Trojaner-Board - Weisser Bildschirm nach Start

ups, vergessen...

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-06-2013 01

Ran by Eva (administrator) on 27-06-2013 08:38:25

Running from C:\Dokumente und Einstellungen\Eva\Desktop

Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard

Internet Explorer Version 8

Boot Mode: Normal
 

==================== Processes (Whitelisted) ===================
 

(Microsoft Corporation) C:\Programme\Microsoft Security Client\MsMpEng.exe

(Intel Corporation) C:\Programme\Intel\Wireless\Bin\EvtEng.exe

(Intel Corporation ) C:\Programme\Intel\Wireless\Bin\S24EvMon.exe

(Apple Inc.) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Programme\Bonjour\mDNSResponder.exe

(TOSHIBA CORPORATION) C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe

(Microsoft Corporation) C:\WINDOWS\eHome\ehRecvr.exe

(Microsoft Corporation) C:\WINDOWS\eHome\ehSched.exe

(HP) C:\WINDOWS\system32\HPSIsvc.exe

(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe

(TOSHIBA Corporation) C:\Programme\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe

(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe

(RealNetworks, Inc.) C:\Programme\Online Games Manager\ogmservice.exe

(Intel Corporation) C:\Programme\Intel\Wireless\Bin\RegSrvc.exe

(SigmaTel, Inc.) C:\Programme\SigmaTel\C-Major Audio\WDM\stacsv.exe

(TOSHIBA Corporation) C:\WINDOWS\system32\TODDSrv.exe

(X10) C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

(Microsoft Corporation) C:\WINDOWS\ehome\mcrdsvc.exe

(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe

(Microsoft Corporation) C:\WINDOWS\eHome\ehmsas.exe

(TOSHIBA Corporation) C:\WINDOWS\system32\00THotkey.exe

(TOSHIBA Corp.) C:\WINDOWS\system32\TFNF5.exe

(TOSHIBA Corporation) C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe

(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPEnh.exe

(TOSHIBA Corporation) C:\Programme\TOSHIBA\TouchED\TouchED.Exe

(TOSHIBA) C:\Programme\TOSHIBA\Touch and Launch\PadExe.exe

(Agere Systems) C:\WINDOWS\AGRSMMSG.exe

(TOSHIBA CORPORATION) C:\Programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe

(TOSHIBA CORPORATION) C:\Programme\TOSHIBA\ConfigFree\NDSTray.exe

(TOSHIBA Corporation) C:\Programme\TOSHIBA\TOSHIBA Controls\TFncKy.exe

(TOSHIBA CORPORATION) C:\Programme\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe

(TOSHIBA Corporation) C:\Programme\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe

(Intel Corporation) C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe

(TOSHIBA Corporation) C:\WINDOWS\system32\TPSBattM.exe

(Microsoft Corporation) C:\WINDOWS\vVX1000.exe

(TOSHIBA CORPORATION) C:\Programme\TOSHIBA\ConfigFree\CFSServ.exe

(Microsoft Corporation) C:\Programme\Microsoft Security Client\msseces.exe

(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

(Apple Inc.) C:\Programme\iTunes\iTunesHelper.exe

(Google Inc.) C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(Skype Technologies S.A.) C:\Programme\Skype\Phone\Skype.exe

(TOSHIBA CORPORATION) C:\Programme\TOSHIBA\ConfigFree\CFXFER.exe

(Apple Inc.) C:\Programme\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe

(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe

(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe [64512 2005-08-05] (Microsoft Corporation)

HKLM\...\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [7340032 2006-02-15] (NVIDIA Corporation)

HKLM\...\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe [253952 2005-05-11] (TOSHIBA Corporation)

HKLM\...\Run: [000StTHK] 000StTHK.exe [x]

HKLM\...\Run: [TFNF5] TFNF5.exe [x]

HKLM\...\Run: [SmoothView] C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe [118784 2005-05-13] (TOSHIBA Corporation)

HKLM\...\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe [761947 2005-12-08] (Synaptics, Inc.)

