| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten ModusWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.08.2013, 10:54
| #1 |
| |  Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus Hallo! ich wurde leider vom "Gesellschaft Zur Verfolgung und Urheberrechtsverletzung"-Virus erwischt und habe mir bereits ein paar Beiträge hier dazu angesehen, allerdings komme ich nichtmals in den Abgesicherten Modus, da er direkt neustartet.  Benutze Windows 7. Was soll ich nun machen?  MfG Dave |
|
01.08.2013, 11:16
| #2 |
| /// the machine /// TB-Ausbilder    | Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus hi,
__________________Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8) Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
__________________ |
|
01.08.2013, 11:44
| #3 |
| | Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus Scan schonmal erfolgreich
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by SYSTEM on 01-08-2013 12:35:55
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RunDLLEntry] - C:\Windows\system32\RunDLL32.exe [45568 2009-07-14] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2412616 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [415232 2009-07-14] (Microsoft Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION!
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2010-12-29] ()
HKLM-x32\...\Run: [VolPanel] - C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-07-07] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1226608 2010-12-09] ()
HKLM-x32\...\Run: [DivX Download Manager] - E:\DivX\DivX Plus Web Player\DDmService.exe [63360 2010-12-08] (DivX, LLC)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] - E:\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2010-12-29] (Analog Devices, Inc.)
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811800 2010-10-05] (Logitech(c))
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - E:\Itunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKU\David\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\David\...\Run: [Spotify Web Helper] - C:\Users\David\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-08] (Spotify Ltd)
HKU\David\...\Run: [Spotify] - C:\Users\David\AppData\Roaming\Spotify\spotify.exe [4640768 2013-07-08] (Spotify Ltd)
HKU\David\...\Run: [EvolveClient] - E:\evolve\EvolveClient.exe [3157464 2013-06-21] (Echobit LLC)
HKU\David\...\Run: [Java Auto Update] - C:\Users\David\AppData\Roaming\Java\Update\Download\Cache\jsheded.exe [172544 2013-06-07] ()
HKU\David\...\Run: [GrindingGearGames] - C:\Users\David\AppData\Roaming\ijfvsasd\rcaujfgs.exe [x]
HKU\David\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\David\AppData\Local\Temp\ohjoiaqaonbktlqke.exe [68608 2013-08-01] () <===== ATTENTION
HKU\David\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe [814472 2013-06-12] (Adobe Systems Incorporated)
HKU\David\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\David\...\Command Processor: "C:\Users\David\AppData\Local\Temp\ohjoiaqaonbktlqke.exe" <===== ATTENTION!
HKU\UpdatusUser\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\UpdatusUser\...\Run: [ICQ] - E:\ICQ\ICQ7.2\ICQ.exe [133432 2011-01-05] (ICQ, LLC.)
HKU\UpdatusUser\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4288048 2013-04-02] ()
HKU\UpdatusUser\...\Run: [Skype] - "E:\Skype\Phone\Skype.exe" /nosplash /minimized [x]
Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> E:\open office\program\quickstart.exe ()
==================== Services (Whitelisted) =================
S2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2010-12-29] (Andrea Electronics Corporation)
S2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [90112 2010-12-29] ()
S3 DAUpdaterSvc; E:\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2013-04-24] (BioWare)
S3 EvoSvc; E:\evolve\EvoSvc.exe [1484760 2013-06-21] (Echobit LLC)
S2 VisualSVNServer; "C:\Program Files (x86)\VisualSVN Server\bin\VisualSVNServer.exe" -k runservice -C "LoadModule log_visualsvn_module bin/mod_log_visualsvn.so" -E nul [x]
==================== Drivers (Whitelisted) ====================
S3 Alpham1; C:\Windows\System32\DRIVERS\Alpham164.sys [52992 2007-07-23] (Ideazon Corporation)
S3 Alpham2; C:\Windows\System32\DRIVERS\Alpham264.sys [21760 2007-03-20] (Ideazon Corporation)
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2010-12-29] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2010-12-29] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-04-01] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-04-22] (EnTech Taiwan)
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-04-22] (EnTech Taiwan)
S3 EvolveVirtualAdapter; C:\Windows\System32\DRIVERS\evolve.sys [21656 2013-06-02] (Echobit, LLC)
S3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech)
S3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-04-01] ()
S3 MCfilt; C:\Windows\System32\drivers\MCfilt64.sys [25600 2010-12-29] (Creative Technology Ltd.)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2010-12-29] ()
S1 aggpjxvt; \??\C:\Windows\system32\drivers\aggpjxvt.sys [x]
S1 ayxvwhqx; \??\C:\Windows\system32\drivers\ayxvwhqx.sys [x]
S1 bdcrppmv; \??\C:\Windows\system32\drivers\bdcrppmv.sys [x]
S1 bktcblxg; \??\C:\Windows\system32\drivers\bktcblxg.sys [x]
S1 bukedoqz; \??\C:\Windows\system32\drivers\bukedoqz.sys [x]
S1 bxprdnhv; \??\C:\Windows\system32\drivers\bxprdnhv.sys [x]
S1 cbuvjfcn; \??\C:\Windows\system32\drivers\cbuvjfcn.sys [x]
S1 ckxlmoag; \??\C:\Windows\system32\drivers\ckxlmoag.sys [x]
S1 dijtqsyd; \??\C:\Windows\system32\drivers\dijtqsyd.sys [x]
S1 djppjqoy; \??\C:\Windows\system32\drivers\djppjqoy.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S1 eeqnyxua; \??\C:\Windows\system32\drivers\eeqnyxua.sys [x]
S1 eodqvlev; \??\C:\Windows\system32\drivers\eodqvlev.sys [x]
S1 frdbztwj; \??\C:\Windows\system32\drivers\frdbztwj.sys [x]
S1 frgpexvc; \??\C:\Windows\system32\drivers\frgpexvc.sys [x]
S1 gbtfoihw; \??\C:\Windows\system32\drivers\gbtfoihw.sys [x]
S1 ggbrqooe; \??\C:\Windows\system32\drivers\ggbrqooe.sys [x]
S1 gqotauhv; \??\C:\Windows\system32\drivers\gqotauhv.sys [x]
S1 gryosttc; \??\C:\Windows\system32\drivers\gryosttc.sys [x]
S1 gwcflvty; \??\C:\Windows\system32\drivers\gwcflvty.sys [x]
S1 htkldjuw; \??\C:\Windows\system32\drivers\htkldjuw.sys [x]
S1 hxnuzadh; \??\C:\Windows\system32\drivers\hxnuzadh.sys [x]
S1 itxsftgz; \??\C:\Windows\system32\drivers\itxsftgz.sys [x]
S1 jlmpskjk; \??\C:\Windows\system32\drivers\jlmpskjk.sys [x]
S1 jmrdmjzd; \??\C:\Windows\system32\drivers\jmrdmjzd.sys [x]
S1 jtkzajak; \??\C:\Windows\system32\drivers\jtkzajak.sys [x]
