confus13 | 11.12.2013 18:14 | Der TFC bleibt laufend stehen bei Stopping running Processes. Hab jatzt schon ein paarmal probiert.
An anderer Stelle hier im Board wurde geschrieben, das der CCleaner auch geht. Ist das Ok??
Ok, es ist jetzt gegangen. Das Malewarebytes Programm scheint es geblockt zu haben.
Sorry, aber ich habe da noch ein anderes Problem. Ich habe den Laptop nur noch bis spätestens Freitag Früh. Der Besitzer zieht nämlich am Wochenende weg. Versteh mich bitte nicht falsch. Ich will hier wirklich nicht drängeln. Zumal ihr das ja alles ehrenamtlich macht, verdient das meine größte Hochachtung. Aber ich hätte auch nicht gedacht, das das ganze sich so hin zieht. Kriegen wir das hin???
Hier die beiden txt Dateien: Code:
Farbar Service Scanner Version: 05-12-2013
Ran by Administrator (administrator) on 11-12-2013 at 17:53:04
Running from "C:\Dokumente und Einstellungen\Administrator\Desktop"
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Security Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Other Services:
==============
Checking Start type of PolicyAgent: ATTENTION!=====> Unable to open PolicyAgent registry key. The service key does not exist.
Checking ImagePath of PolicyAgent: ATTENTION!=====> Unable to open PolicyAgent registry key. The service key does not exist.
Checking Start type of RemoteAccess: ATTENTION!=====> Unable to open RemoteAccess registry key. The service key does not exist.
Checking ImagePath of RemoteAccess: ATTENTION!=====> Unable to open RemoteAccess registry key. The service key does not exist.
Checking ServiceDll of RemoteAccess: ATTENTION!=====> Unable to open RemoteAccess registry key. The service key does not exist.
File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0127488 ____A (Microsoft Corporation) C29A1C9B75BA38FA37F8C44405DEC360
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll
[2008-04-14 04:00] - [2009-04-20 18:17] - 0045568 ____A (Microsoft Corporation) 407F3227AC618FD1CA54B335B083DE07
C:\WINDOWS\system32\ipnathlp.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0334336 ____A (Microsoft Corporation) CAD058D5F8B889A87CA3EB3CF624DCEF
C:\WINDOWS\system32\netman.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0198144 ____A (Microsoft Corporation) E6D88F1F6745BF00B57E7855A2AB696C
C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0145408 ____A (Microsoft Corporation) 6F3F3973D97714CC5F906A19FE883729
C:\WINDOWS\system32\srsvc.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0171520 ____A (Microsoft Corporation) FE77A85495065F3AD59C5C65B6C54182
C:\WINDOWS\system32\Drivers\sr.sys
[2008-04-14 04:00] - [2008-04-14 04:00] - 0073472 ____A (Microsoft Corporation) 50FA898F8C032796D3B1B9951BB5A90F
C:\WINDOWS\system32\wscsvc.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0080896 ____A (Microsoft Corporation) 300B3E84FAF1A5C1F791C159BA28035D
C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0145408 ____A (Microsoft Corporation) 6F3F3973D97714CC5F906A19FE883729
C:\WINDOWS\system32\wuauserv.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0006656 ____A (Microsoft Corporation) 7B4FE05202AA6BF9F4DFD0E6A0D8A085
C:\WINDOWS\system32\qmgr.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0409088 ____A (Microsoft Corporation) D6F603772A789BB3228F310D650B8BD1
C:\WINDOWS\system32\es.dll
[2008-04-14 04:00] - [2008-07-07 21:26] - 0253952 ____A (Microsoft Corporation) AF4F6B5739D18CA7972AB53E091CBC74
C:\WINDOWS\system32\cryptsvc.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0062464 ____A (Microsoft Corporation) 611F824E5C703A5A899F84C5F1699E4D
C:\WINDOWS\system32\svchost.exe
[2008-04-14 04:00] - [2008-04-14 04:00] - 0014336 ____A (Microsoft Corporation) 4FBC75B74479C7A6F829E0CA19DF3366
C:\WINDOWS\system32\rpcss.dll
[2008-04-14 04:00] - [2009-02-09 11:51] - 0401408 ____A (Microsoft Corporation) 3127AFBF2C1ED0AB14A1BBB7AAECB85B
C:\WINDOWS\system32\services.exe
[2008-04-14 04:00] - [2009-02-09 12:21] - 0111104 ____A (Microsoft Corporation) A3EDBE9053889FB24AB22492472B39DC
Extra List:
=======
bdftdif(10) Gpc(6) IPSec(4) NetBT(5) PSched(7) RFCOMM(9) Tcpip(3) tcpipBM(11)
0x0800000004000000030000000B0000000A00000005000000060000000700000009000000
IpSec Tag value is correct.