HKLM\...\Run: [TouchED] C:\Programme\TOSHIBA\TouchED\TouchED.Exe [118784 2005-09-01] (TOSHIBA Corporation)

HKLM\...\Run: [PadTouch] C:\Programme\TOSHIBA\Touch and Launch\PadExe.exe [1077329 2005-12-22] (TOSHIBA)

HKLM\...\Run: [AGRSMMSG] AGRSMMSG.exe [x]

HKLM\...\Run: [TosHKCW.exe] "C:\Programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [49152 2005-05-17] (TOSHIBA CORPORATION)

HKLM\...\Run: [NDSTray.exe] NDSTray.exe [x]

HKLM\...\Run: [TPSMain] TPSMain.exe [x]

HKLM\...\Run: [TPSODDCtl] TPSODDCtl.exe [x]

HKLM\...\Run: [TFncKy] TFncKy.exe [x]

HKLM\...\Run: [Kraidman] C:\Programme\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe [1093706 2005-12-14] (TOSHIBA CORPORATION)

HKLM\...\Run: [DDWMon] C:\Programme\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe [262144 2006-03-07] (TOSHIBA Corporation)

HKLM\...\Run: [IntelZeroConfig] "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe" [667718 2005-12-05] (Intel Corporation)

HKLM\...\Run: [IntelWireless] "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless [602182 2005-11-28] (Intel Corporation)

HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated)

HKLM\...\Run: [VX1000] C:\WINDOWS\vVX1000.exe [757248 2009-06-26] (Microsoft Corporation)

HKLM\...\Run: [CFSServ.exe] CFSServ.exe -NoClient [x]

HKLM\...\Run: [nwiz] nwiz.exe /install [x]

HKLM\...\Run: [MSC] "C:\Programme\Microsoft Security Client\msseces.exe" -hide -runkey [931200 2012-03-26] (Microsoft Corporation)

HKLM\...\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [254896 2012-09-17] (Sun Microsystems, Inc.)

HKLM\...\Run: [APSDaemon] "C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" [152544 2012-12-12] (Apple Inc.)

HKCU\...\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-02-09] (Google Inc.)

HKCU\...\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized [17418928 2012-07-13] (Skype Technologies S.A.)

HKCU\...\Policies\system: [DisableRegistryTools] 0

HKCU\...\Policies\system: [DisableTaskMgr] 0
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU SearchScopes: DefaultScope {8F83F474-8BBA-4BD3-8BC1-E0E50AED1F44} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADFA_deDE418

SearchScopes: HKCU - {8F83F474-8BBA-4BD3-8BC1-E0E50AED1F44} URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADFA_deDE418

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU -&Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU -No Name - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} -  No File

Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: ipp - No CLSID Value - 

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: msdaipp - No CLSID Value - 

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Winsock: Catalog5 04 C:\Programme\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Dokumente und Einstellungen\Eva\Anwendungsdaten\Mozilla\Firefox\Profiles\j0es83u3.default

FF Plugin: @adobe.com/ShockwavePlayer - C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=1.6.0_37 - C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @zylom.com/ZylomGamesPlayer - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)

FF Extension: No Name - C:\Dokumente und Einstellungen\Eva\Anwendungsdaten\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

FF Extension: No Name - C:\Dokumente und Einstellungen\Eva\Anwendungsdaten\Mozilla\Firefox\Profiles\j0es83u3.default\Extensions\staged-xpis

FF Extension: No Name - C:\Dokumente und Einstellungen\Eva\Anwendungsdaten\Mozilla\Firefox\Profiles\j0es83u3.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
 

========================== Services (Whitelisted) =================
 

R2 Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55184 2012-08-11] (Apple Inc.)

R2 Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [390504 2011-08-31] (Apple Inc.)

R2 CFSvcs; C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2005-01-18] (TOSHIBA CORPORATION)

R2 EvtEng; C:\Programme\Intel\Wireless\Bin\EvtEng.exe [114753 2005-11-28] (Intel Corporation)

S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-04-22] (Google Inc.)

S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-04-22] (Google Inc.)

S3 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2012-08-14] (Google)

S3 IDriverT; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation)

R3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [553440 2012-12-12] (Apple Inc.)