S1 kgvulttb; \??\C:\Windows\system32\drivers\kgvulttb.sys [x]
S1 kixduwqc; \??\C:\Windows\system32\drivers\kixduwqc.sys [x]
S1 kqdaozfq; \??\C:\Windows\system32\drivers\kqdaozfq.sys [x]
S1 kzyirzdp; \??\C:\Windows\system32\drivers\kzyirzdp.sys [x]
S1 lfgwwwwb; \??\C:\Windows\system32\drivers\lfgwwwwb.sys [x]
S1 lgejffsk; \??\C:\Windows\system32\drivers\lgejffsk.sys [x]
S1 lhujgpbh; \??\C:\Windows\system32\drivers\lhujgpbh.sys [x]
S1 lmhfwlhe; \??\C:\Windows\system32\drivers\lmhfwlhe.sys [x]
S1 lnzjlsny; \??\C:\Windows\system32\drivers\lnzjlsny.sys [x]
S1 luqiofpb; \??\C:\Windows\system32\drivers\luqiofpb.sys [x]
S1 muzndpfx; \??\C:\Windows\system32\drivers\muzndpfx.sys [x]
S1 nojnjlkd; \??\C:\Windows\system32\drivers\nojnjlkd.sys [x]
S1 nzwyhfke; \??\C:\Windows\system32\drivers\nzwyhfke.sys [x]
S1 pbjgabsl; \??\C:\Windows\system32\drivers\pbjgabsl.sys [x]
S1 phjnyrka; \??\C:\Windows\system32\drivers\phjnyrka.sys [x]
S1 plrdixyz; \??\C:\Windows\system32\drivers\plrdixyz.sys [x]
S1 pmgecxzd; \??\C:\Windows\system32\drivers\pmgecxzd.sys [x]
S1 pnqcbfjn; \??\C:\Windows\system32\drivers\pnqcbfjn.sys [x]
S1 qdhkvxbl; \??\C:\Windows\system32\drivers\qdhkvxbl.sys [x]
S1 qgbdsloq; \??\C:\Windows\system32\drivers\qgbdsloq.sys [x]
S1 qndygfam; \??\C:\Windows\system32\drivers\qndygfam.sys [x]
S1 qqovjeum; \??\C:\Windows\system32\drivers\qqovjeum.sys [x]
S1 rbyqtadb; \??\C:\Windows\system32\drivers\rbyqtadb.sys [x]
S1 rddhtdat; \??\C:\Windows\system32\drivers\rddhtdat.sys [x]
S1 riazdyhu; \??\C:\Windows\system32\drivers\riazdyhu.sys [x]
S1 rkepnnsz; \??\C:\Windows\system32\drivers\rkepnnsz.sys [x]
S1 roebfopy; \??\C:\Windows\system32\drivers\roebfopy.sys [x]
S1 rrmgkciq; \??\C:\Windows\system32\drivers\rrmgkciq.sys [x]
S1 slkbxphf; \??\C:\Windows\system32\drivers\slkbxphf.sys [x]
S1 stccxiyp; \??\C:\Windows\system32\drivers\stccxiyp.sys [x]
S1 tfmizzgy; \??\C:\Windows\system32\drivers\tfmizzgy.sys [x]
S1 tuppnnjn; \??\C:\Windows\system32\drivers\tuppnnjn.sys [x]
S1 udxbgusv; \??\C:\Windows\system32\drivers\udxbgusv.sys [x]
S1 ueusxrqs; \??\C:\Windows\system32\drivers\ueusxrqs.sys [x]
S1 ufqqrjqx; \??\C:\Windows\system32\drivers\ufqqrjqx.sys [x]
S1 ugjddisi; \??\C:\Windows\system32\drivers\ugjddisi.sys [x]
S1 ugjtgasx; \??\C:\Windows\system32\drivers\ugjtgasx.sys [x]
S1 vargnwgs; \??\C:\Windows\system32\drivers\vargnwgs.sys [x]
S1 vjvoauio; \??\C:\Windows\system32\drivers\vjvoauio.sys [x]
S1 wemfspgt; \??\C:\Windows\system32\drivers\wemfspgt.sys [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
S1 xgmxkmwz; \??\C:\Windows\system32\drivers\xgmxkmwz.sys [x]
S1 xxxvynay; \??\C:\Windows\system32\drivers\xxxvynay.sys [x]
S1 yateqmze; \??\C:\Windows\system32\drivers\yateqmze.sys [x]
S1 yhpdujkx; \??\C:\Windows\system32\drivers\yhpdujkx.sys [x]
S1 yxsdxier; \??\C:\Windows\system32\drivers\yxsdxier.sys [x]
S1 zlpwcbyk; \??\C:\Windows\system32\drivers\zlpwcbyk.sys [x]
S1 ztyboacu; \??\C:\Windows\system32\drivers\ztyboacu.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-01 12:35 - 2013-08-01 12:35 - 00000000 ____D C:\FRST
2013-08-01 02:12 - 2013-08-01 02:12 - 00163067 _____ C:\Users\David\AppData\Roaming\2433f433
2013-08-01 02:12 - 2013-08-01 02:12 - 00163065 _____ C:\ProgramData\2433f433
2013-08-01 02:12 - 2013-08-01 02:12 - 00163003 _____ C:\Users\David\AppData\Local\2433f433
2013-08-01 01:19 - 2013-08-01 01:19 - 00000000 ____D C:\Users\David\AppData\Roaming\capy
2013-07-31 21:51 - 2013-07-31 21:55 - 00000000 ____D C:\Users\David\AppData\Roaming\Braid
2013-07-30 19:14 - 2013-07-30 19:14 - 00675988 _____ C:\Users\David\Desktop\Minecraft.exe
2013-07-24 05:11 - 2013-07-24 16:24 - 00000000 ____D C:\Users\David\Documents\Endless Space
2013-07-22 14:12 - 2013-07-31 20:25 - 00000000 ____D C:\Users\David\AppData\Local\PAYDAY
2013-07-22 11:53 - 2013-07-22 11:53 - 00000000 ____D C:\Users\David\AppData\Roaming\Doublefine
2013-07-21 23:46 - 2013-07-21 23:46 - 00000000 ____D C:\Users\David\AppData\Roaming\com.shirogames.evoland
2013-07-19 00:26 - 2013-07-19 01:23 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband Savegames
2013-07-19 00:19 - 2013-07-19 00:28 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband
2013-07-19 00:19 - 2013-07-19 00:26 - 00000000 ____D C:\Users\David\AppData\Roaming\Mount&Blade Warband
2013-07-18 22:24 - 2013-07-20 01:57 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4
2013-07-18 22:22 - 2013-07-18 22:22 - 00000000 ____D C:\Users\David\AppData\Roaming\Kalypso Media
2013-07-18 18:37 - 2013-07-18 18:50 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4 Demo
2013-07-17 16:51 - 2013-07-17 19:42 - 00000000 ____D C:\Users\David\Documents\Shiner
2013-07-17 16:51 - 2013-07-17 16:51 - 00000000 ____D C:\Users\David\Documents\Robot Entertainment
2013-07-17 16:51 - 2013-07-17 16:51 - 00000000 ____D C:\Users\David\AppData\Local\Robot Entertainment
2013-07-16 12:08 - 2013-07-23 18:34 - 00015791 _____ C:\Users\David\Documents\TombRaider.log
2013-07-13 03:54 - 2013-07-13 03:54 - 00000000 ____D C:\Users\David\Documents\Square Enix
2013-07-12 02:47 - 2013-07-12 02:55 - 04082353 _____ C:\Users\David\Desktop\Jan Hegenberg - Des Gamers Schlaflied.flv
2013-07-11 09:55 - 2013-07-11 09:55 - 00000000 ____D C:\ProgramData\Picroma
2013-07-11 09:41 - 2013-07-11 09:41 - 00001378 _____ C:\Users\Public\Desktop\Bastion.lnk
2013-07-10 22:11 - 2013-07-10 22:11 - 00000608 _____ C:\Users\Public\Desktop\SuperMeatBoy.lnk
2013-07-09 12:12 - 2013-07-09 12:13 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-07-09 12:12 - 2013-07-09 12:13 - 00000000 ____D C:\Program Files\iTunes
2013-07-09 12:12 - 2013-07-09 12:12 - 00000000 ____D C:\Program Files\iPod
2013-07-09 12:07 - 2013-07-09 12:07 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-07-08 16:44 - 2013-07-08 22:38 - 00000000 ____D C:\Users\David\Desktop\attachments_20130708172936
2013-07-04 23:30 - 2013-07-04 23:30 - 00004096 _____ C:\Windows\d3dx.dat
==================== One Month Modified Files and Folders =======
2013-08-01 11:29 - 2011-09-19 17:40 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-01 11:29 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-01 11:29 - 2009-07-14 05:51 - 00050832 _____ C:\Windows\setupact.log
2013-08-01 02:46 - 2010-12-29 07:37 - 01478935 _____ C:\Windows\WindowsUpdate.log
2013-08-01 02:46 - 2009-07-14 05:45 - 00014608 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-01 02:46 - 2009-07-14 05:45 - 00014608 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-01 02:18 - 2010-12-29 07:41 - 00000000 ____D C:\users\David
2013-08-01 02:16 - 2012-05-03 09:40 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-01 02:15 - 2011-01-07 13:00 - 00101850 _____ C:\Windows\PFRO.log