**** End of log ****
FRST Logfile:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-12-2013 01
Ran by Administrator (administrator) on ACER-0A4B429EFB on 11-12-2013 17:54:06
Running from C:\Dokumente und Einstellungen\Administrator\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Broadcom Corporation.) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(Bytemobile, Inc.) C:\WINDOWS\system32\bmwebcfg.exe
(NewTech Infosystems, Inc.) C:\Programme\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
(Intel Corporation) C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(InterVideo) C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe
(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Dritek System Inc.) C:\Programme\Launch Manager\LManager.exe
(Google Inc.) C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Malwarebytes Corporation) C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Intel Corporation) C:\WINDOWS\system32\igfxext.exe
(NewTech InfoSystems, Inc.) C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
() C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(O2Micro International) C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe
(Protexis Inc.) C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Programme\Windows Media Player\wmpnetwk.exe
(Vodafone) C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\WINDOWS\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [LManager] - C:\Programme\Launch Manager\LManager.exe [870920 2008-06-09] (Dritek System Inc.)
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKCU\...\Run: [AS2014] - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\X7pDn3Xg\X7pDn3Xg.exe
HKCU\...\Run: [swg] - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-03-10] (Google Inc.)
MountPoints2: F - F:\Run.exe
MountPoints2: {376282e8-8851-11de-8a27-0017c4481bab} - G:\setup.exe
MountPoints2: {3d14db56-2ebf-11df-8b39-0017c4481bab} - G:\setup.exe
MountPoints2: {8e7f9ea6-293e-11df-8b2b-0017c4481bab} - G:\setup.exe
MountPoints2: {8e7f9ea7-293e-11df-8b2b-0017c4481bab} - G:\setup.exe
MountPoints2: {d6726318-4c60-11dd-a4a1-806d6172696f} - E:\setup.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://wetterstationen.meteomedia.de/?map=Sachsen&station=104990
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - No Name - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
Toolbar: HKLM - No Name - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1239184067734
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchKeyword: google.de
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR Plugin: (Shockwave Flash) - C:\Programme\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Programme\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Programme\Google\Chrome\Application\31.0.1650.57\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Programme\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U13) - C:\Programme\Java\jre6\bin\new_plugin\npdeploytk.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U13) - C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft\u00AE DRM) - C:\Programme\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Programme\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft\u00AE DRM) - C:\Programme\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Presentation Foundation) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (YouTube) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Chrome In-App Payments service) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
========================== Services (Whitelisted) =================
R2 bmwebcfg; C:\WINDOWS\system32\bmwebcfg.exe [118784 2007-04-03] (Bytemobile, Inc.)
R2 btwdins; C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe [273256 2007-04-01] (Broadcom Corporation.)
R2 BUNAgentSvc; C:\Programme\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384 2008-03-03] (NewTech Infosystems, Inc.)
S3 FSORSPClient; C:\Programme\F-Secure\ORSP Client\fsorsp.exe [61088 2012-03-28] (F-Secure Corporation)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2013-03-10] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2013-03-10] (Google Inc.)
S3 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2013-03-10] (Google)
R2 IAANTMON; C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe [354840 2008-05-07] (Intel Corporation)
R2 IviRegMgr; C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe [112152 2007-01-04] (InterVideo)
R2 LightScribeService; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company)
R2 MBAMScheduler; C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NTIBackupSvc; C:\Programme\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [50424 2008-04-06] (NewTech InfoSystems, Inc.)
R2 NTISchedulerSvc; C:\Programme\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] ()
R2 o2flash; C:\Programme\O2Micro Flash Memory Card Driver\o2flash.exe [65536 2007-02-13] (O2Micro International)
S3 odserv; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [440696 2011-07-20] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [145184 2006-10-26] (Microsoft Corporation)
R2 PSI_SVC_2; C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe [185632 2007-07-24] (Protexis Inc.)
S3 SQLWriter; C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe [87840 2006-04-14] (Microsoft Corporation)
R2 VMCService; C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [14336 2008-07-04] (Vodafone)
R2 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
R2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf"
S2 LIVESRV; "C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Update Service\livesrv.exe" /service [x]
S3 scan; C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\scan.dll [x]
S2 VSSERV; "C:\Programme\BitDefender\BitDefender 2009\vsserv.exe" /service [x]
==================== Drivers (Whitelisted) ====================
R0 abp480n5; C:\Windows\System32\DRIVERS\ABP480N5.SYS [23552 2001-08-17] (Microsoft Corporation)
R3 AR5416; C:\Windows\System32\DRIVERS\athw.sys [1343616 2008-11-05] (Atheros Communications, Inc.)
