 2013-11-23 22:50 - 00018270 _____ C:\Windows\IE11_main.log
2013-11-23 08:26 - 2013-11-23 08:26 - 00001896 _____ L:\Benutzer\Öffentlich\Desktop\Adobe Reader X.lnk
2013-11-23 08:26 - 2013-11-23 08:26 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-23 06:03 - 2013-11-24 17:44 - 00000000 ____D C:\FRST
2013-11-08 19:02 - 2013-11-23 18:22 - 00003216 _____ C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3112642421-3913958396-2466649522-1007
2013-11-08 18:18 - 2013-11-08 18:18 - 00002069 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Safepay.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00001960 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Total Security.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00000684 ____H C:\bdr-cf01
2013-11-08 18:18 - 2013-11-08 18:18 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-11-08 18:17 - 2013-07-23 15:50 - 00082824 _____ (BitDefender SRL) C:\Windows\system32\Drivers\bdsandbox.sys
2013-11-08 18:17 - 2013-07-19 17:08 - 00601360 _____ (BitDefender) C:\Windows\system32\Drivers\avckf.sys
2013-11-08 18:17 - 2013-07-19 17:04 - 00727592 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys
2013-11-08 18:17 - 2013-02-22 18:46 - 00093600 _____ (BitDefender LLC) C:\Windows\system32\Drivers\BdfNdisf6.sys
2013-11-08 18:17 - 2012-11-02 13:17 - 00261056 _____ (BitDefender) C:\Windows\system32\Drivers\avchv.sys
2013-11-08 18:17 - 2012-04-17 13:34 - 00076944 _____ (BitDefender) C:\Windows\system32\Drivers\bdvedisk.sys
2013-11-08 18:17 - 2007-04-11 10:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2013-11-08 18:09 - 2013-11-08 18:18 - 00253404 ____H C:\bdr-ld01
2013-11-08 18:09 - 2013-11-08 18:18 - 00009216 ____H C:\bdr-ld01.mbr
2013-11-08 18:09 - 2013-09-24 15:38 - 46879860 ____H C:\bdr-im01.gz
2013-11-08 18:09 - 2013-08-13 12:38 - 03271472 ____H C:\bdr-bz01
2013-11-08 18:03 - 2013-08-23 12:48 - 00150256 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2013-11-08 18:03 - 2013-08-07 12:46 - 00389240 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2013-11-08 17:57 - 2013-11-08 18:00 - 00000000 _____ C:\Windows\system32\獷楬汢捯污
2013-11-04 16:53 - 2013-11-04 16:53 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-02 20:07 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-11-02 20:07 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-11-02 20:04 - 2013-11-02 20:04 - 00004865 _____ C:\WirelessDiagLog.csv
2013-11-02 19:12 - 2013-11-02 19:12 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\Tvsukernel
2013-11-02 19:12 - 2012-01-14 05:41 - 00068864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2013-11-02 19:10 - 2013-11-02 19:10 - 00000030 _____ C:\Windows\success32.log
2013-11-02 19:09 - 2013-11-02 19:09 - 00000030 _____ C:\Windows\success64.log
2013-10-28 21:40 - 2013-06-23 15:56 - 00002357 _____ L:\Benutzer\Lars\Desktop\Skype.lnk