R2 kraidsvc; C:\Programme\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe [208970 2005-12-14] (TOSHIBA Corporation)

R2 McrdSvc; C:\WINDOWS\ehome\mcrdsvc.exe [99328 2005-08-05] (Microsoft Corporation)

R2 MsMpSvc; C:\Programme\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)

R2 ogmservice; C:\Programme\Online Games Manager\ogmservice.exe [559168 2013-03-12] (RealNetworks, Inc.)

S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)

R2 RegSrvc; C:\Programme\Intel\Wireless\Bin\RegSrvc.exe [217164 2005-11-28] (Intel Corporation)

R2 S24EventMonitor; C:\Programme\Intel\Wireless\Bin\S24EvMon.exe [540745 2005-11-28] (Intel Corporation )

S2 SkypeUpdate; C:\Programme\Skype\Updater\Updater.exe [160944 2012-07-13] (Skype Technologies)

R2 STacSV; C:\Programme\SigmaTel\C-Major Audio\WDM\stacsv.exe [77824 2006-02-14] (SigmaTel, Inc.)

S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2009-02-04] (Microsoft Corporation)

R2 x10nets; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [20480 2001-11-12] (X10)

R2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf" [x]
 

==================== Drivers (Whitelisted) ====================
 

R2 AegisP; C:\Windows\System32\DRIVERS\AegisP.sys [21275 2009-10-19] (Meetinghouse Data Communications)

S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)

R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)

R3 Iviaspi; C:\Windows\System32\drivers\iviaspi.sys [21060 2003-09-11] (InterVideo, Inc.)

S3 MPE; C:\Windows\System32\DRIVERS\MPE.sys [15232 2008-04-13] (Microsoft Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)

S3 NABTSFEC; C:\Windows\System32\DRIVERS\NABTSFEC.sys [85248 2008-04-13] (Microsoft Corporation)

S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)

R2 Netdevio; C:\Windows\System32\DRIVERS\netdevio.sys [12032 2003-01-29] (TOSHIBA Corporation.)

R3 Pfc; C:\Windows\System32\drivers\pfc.sys [10368 2003-09-19] (Padus, Inc.)

R2 s24trans; C:\Windows\System32\DRIVERS\s24trans.sys [13568 2005-11-28] (Intel Corporation)

S3 SLIP; C:\Windows\System32\DRIVERS\SLIP.sys [11136 2008-04-13] (Microsoft Corporation)

R3 STHDA; C:\Windows\System32\drivers\sthda.sys [1106888 2006-02-14] (SigmaTel, Inc.)

S3 streamip; C:\Windows\System32\DRIVERS\StreamIP.sys [15232 2008-04-13] (Microsoft Corporation)

R2 tdudf; C:\Windows\System32\DRIVERS\tdudf.sys [98048 2006-02-16] (TOSHIBA Corporation)

R2 TOS_SPS; C:\Programme\TOSHIBA\TMP2VDec\TOS_SPS.sys [169216 2006-01-07] (Toshiba Corporation)

R3 ttv400x; C:\Windows\System32\drivers\ttv400x.sys [173696 2005-09-22] (TOSHIBA)

S3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1956096 2009-06-26] (Microsoft Corporation)

R3 w39n51; C:\Windows\System32\DRIVERS\w39n51.sys [1428096 2005-12-05] (Intel® Corporation)

S3 WSTCODEC; C:\Windows\System32\DRIVERS\WSTCODEC.SYS [19200 2008-04-13] (Microsoft Corporation)

R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [7040 2005-11-28] (X10 Wireless Technology, Inc.)