R3 btaudio; C:\Windows\System32\drivers\btaudio.sys [539072 2007-03-23] (Broadcom Corporation.)
R3 BTDriver; C:\Windows\System32\DRIVERS\btport.sys [37424 2007-03-23] (Broadcom Corporation.)
R3 BTKRNL; C:\Windows\System32\DRIVERS\btkrnl.sys [876384 2007-03-31] (Broadcom Corporation.)
S3 BTWDNDIS; C:\Windows\System32\DRIVERS\btwdndis.sys [149123 2007-03-23] (Broadcom Corporation.)
S3 btwhid; C:\Windows\System32\DRIVERS\btwhid.sys [55352 2007-03-31] (Broadcom Corporation.)
S3 BTWUSB; C:\Windows\System32\Drivers\btwusb.sys [67960 2007-03-23] (Broadcom Corporation.)
S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
R3 HSFHWAZL; C:\Windows\System32\DRIVERS\HSFHWAZL.sys [210688 2007-03-01] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\Windows\System32\DRIVERS\HSF_DPV.sys [988032 2007-03-01] (Conexant Systems, Inc.)
R3 Iviaspi; C:\Windows\System32\drivers\iviaspi.sys [10368 2005-09-21] (InterVideo, Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
S3 bdfm; system32\drivers\bdfm.sys [x]
S3 bdfsfltr; system32\drivers\bdfsfltr.sys [x]
S1 bdftdif; \??\C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Firewall\bdftdif.sys [x]
S3 BDSelfPr; \??\C:\Programme\BitDefender\BitDefender 2009\bdselfpr.sys [x]
S1 GLogin; No ImagePath
S3 massfilter; system32\drivers\massfilter.sys [x]
S3 Profos; \??\C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\profos.sys [x]
S3 Trufos; \??\C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\trufos.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-11 17:53 - 2013-12-11 17:53 - 00004380 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\FSS.txt
2013-12-11 17:53 - 2013-12-11 17:53 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Desktop\FRST-OlderVersion
2013-12-11 17:52 - 2013-12-11 17:52 - 00708597 _____ (Farbar) C:\Dokumente und Einstellungen\Administrator\Desktop\FSS.exe
2013-12-11 17:49 - 2013-12-11 17:49 - 00000000 ____D C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Vodafone
2013-12-11 17:45 - 2013-12-11 17:45 - 00003758 _____ C:\WINDOWS\bitssetup.log
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü\Programme\Zubehör
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü\Programme
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü
2013-12-11 17:30 - 2013-12-11 17:46 - 00181064 _____ (Sysinternals) C:\WINDOWS\PSEXESVC.EXE
2013-12-11 17:14 - 2013-12-11 17:14 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Desktop\tweaking.com_windows_repair_aio
2013-12-11 13:40 - 2013-12-11 13:37 - 00448512 _____ (OldTimer Tools) C:\Dokumente und Einstellungen\Administrator\Desktop\TFC.exe
2013-12-11 13:40 - 2013-12-11 13:36 - 02804572 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\tweaking.com_windows_repair_aio.zip
2013-12-10 16:28 - 2013-12-11 17:54 - 00014446 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\FRST.txt
2013-12-10 16:27 - 2013-12-11 17:53 - 01061389 _____ (Farbar) C:\Dokumente und Einstellungen\Administrator\Desktop\FRST.exe
2013-12-10 16:23 - 2013-12-10 16:23 - 00891184 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\SecurityCheck.exe
2013-12-10 12:43 - 2013-12-10 12:43 - 00000000 ____D C:\Programme\ESET
2013-12-09 19:44 - 2013-12-09 19:44 - 00000454 _____ C:\WINDOWS\nsw.log
2013-12-09 18:14 - 2013-12-09 18:14 - 00000905 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\JRT.txt
2013-12-09 18:01 - 2013-12-09 18:01 - 00000000 ____D C:\WINDOWS\ERUNT
2013-12-09 17:50 - 2013-12-09 17:54 - 00000000 ____D C:\AdwCleaner
2013-12-09 17:24 - 2013-12-09 17:26 - 00000760 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-12-09 17:24 - 2013-12-09 17:26 - 00000000 ____D C:\Programme\Malwarebytes' Anti-Malware
2013-12-09 17:24 - 2013-12-09 17:26 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
2013-12-09 17:24 - 2013-12-09 17:24 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2013-12-09 17:24 - 2013-12-09 17:24 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2013-12-09 17:24 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-12-09 17:22 - 2013-12-09 17:22 - 00315388 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Administrator\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-07 00:25 - 2013-12-11 17:53 - 00000000 ____D C:\FRST