==================== One Month Modified Files and Folders =======

2013-11-25 06:54 - 2013-11-24 17:36 - 00000000 ____D L:\Benutzer\Lars\Desktop\Repair
2013-11-25 06:31 - 2010-04-24 20:19 - 01390835 _____ C:\Windows\WindowsUpdate.log
2013-11-24 18:22 - 2009-07-14 05:45 - 00020704 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-24 18:22 - 2009-07-14 05:45 - 00020704 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-24 18:21 - 2010-04-25 06:09 - 04148706 _____ C:\Windows\system32\perfh007.dat
2013-11-24 18:21 - 2010-04-25 06:09 - 01263002 _____ C:\Windows\system32\perfc007.dat
2013-11-24 18:21 - 2009-07-14 06:13 - 00006264 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-24 18:20 - 2013-11-24 18:20 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-24 18:15 - 2010-12-02 17:15 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\LogMeIn Hamachi
2013-11-24 18:15 - 2010-07-25 16:03 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-24 18:14 - 2013-11-23 09:50 - 00001144 _____ C:\Windows\PFRO.log
2013-11-24 18:14 - 2013-10-22 19:08 - 00007366 _____ C:\Windows\setupact.log
2013-11-24 18:14 - 2010-12-10 21:13 - 00000000 ____D C:\Windows\SysWOW64\logishrd
2013-11-24 18:14 - 2010-12-10 21:13 - 00000000 ____D C:\Windows\system32\logishrd
2013-11-24 18:14 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-24 18:12 - 2010-07-25 15:13 - 00000000 ___RD L:\Benutzer\Öffentlich
2013-11-24 17:52 - 2013-11-24 17:52 - 00000000 ____D L:\Benutzer\Lars\AppData\Roaming\Malwarebytes
2013-11-24 17:51 - 2013-11-24 17:51 - 00000994 _____ L:\Benutzer\Öffentlich\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-24 17:51 - 2013-11-24 17:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-24 17:44 - 2013-11-23 06:03 - 00000000 ____D C:\FRST
2013-11-24 17:39 - 2010-07-25 15:19 - 00000000 ___RD L:\Benutzer\Lars\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 22:50 - 2013-11-23 08:39 - 00018270 _____ C:\Windows\IE11_main.log
2013-11-23 20:23 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-23 19:57 - 2013-11-23 19:57 - 00003224 ____N C:\bootsqm.dat
2013-11-23 18:29 - 2011-02-25 20:06 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-23 18:23 - 2010-11-10 22:45 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{729EE656-F272-42D3-AAC6-5756CB503C55}
2013-11-23 18:22 - 2013-11-08 19:02 - 00003216 _____ C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3112642421-3913958396-2466649522-1007
2013-11-23 18:20 - 2011-02-25 20:06 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-23 18:20 - 2009-07-24 18:29 - 00000000 ____D C:\Windows\Panther
2013-11-23 18:13 - 2013-08-15 13:32 - 00000000 ____D C:\Windows\system32\MRT
2013-11-23 18:10 - 2010-07-07 20:50 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-23 17:44 - 2012-10-24 21:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-23 09:58 - 2013-11-23 08:40 - 00000134 _____ L:\Benutzer\Lars\Desktop\Internet Explorer Troubleshooting.url
2013-11-23 08:26 - 2013-11-23 08:26 - 00001896 _____ L:\Benutzer\Öffentlich\Desktop\Adobe Reader X.lnk
2013-11-23 08:26 - 2013-11-23 08:26 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-11-12 14:34 - 2010-07-25 16:30 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\Adobe
2013-11-12 14:33 - 2012-10-24 21:20 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-12 14:33 - 2012-10-24 21:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-12 14:33 - 2011-06-08 18:42 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-08 21:00 - 2010-04-24 20:55 - 00000340 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-11-08 18:19 - 2010-11-08 17:48 - 00000000 ____D L:\Benutzer\Lars\AppData\Roaming\BitDefender
2013-11-08 18:18 - 2013-11-08 18:18 - 00002069 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Safepay.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00001960 _____ L:\Benutzer\Öffentlich\Desktop\Bitdefender Total Security.lnk
2013-11-08 18:18 - 2013-11-08 18:18 - 00000684 ____H C:\bdr-cf01
2013-11-08 18:18 - 2013-11-08 18:18 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-11-08 18:18 - 2013-11-08 18:09 - 00253404 ____H C:\bdr-ld01
2013-11-08 18:18 - 2013-11-08 18:09 - 00009216 ____H C:\bdr-ld01.mbr
2013-11-08 18:09 - 2010-11-08 17:47 - 00000000 ____D C:\Program Files\BitDefender
2013-11-08 18:00 - 2013-11-08 17:57 - 00000000 _____ C:\Windows\system32\獷楬汢捯污
2013-11-04 16:53 - 2013-11-04 16:53 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2013-11-03 18:40 - 2010-11-26 19:59 - 00000376 _____ L:\Benutzer\Lars\AppData\Roamingprivacy.xml
2013-11-02 20:04 - 2013-11-02 20:04 - 00004865 _____ C:\WirelessDiagLog.csv
2013-11-02 19:12 - 2013-11-02 19:12 - 00000000 ____D L:\Benutzer\Lars\AppData\Local\Tvsukernel
2013-11-02 19:10 - 2013-11-02 19:10 - 00000030 _____ C:\Windows\success32.log
2013-11-02 19:10 - 2010-04-24 20:59 - 00000000 ____D C:\Program Files\Common Files\Lenovo
2013-11-02 19:10 - 2010-04-24 20:26 - 00000000 ____D C:\Program Files\Lenovo
2013-11-02 19:09 - 2013-11-02 19:09 - 00000030 _____ C:\Windows\success64.log
2013-10-29 18:37 - 2010-08-31 18:23 - 00000000 ____D L:\Benutzer\Lars\AppData\Roaming\TS3Client