S4 Abiosdsk; No ImagePath

S4 abp480n5; No ImagePath

S4 adpu160m; No ImagePath

S4 Aha154x; No ImagePath

S4 aic78u2; No ImagePath

S4 aic78xx; No ImagePath

S4 AliIde; No ImagePath

S4 amsint; No ImagePath

S4 asc; No ImagePath

S4 asc3350p; No ImagePath

S4 asc3550; No ImagePath

S4 Atdisk; No ImagePath

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S4 cd20xrnt; No ImagePath

S1 Changer; No ImagePath

S4 CmdIde; No ImagePath

S4 Cpqarray; No ImagePath

U4 dac2w2k; No ImagePath

S4 dac960nt; No ImagePath

S4 dpti2o; No ImagePath

S4 hpn; No ImagePath

S1 i2omgmt; No ImagePath

S4 i2omp; No ImagePath

S4 ini910u; No ImagePath

S4 IntelIde; No ImagePath

S1 lbrtfdc; No ImagePath

S4 mraid35x; No ImagePath

S1 PCIDump; No ImagePath

S3 PDCOMP; No ImagePath

S3 PDFRAME; No ImagePath

S3 PDRELI; No ImagePath

S3 PDRFRAME; No ImagePath

S4 perc2; No ImagePath

S4 perc2hib; No ImagePath

S4 ql1080; No ImagePath

S4 Ql10wnt; No ImagePath

S4 ql12160; No ImagePath

S4 ql1240; No ImagePath

S4 ql1280; No ImagePath

S4 Simbad; No ImagePath

S4 Sparrow; No ImagePath

S4 symc810; No ImagePath

S4 symc8xx; No ImagePath

S4 sym_hi; No ImagePath

S4 sym_u3; No ImagePath

S4 TosIde; No ImagePath

S4 ultra; No ImagePath

S4 ViaIde; No ImagePath

S3 WDICA; No ImagePath
 

==================== NetSvcs (Whitelisted) ===================
 

NETSVC: MHN -> C:\Windows\System32\mhn.dll (Microsoft Corporation)
 

==================== One Month Created Files and Folders ========
 

2013-06-26 19:53 - 2013-06-26 19:53 - 00000000 ____D C:\Windows\LastGood

2013-06-26 19:12 - 2013-06-26 19:12 - 00000000 ____D C:\Windows\ERUNT

2013-06-26 19:12 - 2013-06-26 19:12 - 00000000 ____D C:\JRT

2013-06-26 18:59 - 2013-06-26 19:00 - 00019796 ____A C:\AdwCleaner[S1].txt

2013-06-26 18:51 - 2013-06-26 18:51 - 00012857 ____A C:\ComboFix.txt

2013-06-26 15:52 - 2013-06-26 19:56 - 00009355 ____A C:\Windows\KB2758857.log

2013-06-26 15:52 - 2013-06-26 19:56 - 00009260 ____A C:\Windows\KB2802968.log

2013-06-26 15:51 - 2013-06-26 19:56 - 00009168 ____A C:\Windows\KB2780091.log

2013-06-26 15:50 - 2013-06-26 19:55 - 00009844 ____A C:\Windows\KB2839229.log

2013-06-26 15:48 - 2013-06-26 19:55 - 00008953 ____A C:\Windows\KB2820917.log

2013-06-26 15:48 - 2013-06-26 19:54 - 00008864 ____A C:\Windows\KB2757638.log

2013-06-26 15:47 - 2013-06-26 19:54 - 00009743 ____A C:\Windows\KB2813345.log

2013-06-26 15:47 - 2013-06-26 19:54 - 00008754 ____A C:\Windows\KB2749655.log

2013-06-26 15:47 - 2013-06-26 19:54 - 00008651 ____A C:\Windows\KB2727528.log

2013-06-26 15:47 - 2013-06-26 19:54 - 00008635 ____A C:\Windows\KB2661254-v2.log

2013-06-26 15:46 - 2013-06-26 19:54 - 00009466 ____A C:\Windows\KB2829361.log

2013-06-26 15:14 - 2013-06-26 18:43 - 00008192 ___AH C:\Windows\System32\config\SECURITY.tmp.LOG

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\system.tmp.LOG

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\software.tmp.LOG

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\SAM.tmp.LOG

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\default.tmp.LOG

2013-06-26 14:24 - 2013-06-26 14:24 - 00000000 RASHD C:\cmdcons

2013-06-26 14:24 - 2009-10-19 07:33 - 00000224 ____A C:\Boot.bak

2013-06-26 14:24 - 2004-08-03 23:00 - 00262448 _RASH C:\cmldr

2013-06-26 13:45 - 2013-06-26 18:51 - 00000000 ____D C:\Qoobox

2013-06-26 13:45 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe

2013-06-26 13:45 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe

2013-06-26 13:45 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe

2013-06-26 13:45 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe

2013-06-26 13:45 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe

2013-06-26 13:45 - 2000-08-31 02:00 - 00212480 ____A (SteelWerX) C:\Windows\SWXCACLS.exe