2013-12-06 21:00 - 2013-12-06 21:00 - 00087324 _____ C:\OTL.Txt
2013-12-06 21:00 - 2013-12-06 21:00 - 00026636 _____ C:\Extras.Txt
2013-12-05 18:46 - 2013-12-05 18:46 - 00210944 _____ C:\WINDOWS\system32\bootacls.dll
2013-12-05 18:46 - 2013-12-05 18:46 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Antivirus Security Pro
==================== One Month Modified Files and Folders =======
2013-12-11 17:54 - 2013-12-10 16:28 - 00014446 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\FRST.txt
2013-12-11 17:53 - 2013-12-11 17:53 - 00004380 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\FSS.txt
2013-12-11 17:53 - 2013-12-11 17:53 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Desktop\FRST-OlderVersion
2013-12-11 17:53 - 2013-12-10 16:27 - 01061389 _____ (Farbar) C:\Dokumente und Einstellungen\Administrator\Desktop\FRST.exe
2013-12-11 17:53 - 2013-12-07 00:25 - 00000000 ____D C:\FRST
2013-12-11 17:52 - 2013-12-11 17:52 - 00708597 _____ (Farbar) C:\Dokumente und Einstellungen\Administrator\Desktop\FSS.exe
2013-12-11 17:49 - 2013-12-11 17:49 - 00000000 ____D C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Vodafone
2013-12-11 17:49 - 2008-09-04 21:59 - 01626060 _____ C:\WINDOWS\WindowsUpdate.log
2013-12-11 17:49 - 2008-09-04 21:59 - 00001158 _____ C:\WINDOWS\system32\wpa.dbl
2013-12-11 17:49 - 2008-09-04 21:50 - 01081368 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-12-11 17:48 - 2013-03-10 15:13 - 00001104 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-11 17:48 - 2013-03-10 15:13 - 00001100 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-11 17:48 - 2008-09-04 21:59 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-12-11 17:48 - 2008-09-04 21:59 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-12-11 17:48 - 2008-09-04 21:59 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-12-11 17:48 - 2008-09-04 21:46 - 00000147 _____ C:\WINDOWS\system32\agent.log
2013-12-11 17:47 - 2008-09-04 21:46 - 00339440 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-12-11 17:46 - 2013-12-11 17:30 - 00181064 _____ (Sysinternals) C:\WINDOWS\PSEXESVC.EXE
2013-12-11 17:46 - 2009-04-08 08:27 - 00000012 _____ C:\WINDOWS\bthservsdp.dat
2013-12-11 17:46 - 2008-09-04 21:59 - 00032508 _____ C:\WINDOWS\SchedLgU.Txt
2013-12-11 17:46 - 2008-09-04 21:59 - 00000190 ___SH C:\Dokumente und Einstellungen\Administrator\ntuser.ini
2013-12-11 17:45 - 2013-12-11 17:45 - 00003758 _____ C:\WINDOWS\bitssetup.log
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü\Programme\Zubehör
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü\Programme
2013-12-11 17:44 - 2013-12-11 17:44 - 00000000 ____D C:\Dokumente und Einstellungen\LocalService\Startmenü
2013-12-11 17:44 - 2008-09-04 19:45 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService
2013-12-11 17:44 - 2008-07-07 19:21 - 00023392 _____ C:\WINDOWS\system32\nscompat.tlb
2013-12-11 17:44 - 2008-07-07 19:21 - 00016832 _____ C:\WINDOWS\system32\amcompat.tlb
2013-12-11 17:32 - 2013-03-10 15:12 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-12-11 17:32 - 2013-03-10 15:12 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-12-11 17:32 - 2013-03-10 15:12 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-12-11 17:30 - 2012-08-18 05:32 - 01600011 _____ C:\WINDOWS\setupapi.log
2013-12-11 17:14 - 2013-12-11 17:14 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Desktop\tweaking.com_windows_repair_aio
2013-12-11 13:37 - 2013-12-11 13:40 - 00448512 _____ (OldTimer Tools) C:\Dokumente und Einstellungen\Administrator\Desktop\TFC.exe
2013-12-11 13:36 - 2013-12-11 13:40 - 02804572 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\tweaking.com_windows_repair_aio.zip
2013-12-10 16:23 - 2013-12-10 16:23 - 00891184 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\SecurityCheck.exe
2013-12-10 12:49 - 2013-03-10 15:15 - 00001773 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
2013-12-10 12:43 - 2013-12-10 12:43 - 00000000 ____D C:\Programme\ESET
2013-12-10 12:43 - 2008-09-04 19:45 - 00000000 ___RD C:\Programme