2013-08-01 02:15 - 2009-07-14 05:45 - 00309992 _____ C:\Windows\System32\FNTCACHE.DAT
2013-08-01 02:14 - 2011-02-23 14:51 - 00000000 __SHD C:\Users\David\AppData\Roaming\ijfvsasd
2013-08-01 02:12 - 2013-08-01 02:12 - 00163067 _____ C:\Users\David\AppData\Roaming\2433f433
2013-08-01 02:12 - 2013-08-01 02:12 - 00163065 _____ C:\ProgramData\2433f433
2013-08-01 02:12 - 2013-08-01 02:12 - 00163003 _____ C:\Users\David\AppData\Local\2433f433
2013-08-01 02:07 - 2011-01-06 22:29 - 00000000 ____D C:\Users\David\AppData\Roaming\Skype
2013-08-01 01:59 - 2010-12-29 07:44 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{A536AF18-E296-403C-ADD0-944C29FD563C}
2013-08-01 01:32 - 2012-11-18 18:46 - 00000000 ____D C:\Users\David\AppData\Roaming\Spotify
2013-08-01 01:19 - 2013-08-01 01:19 - 00000000 ____D C:\Users\David\AppData\Roaming\capy
2013-07-31 21:55 - 2013-07-31 21:51 - 00000000 ____D C:\Users\David\AppData\Roaming\Braid
2013-07-31 20:25 - 2013-07-22 14:12 - 00000000 ____D C:\Users\David\AppData\Local\PAYDAY
2013-07-30 23:46 - 2012-05-06 14:22 - 00000000 ____D C:\Users\David\AppData\Roaming\.minecraft
2013-07-30 20:57 - 2013-06-15 00:02 - 00000000 ____D C:\Users\David\Documents\Telltale Games
2013-07-30 19:14 - 2013-07-30 19:14 - 00675988 _____ C:\Users\David\Desktop\Minecraft.exe
2013-07-25 09:29 - 2012-11-18 18:46 - 00000000 ____D C:\Users\David\AppData\Local\Spotify
2013-07-24 21:27 - 2011-01-06 19:00 - 00884769 _____ C:\Windows\DirectX.log
2013-07-24 16:24 - 2013-07-24 05:11 - 00000000 ____D C:\Users\David\Documents\Endless Space
2013-07-24 16:24 - 2011-09-28 22:43 - 05281792 ___SH C:\Users\David\Desktop\Thumbs.db
2013-07-23 18:34 - 2013-07-16 12:08 - 00015791 _____ C:\Users\David\Documents\TombRaider.log
2013-07-22 11:53 - 2013-07-22 11:53 - 00000000 ____D C:\Users\David\AppData\Roaming\Doublefine
2013-07-21 23:46 - 2013-07-21 23:46 - 00000000 ____D C:\Users\David\AppData\Roaming\com.shirogames.evoland
2013-07-20 01:57 - 2013-07-18 22:24 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4
2013-07-19 01:23 - 2013-07-19 00:26 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband Savegames
2013-07-19 00:28 - 2013-07-19 00:19 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband
2013-07-19 00:26 - 2013-07-19 00:19 - 00000000 ____D C:\Users\David\AppData\Roaming\Mount&Blade Warband
2013-07-18 22:22 - 2013-07-18 22:22 - 00000000 ____D C:\Users\David\AppData\Roaming\Kalypso Media
2013-07-18 19:06 - 2011-09-14 20:30 - 00000000 ____D C:\Program Files (x86)\Opera
2013-07-18 18:50 - 2013-07-18 18:37 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4 Demo
2013-07-17 19:42 - 2013-07-17 16:51 - 00000000 ____D C:\Users\David\Documents\Shiner
2013-07-17 16:51 - 2013-07-17 16:51 - 00000000 ____D C:\Users\David\Documents\Robot Entertainment
2013-07-17 16:51 - 2013-07-17 16:51 - 00000000 ____D C:\Users\David\AppData\Local\Robot Entertainment
2013-07-17 10:36 - 2011-02-23 14:30 - 00000000 ____D C:\Users\David\Documents\My Games
2013-07-13 03:54 - 2013-07-13 03:54 - 00000000 ____D C:\Users\David\Documents\Square Enix
2013-07-12 02:55 - 2013-07-12 02:47 - 04082353 _____ C:\Users\David\Desktop\Jan Hegenberg - Des Gamers Schlaflied.flv
2013-07-12 02:02 - 2011-01-06 23:35 - 00000000 ____D C:\Users\David\AppData\Roaming\Hamachi
2013-07-11 09:55 - 2013-07-11 09:55 - 00000000 ____D C:\ProgramData\Picroma
2013-07-11 09:41 - 2013-07-11 09:41 - 00001378 _____ C:\Users\Public\Desktop\Bastion.lnk
2013-07-10 22:11 - 2013-07-10 22:11 - 00000608 _____ C:\Users\Public\Desktop\SuperMeatBoy.lnk
2013-07-09 21:36 - 2013-02-28 03:09 - 00256620 _____ C:\Users\David\Desktop\config_A802.bin
2013-07-09 12:13 - 2013-07-09 12:12 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-07-09 12:13 - 2013-07-09 12:12 - 00000000 ____D C:\Program Files\iTunes
2013-07-09 12:13 - 2012-09-18 12:24 - 00001446 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-07-09 12:12 - 2013-07-09 12:12 - 00000000 ____D C:\Program Files\iPod
2013-07-09 12:07 - 2013-07-09 12:07 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-07-09 08:05 - 2012-11-13 17:45 - 00000000 ____D C:\Users\David\Desktop\Black Sabbath - Iron Man The Best of Black Sabbath (2012)
2013-07-08 22:38 - 2013-07-08 16:44 - 00000000 ____D C:\Users\David\Desktop\attachments_20130708172936
2013-07-08 16:46 - 2010-12-29 08:28 - 00069520 _____ C:\Users\David\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-08 15:48 - 2009-07-14 18:58 - 00707316 _____ C:\Windows\System32\perfh007.dat
2013-07-08 15:48 - 2009-07-14 18:58 - 00152908 _____ C:\Windows\System32\perfc007.dat
2013-07-08 15:48 - 2009-07-14 06:13 - 01642220 _____ C:\Windows\System32\PerfStringBackup.INI
2013-07-04 23:30 - 2013-07-04 23:30 - 00004096 _____ C:\Windows\d3dx.dat
2013-07-02 21:48 - 2012-05-24 12:00 - 00001964 _____ C:\Users\David\Desktop\Drakensang Online.lnk
2013-07-02 21:48 - 2012-05-24 12:00 - 00000000 ____D C:\Program Files (x86)\Drakensang Online
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3251074102-83015546-74196890-1000\$cbd215d9264166bb8e8104d7af7ffc76
Files to move or delete:
====================
C:\Users\David\AppData\Local\Temp\ohjoiaqaonbktlqke.exe
C:\ProgramData\ezsid.dat
C:\ProgramData\hash.dat
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-07-31 04:36:03
Restore point made on: 2013-07-31 21:51:19
Restore point made on: 2013-07-31 22:44:07
==================== Memory info ===========================
Percentage of memory in use: 12%
Total physical RAM: 6135.11 MB
Available physical RAM: 5357.68 MB
Total Pagefile: 6133.26 MB
Available Pagefile: 5372.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:100 GB) (Free:21.87 GB) NTFS (Disk=0 Partition=2)
Drive e: (Volume) (Fixed) (Total:831.41 GB) (Free:96.3 GB) NTFS (Disk=0 Partition=3)
Drive g: (D-BOX) (Removable) (Total:7.52 GB) (Free:7.51 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 99643145)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=831 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 8 GB) (Disk ID: 03FB86F6)
Partition 1: (Not Active) - (Size=8 GB) - (Type=0C)
LastRegBack: 2013-07-23 02:25
==================== End Of Log ============================
--- --- --- Schon einmal ein riesen Dankeschön für die schnelle Hilfe |
|
01.08.2013, 12:47
| #4 |
| /// the machine /// TB-Ausbilder | Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\David\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\David\AppData\Local\Temp\ohjoiaqaonbktlqke.exe [68608 2013-08-01] () <===== ATTENTION
HKU\David\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\David\...\Command Processor: "C:\Users\David\AppData\Local\Temp\ohjoiaqaonbktlqke.exe" <===== ATTENTION!