2013-06-26 13:45 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe

2013-06-26 13:45 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe

2013-06-26 13:45 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe

2013-06-26 13:44 - 2013-06-26 18:43 - 00000000 ____D C:\Windows\erdnt

2013-06-26 13:43 - 2013-06-27 02:17 - 00000386 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job

2013-06-25 17:17 - 2013-06-26 12:46 - 00000000 ____D C:\FRST
 

==================== One Month Modified Files and Folders ========
 

2013-06-27 08:31 - 2012-07-12 14:29 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-06-27 08:27 - 2011-02-21 00:26 - 00001202 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1875323254-657226231-2693366216-1005UA.job

2013-06-27 07:52 - 2010-04-22 11:46 - 00001084 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-06-27 06:32 - 2006-03-22 13:09 - 01528088 ____A C:\Windows\WindowsUpdate.log

2013-06-27 06:32 - 2006-03-22 13:03 - 00000000 ___RD C:\Programme

2013-06-27 06:27 - 2011-02-21 00:25 - 00001150 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1875323254-657226231-2693366216-1005Core.job

2013-06-27 06:26 - 2012-03-27 19:51 - 00006144 _ASHC C:\Windows\Thumbs.db

2013-06-27 02:17 - 2013-06-26 13:43 - 00000386 ___AH C:\Windows\Tasks\Microsoft Antimalware Scheduled Scan.job

2013-06-26 21:09 - 2006-03-22 13:06 - 00000000 ____D C:\Windows\Microsoft.NET

2013-06-26 19:56 - 2013-06-26 15:52 - 00009355 ____A C:\Windows\KB2758857.log

2013-06-26 19:56 - 2013-06-26 15:52 - 00009260 ____A C:\Windows\KB2802968.log

2013-06-26 19:56 - 2013-06-26 15:51 - 00009168 ____A C:\Windows\KB2780091.log

2013-06-26 19:55 - 2013-06-26 15:50 - 00009844 ____A C:\Windows\KB2839229.log

2013-06-26 19:55 - 2013-06-26 15:48 - 00008953 ____A C:\Windows\KB2820917.log

2013-06-26 19:54 - 2013-06-26 15:48 - 00008864 ____A C:\Windows\KB2757638.log

2013-06-26 19:54 - 2013-06-26 15:47 - 00009743 ____A C:\Windows\KB2813345.log

2013-06-26 19:54 - 2013-06-26 15:47 - 00008754 ____A C:\Windows\KB2749655.log

2013-06-26 19:54 - 2013-06-26 15:47 - 00008651 ____A C:\Windows\KB2727528.log

2013-06-26 19:54 - 2013-06-26 15:47 - 00008635 ____A C:\Windows\KB2661254-v2.log

2013-06-26 19:54 - 2013-06-26 15:46 - 00009466 ____A C:\Windows\KB2829361.log

2013-06-26 19:53 - 2013-06-26 19:53 - 00000000 ____D C:\Windows\LastGood

2013-06-26 19:46 - 2010-04-22 11:46 - 00001080 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-06-26 19:46 - 2006-03-22 15:36 - 00043616 ____A C:\Windows\System32\nvapps.xml

2013-06-26 19:46 - 2006-03-22 13:07 - 00000000 ____D C:\Windows\Registration

2013-06-26 19:45 - 2006-03-22 13:13 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-06-26 19:45 - 2006-03-22 13:05 - 00000159 ____A C:\Windows\wiadebug.log

2013-06-26 19:45 - 2006-03-22 13:05 - 00000050 ____A C:\Windows\wiaservc.log

2013-06-26 19:37 - 2006-03-22 13:13 - 00032512 ____A C:\Windows\SchedLgU.Txt

2013-06-26 19:37 - 2006-03-22 13:03 - 01082104 ___AC C:\Windows\System32\PerfStringBackup.INI