Files to move or delete:
====================
L:\Benutzer\Öffentlich\ts2_client_rc2_2032.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-01 13:25

==================== End Of Log ============================
--- --- ---

--- --- ---


So, jetzt müsste alles da sein. Ich bin gespannt, wie es weiter geht!

Beste Grüße

Bootsektor 27.11.2013 14:07
Hallo schak,
Zitat:
Ich bin gespannt, wie es weiter geht!
wir müssen jetzt noch die Startseite deines Chromebrowsers zurücksetzen und den Fund von ESET löschen
Schritt 1
Bitte setze deinen Chromebrowser nach dieser Anleitung zurück

Schritt 2
Leere nach dieser Anleitung deinen Java Cache.

Schritt 3
Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
  • Öffne die TFC.exe.
    Vista und Win 7 User mit Rechtsklick "als Administrator starten".
  • Schließe alle anderen Programme.
  • Drücke auf den Button Start.
  • Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.




OK
So wie ich es sehe, haben wir damit alles Schadhafte entfernt. Deine Logs sind sauber.
Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir.

Schritt 1
Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren.
Ich empfehle Dir aber zumindest Malwarebytes zu behalten, und damit einmal die Woche einen Kontrollscan zu machen.

Schritt 2
Downloade dir bitte delfix auf deinen Desktop.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.
  • DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.

Updates / Programme aktualisieren
  • Internetexplorer
    Dein InternetExplorer ist nicht mehr aktuell. Besuche diese Microsoftseite und lade dir von dort den neuesten Internetexplorer für dein Betriebssystem herunter
  • FlashPlayer
Dein FlashPlayer für den Firefox ist nicht mehr aktuell, deinstalliere die alten Versionen. öffne mit dem Firefox folgenden Link Adobe - Adobe Flash Player installieren und lade Dir von dort die neueste Version herunter. Entferne den Haken bei McAfee Security Plus
Aktualisierung einstellen
Stelle sicher, dass dein FlashPlayer nach Updates sucht. Den FlashPlayer kann man entweder direkt bei der Installation so konfigurieren, dass er nach Updates automatisch sucht, nachträglich kann man das über folgenden Link machen:
Adobe - Flash Player: Einstellungsmanager - Globale Benachrichtigungseinstellungen
  • Java
Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 45 ) herunter laden.
  • Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
  • Klicke erneut OK.

Java kann man einstellen, dass es nach Updates sucht, dazu:
  • öffne Java
  • klicke auf den Reiter Update
  • klicke auf: Benachrichtung ausgeben: Vor dem Download setze den Haken bei Automatisch nach Updates suchen
  • klicke auf Erweitert
  • ändere das Intervall mindestens auf wöchentlich

Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems.

Aktualität des Systems
Es ist extrem wichtig, dass sowohl dein System als auch die darauf installierte sicherheitsrelevante Software (Flash Player, PDF-Reader und besonders Java) aktuell sind.
  • Bitte überprüfe, ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.

Antivirensoftware
  • Gehe sicher immer eine Antiviren Software installiert zu haben und halte diese unbedingt aktuell.

Zusätzlicher Schutz
  • MalwareBytes Anti-Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On-Demand Scantool welches viele aktuelle Malware erkennt und auch entfernt.
    Aktualisiere das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der Internet Explorer, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf einen Banner um diesen zu AdBlockPlus hinzuzufügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Systemleistung
Lösche regelmäßig deine temporären Dateien. Ich empfehle hierzu TFC
Halte dich fern von jeglichen Registry Cleanern.
Diese schaden deinem System mehr als dass sie es schneller machen.

Verhaltensregeln zum sichereren Surfen
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Falls Du Lob oder Kritik abgeben möchtest, kannst Du das sehr gerne hier tun.

Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun.


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:18 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19