S1 aggpjxvt; \??\C:\Windows\system32\drivers\aggpjxvt.sys [x]
S1 ayxvwhqx; \??\C:\Windows\system32\drivers\ayxvwhqx.sys [x]
S1 bdcrppmv; \??\C:\Windows\system32\drivers\bdcrppmv.sys [x]
S1 bktcblxg; \??\C:\Windows\system32\drivers\bktcblxg.sys [x]
S1 bukedoqz; \??\C:\Windows\system32\drivers\bukedoqz.sys [x]
S1 bxprdnhv; \??\C:\Windows\system32\drivers\bxprdnhv.sys [x]
S1 cbuvjfcn; \??\C:\Windows\system32\drivers\cbuvjfcn.sys [x]
S1 ckxlmoag; \??\C:\Windows\system32\drivers\ckxlmoag.sys [x]
S1 dijtqsyd; \??\C:\Windows\system32\drivers\dijtqsyd.sys [x]
S1 djppjqoy; \??\C:\Windows\system32\drivers\djppjqoy.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S1 eeqnyxua; \??\C:\Windows\system32\drivers\eeqnyxua.sys [x]
S1 eodqvlev; \??\C:\Windows\system32\drivers\eodqvlev.sys [x]
S1 frdbztwj; \??\C:\Windows\system32\drivers\frdbztwj.sys [x]
S1 frgpexvc; \??\C:\Windows\system32\drivers\frgpexvc.sys [x]
S1 gbtfoihw; \??\C:\Windows\system32\drivers\gbtfoihw.sys [x]
S1 ggbrqooe; \??\C:\Windows\system32\drivers\ggbrqooe.sys [x]
S1 gqotauhv; \??\C:\Windows\system32\drivers\gqotauhv.sys [x]
S1 gryosttc; \??\C:\Windows\system32\drivers\gryosttc.sys [x]
S1 gwcflvty; \??\C:\Windows\system32\drivers\gwcflvty.sys [x]
S1 htkldjuw; \??\C:\Windows\system32\drivers\htkldjuw.sys [x]
S1 hxnuzadh; \??\C:\Windows\system32\drivers\hxnuzadh.sys [x]
S1 itxsftgz; \??\C:\Windows\system32\drivers\itxsftgz.sys [x]
S1 jlmpskjk; \??\C:\Windows\system32\drivers\jlmpskjk.sys [x]
S1 jmrdmjzd; \??\C:\Windows\system32\drivers\jmrdmjzd.sys [x]
S1 jtkzajak; \??\C:\Windows\system32\drivers\jtkzajak.sys [x]
S1 kgvulttb; \??\C:\Windows\system32\drivers\kgvulttb.sys [x]
S1 kixduwqc; \??\C:\Windows\system32\drivers\kixduwqc.sys [x]
S1 kqdaozfq; \??\C:\Windows\system32\drivers\kqdaozfq.sys [x]
S1 kzyirzdp; \??\C:\Windows\system32\drivers\kzyirzdp.sys [x]
S1 lfgwwwwb; \??\C:\Windows\system32\drivers\lfgwwwwb.sys [x]
S1 lgejffsk; \??\C:\Windows\system32\drivers\lgejffsk.sys [x]
S1 lhujgpbh; \??\C:\Windows\system32\drivers\lhujgpbh.sys [x]
S1 lmhfwlhe; \??\C:\Windows\system32\drivers\lmhfwlhe.sys [x]
S1 lnzjlsny; \??\C:\Windows\system32\drivers\lnzjlsny.sys [x]
S1 luqiofpb; \??\C:\Windows\system32\drivers\luqiofpb.sys [x]
S1 muzndpfx; \??\C:\Windows\system32\drivers\muzndpfx.sys [x]
S1 nojnjlkd; \??\C:\Windows\system32\drivers\nojnjlkd.sys [x]
S1 nzwyhfke; \??\C:\Windows\system32\drivers\nzwyhfke.sys [x]
S1 pbjgabsl; \??\C:\Windows\system32\drivers\pbjgabsl.sys [x]
S1 phjnyrka; \??\C:\Windows\system32\drivers\phjnyrka.sys [x]
S1 plrdixyz; \??\C:\Windows\system32\drivers\plrdixyz.sys [x]
S1 pmgecxzd; \??\C:\Windows\system32\drivers\pmgecxzd.sys [x]
S1 pnqcbfjn; \??\C:\Windows\system32\drivers\pnqcbfjn.sys [x]
S1 qdhkvxbl; \??\C:\Windows\system32\drivers\qdhkvxbl.sys [x]
S1 qgbdsloq; \??\C:\Windows\system32\drivers\qgbdsloq.sys [x]
S1 qndygfam; \??\C:\Windows\system32\drivers\qndygfam.sys [x]
S1 qqovjeum; \??\C:\Windows\system32\drivers\qqovjeum.sys [x]
S1 rbyqtadb; \??\C:\Windows\system32\drivers\rbyqtadb.sys [x]
S1 rddhtdat; \??\C:\Windows\system32\drivers\rddhtdat.sys [x]
S1 riazdyhu; \??\C:\Windows\system32\drivers\riazdyhu.sys [x]
S1 rkepnnsz; \??\C:\Windows\system32\drivers\rkepnnsz.sys [x]
S1 roebfopy; \??\C:\Windows\system32\drivers\roebfopy.sys [x]
S1 rrmgkciq; \??\C:\Windows\system32\drivers\rrmgkciq.sys [x]
S1 slkbxphf; \??\C:\Windows\system32\drivers\slkbxphf.sys [x]
S1 stccxiyp; \??\C:\Windows\system32\drivers\stccxiyp.sys [x]
S1 tfmizzgy; \??\C:\Windows\system32\drivers\tfmizzgy.sys [x]
S1 tuppnnjn; \??\C:\Windows\system32\drivers\tuppnnjn.sys [x]
S1 udxbgusv; \??\C:\Windows\system32\drivers\udxbgusv.sys [x]
S1 ueusxrqs; \??\C:\Windows\system32\drivers\ueusxrqs.sys [x]
S1 ufqqrjqx; \??\C:\Windows\system32\drivers\ufqqrjqx.sys [x]
S1 ugjddisi; \??\C:\Windows\system32\drivers\ugjddisi.sys [x]
S1 ugjtgasx; \??\C:\Windows\system32\drivers\ugjtgasx.sys [x]
S1 vargnwgs; \??\C:\Windows\system32\drivers\vargnwgs.sys [x]
S1 vjvoauio; \??\C:\Windows\system32\drivers\vjvoauio.sys [x]
S1 wemfspgt; \??\C:\Windows\system32\drivers\wemfspgt.sys [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
S1 xgmxkmwz; \??\C:\Windows\system32\drivers\xgmxkmwz.sys [x]
S1 xxxvynay; \??\C:\Windows\system32\drivers\xxxvynay.sys [x]
S1 yateqmze; \??\C:\Windows\system32\drivers\yateqmze.sys [x]
S1 yhpdujkx; \??\C:\Windows\system32\drivers\yhpdujkx.sys [x]
S1 yxsdxier; \??\C:\Windows\system32\drivers\yxsdxier.sys [x]
S1 zlpwcbyk; \??\C:\Windows\system32\drivers\zlpwcbyk.sys [x]
S1 ztyboacu; \??\C:\Windows\system32\drivers\ztyboacu.sys [x]
2013-08-01 02:12 - 2013-08-01 02:12 - 00163067 _____ C:\Users\David\AppData\Roaming\2433f433
2013-08-01 02:12 - 2013-08-01 02:12 - 00163065 _____ C:\ProgramData\2433f433
2013-08-01 02:12 - 2013-08-01 02:12 - 00163003 _____ C:\Users\David\AppData\Local\2433f433
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3251074102-83015546-74196890-1000\$cbd215d9264166bb8e8104d7af7ffc76
C:\Users\David\AppData\Local\Temp\ohjoiaqaonbktlqke.exe
C:\ProgramData\ezsid.dat
C:\ProgramData\hash.dat
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. neu booten, freuen 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.08.2013, 12:54
| #5 |
| | Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus Es hat funktioniert! ich freu mich so Danke! Noch etwas, dass ich machen oder beachten sollte?Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-07-2013 03
Ran by SYSTEM at 2013-08-01 13:50:16 Run:1
Running from G:\
Boot Mode: Recovery
==============================================
HKU\David\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.