2013-06-26 19:12 - 2013-06-26 19:12 - 00000000 ____D C:\Windows\ERUNT

2013-06-26 19:12 - 2013-06-26 19:12 - 00000000 ____D C:\JRT

2013-06-26 19:00 - 2013-06-26 18:59 - 00019796 ____A C:\AdwCleaner[S1].txt

2013-06-26 18:51 - 2013-06-26 18:51 - 00012857 ____A C:\ComboFix.txt

2013-06-26 18:51 - 2013-06-26 13:45 - 00000000 ____D C:\Qoobox

2013-06-26 18:46 - 2006-03-22 12:56 - 00000227 ____A C:\Windows\system.ini

2013-06-26 18:44 - 2006-03-22 14:01 - 32468992 ____A C:\Windows\System32\config\software.bak

2013-06-26 18:44 - 2006-03-22 14:01 - 08126464 ____A C:\Windows\System32\config\system.bak

2013-06-26 18:44 - 2006-03-22 14:01 - 00331776 ____A C:\Windows\System32\config\default.bak

2013-06-26 18:44 - 2006-03-22 13:02 - 00061440 ____A C:\Windows\System32\config\SECURITY.bak

2013-06-26 18:44 - 2006-03-22 13:02 - 00028672 ____A C:\Windows\System32\config\SAM.bak

2013-06-26 18:43 - 2013-06-26 15:14 - 00008192 ___AH C:\Windows\System32\config\SECURITY.tmp.LOG

2013-06-26 18:43 - 2013-06-26 13:44 - 00000000 ____D C:\Windows\erdnt

2013-06-26 15:52 - 2006-03-22 13:16 - 00000000 ___HD C:\Windows\$hf_mig$

2013-06-26 15:17 - 2006-03-22 14:01 - 00001024 ___AH C:\Windows\System32\config\userdiff.LOG

2013-06-26 15:17 - 2006-03-22 13:03 - 00003236 ___AC C:\Windows\regopt.log

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\system.tmp.LOG

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\software.tmp.LOG

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\SAM.tmp.LOG

2013-06-26 15:14 - 2013-06-26 15:14 - 00000000 ___AH C:\Windows\System32\config\default.tmp.LOG

2013-06-26 14:24 - 2013-06-26 14:24 - 00000000 RASHD C:\cmdcons

2013-06-26 14:24 - 2006-03-22 12:57 - 00000340 _RASH C:\boot.ini

2013-06-26 14:16 - 2013-04-15 11:09 - 00001499 ____A C:\Windows\setupapi.log

2013-06-26 12:46 - 2013-06-25 17:17 - 00000000 ____D C:\FRST

2013-06-25 17:32 - 2012-07-12 14:29 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe

2013-06-25 17:32 - 2011-06-24 19:33 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl

2013-06-25 16:59 - 2011-06-08 21:02 - 00000000 ____D C:\Zylom Games

2013-06-25 16:35 - 2006-03-22 12:56 - 00001158 ____A C:\Windows\System32\wpa.dbl
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe

[2006-03-22 12:56] - [2008-04-14 04:22] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e 
 

C:\Windows\System32\winlogon.exe

[2006-03-22 12:56] - [2008-04-14 04:23] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a 
 

C:\Windows\System32\svchost.exe

[2006-03-22 12:56] - [2008-04-14 04:23] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366 
 

C:\Windows\System32\services.exe

[2006-03-22 12:56] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc 
 

C:\Windows\System32\User32.dll

[2006-03-22 12:56] - [2008-04-14 04:22] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd 
 

C:\Windows\System32\userinit.exe

[2006-03-22 12:56] - [2008-04-14 04:23] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106 
 

C:\Windows\System32\Drivers\volsnap.sys

[2006-03-22 12:56] - [2008-04-14 03:52] - 0053760 ___AC (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d 
 
 

==================== End Of Log ============================
--- --- ---

Hab angenommen wenn ein Scanner was findet, is das ned gut ;)
Aber Du bist hier der Profi!!!