2013-12-09 20:14 - 2008-07-07 19:30 - 00000000 ____D C:\VALUEADD
2013-12-09 19:44 - 2013-12-09 19:44 - 00000454 _____ C:\WINDOWS\nsw.log
2013-12-09 18:51 - 2008-09-04 21:59 - 00000211 __RSH C:\boot.ini
2013-12-09 18:51 - 2008-09-04 19:35 - 00000491 _____ C:\WINDOWS\win.ini
2013-12-09 18:51 - 2008-07-07 20:15 - 00000227 _____ C:\WINDOWS\system.ini
2013-12-09 18:14 - 2013-12-09 18:14 - 00000905 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\JRT.txt
2013-12-09 18:01 - 2013-12-09 18:01 - 00000000 ____D C:\WINDOWS\ERUNT
2013-12-09 17:54 - 2013-12-09 17:50 - 00000000 ____D C:\AdwCleaner
2013-12-09 17:46 - 2009-11-11 22:14 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB969947$
2013-12-09 17:26 - 2013-12-09 17:24 - 00000760 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2013-12-09 17:26 - 2013-12-09 17:24 - 00000000 ____D C:\Programme\Malwarebytes' Anti-Malware
2013-12-09 17:26 - 2013-12-09 17:24 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
2013-12-09 17:24 - 2013-12-09 17:24 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2013-12-09 17:24 - 2013-12-09 17:24 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2013-12-09 17:24 - 2008-09-04 19:45 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2013-12-09 17:22 - 2013-12-09 17:22 - 00315388 _____ (Malwarebytes Corporation ) C:\Dokumente und Einstellungen\Administrator\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-09 12:09 - 2009-08-13 08:57 - 00002505 _____ C:\Dokumente und Einstellungen\Administrator\Desktop\Microsoft Office Excel 2007.lnk
2013-12-08 11:24 - 2009-04-08 08:24 - 00002317 _____ C:\Dokumente und Einstellungen\All Users\Desktop\eSobi v2.lnk
2013-12-06 21:00 - 2013-12-06 21:00 - 00087324 _____ C:\OTL.Txt
2013-12-06 21:00 - 2013-12-06 21:00 - 00026636 _____ C:\Extras.Txt
2013-12-06 14:40 - 2008-07-07 19:25 - 00000000 __SHD C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Verlauf
2013-12-06 09:38 - 2009-04-08 13:59 - 00000000 ____D C:\WINDOWS\pss
2013-12-06 09:38 - 2008-07-07 20:15 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
2013-12-06 09:38 - 2008-07-07 20:15 - 00000000 ___RD C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart
2013-12-06 09:03 - 2008-09-04 21:47 - 00648294 _____ C:\WINDOWS\launApp.log
2013-12-06 07:44 - 2009-08-01 11:53 - 00002533 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Vodafone Mobile Connect.lnk
2013-12-05 21:38 - 2008-09-04 19:16 - 00000000 ___RD C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Eigene Bilder
2013-12-05 18:46 - 2013-12-05 18:46 - 00210944 _____ C:\WINDOWS\system32\bootacls.dll
2013-12-05 18:46 - 2013-12-05 18:46 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Antivirus Security Pro
2013-12-05 18:46 - 2008-09-04 19:16 - 00000000 ___RD C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme
2013-12-05 18:40 - 2013-03-10 15:13 - 00000000 ____D C:\Programme\Google
2013-12-05 18:40 - 2009-04-08 08:29 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google
ZeroAccess:
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Desktop\Install
ZeroAccess:
C:\Programme\Google\Desktop\Install
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2008-04-14 04:00] - [2008-04-14 04:00] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e
C:\Windows\System32\winlogon.exe
[2008-04-14 04:00] - [2008-04-14 04:00] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a
C:\Windows\System32\svchost.exe
[2008-04-14 04:00] - [2008-04-14 04:00] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366
C:\Windows\System32\services.exe
[2008-04-14 04:00] - [2009-02-09 12:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc
C:\Windows\System32\User32.dll
[2008-04-14 04:00] - [2008-04-14 04:00] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd
C:\Windows\System32\userinit.exe
[2008-04-14 04:00] - [2008-04-14 04:00] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106
C:\Windows\System32\Drivers\volsnap.sys
[2008-04-14 04:00] - [2008-04-14 04:00] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d
==================== End Of Log ============================ --- --- ---
--- --- ---
--- --- ---
Vielen Dank für die Mühe |