HKU\David\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\David\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
aggpjxvt => Service deleted successfully.
ayxvwhqx => Service deleted successfully.
bdcrppmv => Service deleted successfully.
bktcblxg => Service deleted successfully.
bukedoqz => Service deleted successfully.
bxprdnhv => Service deleted successfully.
cbuvjfcn => Service deleted successfully.
ckxlmoag => Service deleted successfully.
dijtqsyd => Service deleted successfully.
djppjqoy => Service deleted successfully.
EagleX64 => Service deleted successfully.
eeqnyxua => Service deleted successfully.
eodqvlev => Service deleted successfully.
frdbztwj => Service deleted successfully.
frgpexvc => Service deleted successfully.
gbtfoihw => Service deleted successfully.
ggbrqooe => Service deleted successfully.
gqotauhv => Service deleted successfully.
gryosttc => Service deleted successfully.
gwcflvty => Service deleted successfully.
htkldjuw => Service deleted successfully.
hxnuzadh => Service deleted successfully.
itxsftgz => Service deleted successfully.
jlmpskjk => Service deleted successfully.
jmrdmjzd => Service deleted successfully.
jtkzajak => Service deleted successfully.
kgvulttb => Service deleted successfully.
kixduwqc => Service deleted successfully.
kqdaozfq => Service deleted successfully.
kzyirzdp => Service deleted successfully.
lfgwwwwb => Service deleted successfully.
lgejffsk => Service deleted successfully.
lhujgpbh => Service deleted successfully.
lmhfwlhe => Service deleted successfully.
lnzjlsny => Service deleted successfully.
luqiofpb => Service deleted successfully.
muzndpfx => Service deleted successfully.
nojnjlkd => Service deleted successfully.
nzwyhfke => Service deleted successfully.
pbjgabsl => Service deleted successfully.
phjnyrka => Service deleted successfully.
plrdixyz => Service deleted successfully.
pmgecxzd => Service deleted successfully.
pnqcbfjn => Service deleted successfully.
qdhkvxbl => Service deleted successfully.
qgbdsloq => Service deleted successfully.
qndygfam => Service deleted successfully.
qqovjeum => Service deleted successfully.
rbyqtadb => Service deleted successfully.
rddhtdat => Service deleted successfully.
riazdyhu => Service deleted successfully.
rkepnnsz => Service deleted successfully.
roebfopy => Service deleted successfully.
rrmgkciq => Service deleted successfully.
slkbxphf => Service deleted successfully.
stccxiyp => Service deleted successfully.
tfmizzgy => Service deleted successfully.
tuppnnjn => Service deleted successfully.
udxbgusv => Service deleted successfully.
ueusxrqs => Service deleted successfully.
ufqqrjqx => Service deleted successfully.
ugjddisi => Service deleted successfully.
ugjtgasx => Service deleted successfully.
vargnwgs => Service deleted successfully.
vjvoauio => Service deleted successfully.
wemfspgt => Service deleted successfully.
X6va012 => Service deleted successfully.
xgmxkmwz => Service deleted successfully.
xxxvynay => Service deleted successfully.
yateqmze => Service deleted successfully.
yhpdujkx => Service deleted successfully.
yxsdxier => Service deleted successfully.
zlpwcbyk => Service deleted successfully.
ztyboacu => Service deleted successfully.
C:\Users\David\AppData\Roaming\2433f433 => Moved successfully.
C:\ProgramData\2433f433 => Moved successfully.
C:\Users\David\AppData\Local\2433f433 => Moved successfully.
C:\$Recycle.Bin\S-1-5-21-3251074102-83015546-74196890-1000\$cbd215d9264166bb8e8104d7af7ffc76 => Moved successfully.
C:\Users\David\AppData\Local\Temp\ohjoiaqaonbktlqke.exe => Moved successfully.
C:\ProgramData\ezsid.dat => Moved successfully.
C:\ProgramData\hash.dat => Moved successfully.
==== End of Fixlog ====
|
|
01.08.2013, 13:08
| #6 |
| /// the machine /// TB-Ausbilder | Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus Kontrollscans Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Downloade Dir bitte  Malwarebytes Anti-Malware
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus |
|
01.08.2013, 13:56
| #7 |
| | Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus adwcleaner: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 01/08/2013 um 14:22:05 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : David - DAVID-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\David\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\foxydeal.sqlite
Ordner Gelöscht : C:\Users\David\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\David\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\David\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\David\AppData\LocalLow\Conduit
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2967869
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\OpenCandy NSIS SDK
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKU\S-1-5-21-3251074102-83015546-74196890-1005\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16618
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v3.6.13 (de)
Datei : C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\prefs.js
C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\user.js ... Gelöscht !
[OK] Die Datei ist sauber.
-\\ Opera v12.16.1860.0
Datei : C:\Users\David\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [1925 octets] - [01/08/2013 14:22:05]
########## EOF - C:\AdwCleaner[S1].txt - [1985 octets] ##########
malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.01.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16618 David :: DAVID-PC [Administrator] 01.08.2013 14:32:16 mbam-log-2013-08-01 (14-32-16).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 256141 Laufzeit: 5 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 1 C:\Users\David\AppData\Roaming\Java\Update\Download\Cache\csrss.exe (BitcoinMiner) -> 4412 -> Löschen bei Neustart. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Java Auto Update (Backdoor.Bot) -> Daten: C:\Users\David\AppData\Roaming\Java\Update\Download\Cache\jsheded.exe -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 6 C:\Users\David\AppData\Roaming\Java\Update\Download\Cache\csrss.exe (BitcoinMiner) -> Löschen bei Neustart. C:\Users\David\AppData\Roaming\Java\Update\Download\Cache\jsheded.exe (Backdoor.Bot) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\David\AppData\Local\Temp\1gerwef.exe (Trojan.Zbot.FV) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\David\AppData\Local\Temp\msimg32.dll (Trojan.Downloader.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\David\AppData\Local\Temp\tDKLAKf+.exe.part (Malware.Packer.WT) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\David\AppData\Local\Temp\~djf46175554573006326.tmp (Trojan.Ransom.FG) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by David (administrator) on 01-08-2013 14:48:24
Running from C:\Users\David\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE
() C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
(DivX, LLC) E:\DivX\DivX Plus Web Player\DDMService.exe
(OpenOffice.org) E:\open office\program\soffice.exe
(OpenOffice.org) E:\open office\program\soffice.bin
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech(c)) C:\Program Files (x86)\Logitech\G35\G35.exe
(Apple Inc.) E:\Itunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RunDLLEntry] - C:\Windows\system32\RunDLL32.exe [45568 2009-07-14] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2412616 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4725320 2010-08-03] (Logitech Inc.)
HKLM\...\Run: [XboxStat] - C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-10-01] (Microsoft Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION!
HKCU\...\Run: [EvolveClient] - E:\evolve\EvolveClient.exe [3157464 2013-06-21] (Echobit LLC)
HKCU\...\Run: [GrindingGearGames] - C:\Users\David\AppData\Roaming\ijfvsasd\rcaujfgs.exe [x]
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3251074102-83015546-74196890-1000\$cbd215d9264166bb8e8104d7af7ffc76\o. ATTENTION! ====> ZeroAccess?
MountPoints2: {bdcd6c58-3306-11e1-9100-20cf301f4d1a} - T:\autorun.exe
MountPoints2: {bdcd6c62-3306-11e1-9100-20cf301f4d1a} - U:\noautorun.exe
MountPoints2: {bdcd6c6e-3306-11e1-9100-20cf301f4d1a} - V:\autorun.exe
MountPoints2: {bdcd6c72-3306-11e1-9100-20cf301f4d1a} - W:\noautorun.exe
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2010-12-29] ()
HKLM-x32\...\Run: [VolPanel] - C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-07-07] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] - C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1226608 2010-12-09] ()
HKLM-x32\...\Run: [DivX Download Manager] - E:\DivX\DivX Plus Web Player\DDmService.exe [63360 2010-12-08] (DivX, LLC)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] - E:\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM-x32\...\Run: [SoundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1310720 2010-12-29] (Analog Devices, Inc.)
HKLM-x32\...\Run: [Logitech G35] - C:\Program Files (x86)\Logitech\G35\G35.exe [1811800 2010-10-05] (Logitech(c))
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - E:\Itunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> E:\open office\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: (No Name) - {1ce76c93-a797-4ca2-ab3c-f4a6cfba3440} - No File
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - E:\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - E:\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - E:\Itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - E:\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX OVS Helper,version=1.0.0 - E:\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - E:\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\David\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: No Name - C:\Users\David\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\Extensions\6.tmp
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\Extensions\ich@maltegoetz.de
FF Extension: TinEye Reverse Image Search - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\Extensions\tineye@ideeinc.com
FF Extension: NoScript - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)
FF Extension: No Name - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\0miv74er.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] E:\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 <video> - E:\DivX\DivX Plus Web Player\firefox\html5video
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] E:\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - E:\DivX\DivX Plus Web Player\firefox\wpa
FF StartMenuInternet: FIREFOX.EXE - E:\Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2010-12-29] (Andrea Electronics Corporation)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [90112 2010-12-29] ()
S3 DAUpdaterSvc; E:\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe [25832 2013-04-24] (BioWare)
S3 EvoSvc; E:\evolve\EvoSvc.exe [1484760 2013-06-21] (Echobit LLC)
S2 VisualSVNServer; "C:\Program Files (x86)\VisualSVN Server\bin\VisualSVNServer.exe" -k runservice -C "LoadModule log_visualsvn_module bin/mod_log_visualsvn.so" -E nul [x]
==================== Drivers (Whitelisted) ====================
S3 Alpham1; C:\Windows\System32\DRIVERS\Alpham164.sys [52992 2007-07-23] (Ideazon Corporation)
S3 Alpham2; C:\Windows\System32\DRIVERS\Alpham264.sys [21760 2007-03-20] (Ideazon Corporation)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2010-12-29] ()
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2010-12-29] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2012-04-01] ()
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-04-22] (EnTech Taiwan)
S3 ENTECH64; C:\Windows\system32\DRIVERS\ENTECH64.sys [12744 2008-04-22] (EnTech Taiwan)
R3 EvolveVirtualAdapter; C:\Windows\System32\DRIVERS\evolve.sys [21656 2013-06-02] (Echobit, LLC)
R3 LADF_DHP2; C:\Windows\System32\DRIVERS\ladfDHP2amd64.sys [62168 2010-09-29] (Logitech)
R3 LADF_SBVM; C:\Windows\System32\DRIVERS\ladfSBVMamd64.sys [377176 2010-09-29] (Logitech)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2012-04-01] ()
R3 MCfilt; C:\Windows\System32\drivers\MCfilt64.sys [25600 2010-12-29] (Creative Technology Ltd.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2010-12-29] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-01 14:47 - 2013-08-01 14:48 - 01781589 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe
2013-08-01 14:31 - 2013-08-01 14:31 - 00001105 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-01 14:31 - 2013-08-01 14:31 - 00000000 ____D C:\Users\David\AppData\Roaming\Malwarebytes
2013-08-01 14:31 - 2013-08-01 14:31 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-01 14:31 - 2013-08-01 14:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-01 14:31 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-01 14:30 - 2013-08-01 14:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\David\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-01 14:30 - 2013-08-01 14:22 - 00002052 _____ C:\Users\David\Desktop\AdwCleaner[S1].txt
2013-08-01 14:25 - 2013-08-01 14:25 - 00000000 ____D C:\Users\David\AppData\Local\{D0403ADE-1BB7-4100-82AD-D15BDBFDD483}
2013-08-01 14:22 - 2013-08-01 14:22 - 00002052 _____ C:\AdwCleaner[S1].txt
2013-08-01 14:20 - 2013-08-01 14:20 - 00666633 _____ C:\Users\David\Desktop\adwcleaner.exe
2013-08-01 13:54 - 2013-08-01 13:54 - 00000000 ____D C:\Users\David\AppData\Local\{26244CCB-8760-45F7-9424-6BDED5DD1637}
2013-08-01 13:35 - 2013-08-01 13:35 - 00000000 ____D C:\FRST
2013-08-01 02:19 - 2013-08-01 02:19 - 00000000 ____D C:\Users\David\AppData\Roaming\capy
2013-08-01 02:18 - 2013-08-01 02:18 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Superbrothers Sword & Sworcery EP
2013-07-31 23:43 - 2013-07-31 23:43 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LIMBO
2013-07-31 22:51 - 2013-07-31 22:55 - 00000000 ____D C:\Users\David\AppData\Roaming\Braid
2013-07-30 20:14 - 2013-07-30 20:14 - 00675988 _____ C:\Users\David\Desktop\Minecraft.exe
2013-07-24 06:11 - 2013-07-24 17:24 - 00000000 ____D C:\Users\David\Documents\Endless Space
2013-07-22 15:12 - 2013-07-31 21:25 - 00000000 ____D C:\Users\David\AppData\Local\PAYDAY
2013-07-22 12:53 - 2013-07-22 12:53 - 00000000 ____D C:\Users\David\AppData\Roaming\Doublefine
2013-07-22 00:46 - 2013-07-22 00:46 - 00000000 ____D C:\Users\David\AppData\Roaming\com.shirogames.evoland
2013-07-19 01:26 - 2013-07-19 02:23 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband Savegames
2013-07-19 01:19 - 2013-07-19 01:28 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband
2013-07-19 01:19 - 2013-07-19 01:26 - 00000000 ____D C:\Users\David\AppData\Roaming\Mount&Blade Warband
2013-07-18 23:24 - 2013-07-20 02:57 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4
2013-07-18 23:22 - 2013-07-18 23:22 - 00000000 ____D C:\Users\David\AppData\Roaming\Kalypso Media
2013-07-18 19:37 - 2013-07-18 19:50 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4 Demo
2013-07-17 17:51 - 2013-07-17 20:42 - 00000000 ____D C:\Users\David\Documents\Shiner
2013-07-17 17:51 - 2013-07-17 17:51 - 00000000 ____D C:\Users\David\Documents\Robot Entertainment
2013-07-17 17:51 - 2013-07-17 17:51 - 00000000 ____D C:\Users\David\AppData\Local\Robot Entertainment
2013-07-16 13:08 - 2013-07-23 19:34 - 00015791 _____ C:\Users\David\Documents\TombRaider.log
2013-07-13 04:54 - 2013-07-13 04:54 - 00000000 ____D C:\Users\David\Documents\Square Enix
2013-07-12 03:47 - 2013-07-12 03:55 - 04082353 _____ C:\Users\David\Desktop\Jan Hegenberg - Des Gamers Schlaflied.flv
2013-07-11 10:55 - 2013-07-11 10:55 - 00000000 ____D C:\ProgramData\Picroma
2013-07-11 10:41 - 2013-07-11 10:41 - 00001378 _____ C:\Users\Public\Desktop\Bastion.lnk
2013-07-10 23:11 - 2013-07-10 23:11 - 00000608 _____ C:\Users\Public\Desktop\SuperMeatBoy.lnk
2013-07-09 13:12 - 2013-07-09 13:13 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-07-09 13:12 - 2013-07-09 13:13 - 00000000 ____D C:\Program Files\iTunes
2013-07-09 13:12 - 2013-07-09 13:12 - 00000000 ____D C:\Program Files\iPod
2013-07-09 13:07 - 2013-07-09 13:07 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-07-08 17:44 - 2013-07-08 23:38 - 00000000 ____D C:\Users\David\Desktop\attachments_20130708172936
2013-07-08 16:42 - 2013-07-08 16:43 - 00000000 ___SD C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
2013-07-05 00:30 - 2013-07-05 00:30 - 00004096 _____ C:\Windows\d3dx.dat
2013-07-02 22:48 - 2013-07-02 22:48 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
==================== One Month Modified Files and Folders =======
2013-08-01 14:48 - 2013-08-01 14:47 - 01781589 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe
2013-08-01 14:41 - 2011-09-19 18:40 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-01 14:41 - 2011-01-07 14:00 - 00103192 _____ C:\Windows\PFRO.log
2013-08-01 14:41 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-01 14:41 - 2009-07-14 06:51 - 00051000 _____ C:\Windows\setupact.log
2013-08-01 14:40 - 2010-12-29 08:37 - 01518291 _____ C:\Windows\WindowsUpdate.log
2013-08-01 14:34 - 2009-07-14 06:45 - 00014608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-01 14:34 - 2009-07-14 06:45 - 00014608 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-01 14:31 - 2013-08-01 14:31 - 00001105 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-01 14:31 - 2013-08-01 14:31 - 00000000 ____D C:\Users\David\AppData\Roaming\Malwarebytes
2013-08-01 14:31 - 2013-08-01 14:31 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-01 14:31 - 2013-08-01 14:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-01 14:30 - 2013-08-01 14:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\David\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-01 14:25 - 2013-08-01 14:25 - 00000000 ____D C:\Users\David\AppData\Local\{D0403ADE-1BB7-4100-82AD-D15BDBFDD483}
2013-08-01 14:22 - 2013-08-01 14:30 - 00002052 _____ C:\Users\David\Desktop\AdwCleaner[S1].txt
2013-08-01 14:22 - 2013-08-01 14:22 - 00002052 _____ C:\AdwCleaner[S1].txt
2013-08-01 14:20 - 2013-08-01 14:20 - 00666633 _____ C:\Users\David\Desktop\adwcleaner.exe
2013-08-01 14:16 - 2012-11-18 19:46 - 00000000 ____D C:\Users\David\AppData\Roaming\Spotify
2013-08-01 14:16 - 2012-05-03 10:40 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-01 13:54 - 2013-08-01 13:54 - 00000000 ____D C:\Users\David\AppData\Local\{26244CCB-8760-45F7-9424-6BDED5DD1637}
2013-08-01 13:35 - 2013-08-01 13:35 - 00000000 ____D C:\FRST
2013-08-01 03:18 - 2010-12-29 08:41 - 00000000 ____D C:\Users\David
2013-08-01 03:15 - 2009-07-14 06:45 - 00309992 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-01 03:14 - 2011-02-23 15:51 - 00000000 __SHD C:\Users\David\AppData\Roaming\ijfvsasd
2013-08-01 03:07 - 2011-01-06 23:29 - 00000000 ____D C:\Users\David\AppData\Roaming\Skype
2013-08-01 02:59 - 2010-12-29 08:44 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{A536AF18-E296-403C-ADD0-944C29FD563C}
2013-08-01 02:19 - 2013-08-01 02:19 - 00000000 ____D C:\Users\David\AppData\Roaming\capy
2013-08-01 02:18 - 2013-08-01 02:18 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Superbrothers Sword & Sworcery EP
2013-07-31 23:43 - 2013-07-31 23:43 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LIMBO
2013-07-31 22:55 - 2013-07-31 22:51 - 00000000 ____D C:\Users\David\AppData\Roaming\Braid
2013-07-31 21:25 - 2013-07-22 15:12 - 00000000 ____D C:\Users\David\AppData\Local\PAYDAY
2013-07-31 00:46 - 2012-05-06 15:22 - 00000000 ____D C:\Users\David\AppData\Roaming\.minecraft
2013-07-30 21:57 - 2013-06-15 01:02 - 00000000 ____D C:\Users\David\Documents\Telltale Games
2013-07-30 20:14 - 2013-07-30 20:14 - 00675988 _____ C:\Users\David\Desktop\Minecraft.exe
2013-07-25 10:29 - 2012-11-18 19:46 - 00000000 ____D C:\Users\David\AppData\Local\Spotify
2013-07-24 22:27 - 2011-01-06 20:00 - 00884769 _____ C:\Windows\DirectX.log
2013-07-24 17:24 - 2013-07-24 06:11 - 00000000 ____D C:\Users\David\Documents\Endless Space
2013-07-24 17:24 - 2011-09-28 23:43 - 05281792 ___SH C:\Users\David\Desktop\Thumbs.db
2013-07-23 19:34 - 2013-07-16 13:08 - 00015791 _____ C:\Users\David\Documents\TombRaider.log
2013-07-22 12:53 - 2013-07-22 12:53 - 00000000 ____D C:\Users\David\AppData\Roaming\Doublefine
2013-07-22 00:46 - 2013-07-22 00:46 - 00000000 ____D C:\Users\David\AppData\Roaming\com.shirogames.evoland
2013-07-20 02:57 - 2013-07-18 23:24 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4
2013-07-19 02:23 - 2013-07-19 01:26 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband Savegames
2013-07-19 01:28 - 2013-07-19 01:19 - 00000000 ____D C:\Users\David\Documents\Mount&Blade Warband
2013-07-19 01:26 - 2013-07-19 01:19 - 00000000 ____D C:\Users\David\AppData\Roaming\Mount&Blade Warband
2013-07-18 23:22 - 2013-07-18 23:22 - 00000000 ____D C:\Users\David\AppData\Roaming\Kalypso Media
2013-07-18 20:06 - 2011-09-14 21:30 - 00000000 ____D C:\Program Files (x86)\Opera
2013-07-18 19:50 - 2013-07-18 19:37 - 00000000 ____D C:\Users\David\AppData\Roaming\Tropico 4 Demo
2013-07-17 20:42 - 2013-07-17 17:51 - 00000000 ____D C:\Users\David\Documents\Shiner
2013-07-17 17:51 - 2013-07-17 17:51 - 00000000 ____D C:\Users\David\Documents\Robot Entertainment
2013-07-17 17:51 - 2013-07-17 17:51 - 00000000 ____D C:\Users\David\AppData\Local\Robot Entertainment
2013-07-17 11:36 - 2011-02-23 15:30 - 00000000 ____D C:\Users\David\Documents\My Games
2013-07-13 04:54 - 2013-07-13 04:54 - 00000000 ____D C:\Users\David\Documents\Square Enix
2013-07-12 03:55 - 2013-07-12 03:47 - 04082353 _____ C:\Users\David\Desktop\Jan Hegenberg - Des Gamers Schlaflied.flv
2013-07-12 03:02 - 2011-01-07 00:35 - 00000000 ____D C:\Users\David\AppData\Roaming\Hamachi
2013-07-11 10:55 - 2013-07-11 10:55 - 00000000 ____D C:\ProgramData\Picroma
2013-07-11 10:41 - 2013-07-11 10:41 - 00001378 _____ C:\Users\Public\Desktop\Bastion.lnk
2013-07-10 23:11 - 2013-07-10 23:11 - 00000608 _____ C:\Users\Public\Desktop\SuperMeatBoy.lnk
2013-07-09 22:36 - 2013-02-28 04:09 - 00256620 _____ C:\Users\David\Desktop\config_A802.bin
2013-07-09 13:13 - 2013-07-09 13:12 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-07-09 13:13 - 2013-07-09 13:12 - 00000000 ____D C:\Program Files\iTunes
2013-07-09 13:13 - 2012-09-18 13:24 - 00001446 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-07-09 13:12 - 2013-07-09 13:12 - 00000000 ____D C:\Program Files\iPod
2013-07-09 13:07 - 2013-07-09 13:07 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-07-09 09:05 - 2012-11-13 18:45 - 00000000 ____D C:\Users\David\Desktop\Black Sabbath - Iron Man The Best of Black Sabbath (2012)
2013-07-08 23:38 - 2013-07-08 17:44 - 00000000 ____D C:\Users\David\Desktop\attachments_20130708172936
2013-07-08 17:46 - 2010-12-29 09:28 - 00069520 _____ C:\Users\David\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-08 16:48 - 2009-07-14 19:58 - 00707316 _____ C:\Windows\system32\perfh007.dat
2013-07-08 16:48 - 2009-07-14 19:58 - 00152908 _____ C:\Windows\system32\perfc007.dat
2013-07-08 16:48 - 2009-07-14 07:13 - 01642220 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-08 16:43 - 2013-07-08 16:42 - 00000000 ___SD C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4.1
2013-07-08 16:43 - 2010-12-29 08:41 - 00000000 ___RD C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-05 00:30 - 2013-07-05 00:30 - 00004096 _____ C:\Windows\d3dx.dat
2013-07-02 22:48 - 2013-07-02 22:48 - 00000000 ____D C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2013-07-02 22:48 - 2012-05-24 13:00 - 00001964 _____ C:\Users\David\Desktop\Drakensang Online.lnk
2013-07-02 22:48 - 2012-05-24 13:00 - 00000000 ____D C:\Program Files (x86)\Drakensang Online
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-23 03:25
==================== End Of Log ============================
addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-07-2013 03 Ran by David at 2013-08-01 14:51:44 Running from C:\Users\David\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= µTorrent (x32 Version: 3.2.1.28086) 3DMark Vantage (x32 Version: 1.0.1.1) Adobe AIR (x32 Version: 3.1.0.4880) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7) Adobe Shockwave Player 12.0 (x32 Version: 12.0.0.112) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) Audacity 1.2.6 (x32) Bastion (x32 Version: 1.0.2) BlueJ (x32 Version: 3.0.6) Bonjour (Version: 3.0.0.10) Borderlands 2 (x32) Counter-Strike: Source (x32) Creeper World 2 (x32 Version: 0212) Creeper World DEMO (x32 Version: 0182) Cube World version 0.0.1 (x32 Version: 0.0.1) D3DX10 (x32 Version: 15.4.2368.0902) Dachon 4k (HKCU) Dark Messiah Might and Magic Single Player (x32) Dark Souls: Prepare to Die Edition (x32) Dead Island (x32) Diablo III (x32 Version: 1.0.8.16603) DivX-Setup (x32 Version: 2.2.1.2) Dragon Age: Origins - Ultimate Edition (x32) Drakensang Online (x32) Duke Nukem - Manhattan Project - 1.0.1 Patch (x32 Version: 1.0.1) Endless Space (x32) EPU-6 Engine (x32 Version: 1.01.17) Evolve (Version: 1.4.4) Falk Navi-Manager (x32 Version: 2.2.0.0) Falk Navi-Manager (x32 Version: 2.6.1) Faster Than Light (x32 Version: 2.0.0.9) FLV Player 2.0 (build 25) (x32 Version: 2.0 (build 25)) Futuremark SystemInfo (x32 Version: 3.16.2.1) Garry's Mod (x32) GOG.com Gothic 2 Gothic 2 Gold (x32 Version: 2.0.0.8) GUILD WARS (x32) GuildWars Visions v1.08 (x32) Guns of Icarus Online (x32) Half Minute Hero: Super Mega Neo Climax Ultimate Boy (x32) Half-Life 2: Deathmatch (x32) Half-Life 2: Episode Two (x32) Hamachi 1.0.2.5 (x32) Hidden Expedition Titanic (remove only) (HKCU) Impulse (x32 Version: 1.0) IsoBuster 2.8.5 (x32 Version: 2.8.5) iTunes (Version: 11.0.4.4) Java 7 Update 13 (x32 Version: 7.0.130) Java Auto Updater (x32 Version: 2.1.9.0) Java(TM) 7 Update 1 (64-bit) (Version: 7.0.10) Java(TM) SE Development Kit 7 Update 1 (64-bit) (Version: 1.7.0.10) JavaFX 2.1.1 (x32 Version: 2.1.1) JDownloader (x32) JMicron JMB36X Driver (x32 Version: 1.00.0000) Junk Mail filter update (x32 Version: 15.4.3502.0922) Just Cause 2 (x32) LAME v3.98.3 for Audacity (x32) League of Legends (x32 Version: 1.3) Left 4 Dead 2 (x32) LIMBO (HKCU) Little Inferno (x32 Version: Final) Logitech G35 (Version: 1.1.178) Logitech GamePanel Software 3.06.109 (Version: 3.06.109) Magicka (x32) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Marvell Miniport Driver (x32 Version: 11.10.5.3) Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322) Microsoft .NET Framework 1.1 (x32) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0) Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Windows-Journal-Viewer (x32 Version: 1.5.2316.0) Microsoft Xbox 360 Accessories 1.2 (Version: 1.20.146.0) Microsoft XNA Framework Redistributable 3.1 (x32 Version: 3.1.10527.0) Microsoft XNA Framework Redistributable 4.0 Refresh (x32 Version: 4.0.30901.0) Miranda IM 0.10.12 (x32 Version: 0.10.12) Mount & Blade: Warband (x32) Mozilla Firefox (3.6.13) (x32 Version: 3.6.13 (de)) Mozilla Firefox 22.0 (x86 de) (HKCU Version: 22.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) NVIDIA 3D Vision Controller Driver (x32 Version: 280.19) NVIDIA 3D Vision Controller-Treiber 280.19 (Version: 280.19) NVIDIA 3D Vision Treiber 311.06 (Version: 311.06) NVIDIA Grafiktreiber 311.06 (Version: 311.06) NVIDIA Install Application (Version: 2.1002.108.688) NVIDIA PhysX (x32 Version: 9.12.1031) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106) NVIDIA Systemsteuerung 311.06 (Version: 311.06) NVIDIA Update 1.11.3 (Version: 1.11.3) NVIDIA Update Components (Version: 1.11.3) OpenOffice.org 3.4.1 (x32 Version: 3.41.9593) Opera 12.16 (HKCU Version: 12.16.1860) Orcs Must Die! 2 (x32) Overlord and Overlord - Raising Hell (x32 Version: 2.0.1.10) Pando Media Booster (x32 Version: 2.6.0.9) Path of Exile (x32 Version: 0.10.0.22745) PAYDAY: The Heist (x32) Picasa 3 (x32 Version: 3.8) Poker Night at the Inventory (x32) Portal (x32) Portal 2 (x32) Postal 2 Share The Pain (x32) QuickTime (x32 Version: 7.74.80.86) Ragnarok Online (x32 Version: 13.2.2) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6602) RIFT (HKCU) Risen 2 - Dark Waters (x32) Rome: Total War (x32) RUBICon (x32 Version: 2.0.25) Sacred 2 (x32 Version: 2.0.2.0) Sacred 2 Gold (x32) Saints Row: The Third (x32) SCR3xxx Smart Card Reader (x32 Version: 8.44) Sid Meier's Civilization V (x32) Sins of a Solar Empire: Rebellion (x32) Skype™ 6.3 (x32 Version: 6.3.107) Sound Blaster X-Fi MB (x32 Version: 1.0) Spotify (HKCU Version: 0.9.1.57.ge7405149) StarCraft II (x32 Version: 2.0.8.25604) Super Meat Boy v1.5 (x32) Surgeon Simulator 2013 (x32) swMSM (x32 Version: 12.0.0.1) Tales of Monkey Island (x32) Team Fortress 2 (x32) TEdit 3 (x32 Version: 1.0.0.0) Terraria (x32) The Binding of Isaac (x32) The Cave (x32) The Elder Scrolls IV: Oblivion (x32) The Elder Scrolls V: Skyrim (x32) Thief: Deadly Shadows (x32) TmNationsForever (x32) Tomb Raider (x32) Torchlight II (x32) TrackMania² Stadium Open Beta (x32) Treasure Adventure Game (x32 Version: 2.0.0.4) Trine (x32) Trine 2 (x32) Tropico 4 (x32) UltraISO Premium V9.36 (x32) Unepic (x32) Unity Web Player (HKCU Version: ) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) us Mod Manager (Version: 0.44.10) VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0) VisualSVN Server 2.1.9 (x32 Version: 2.1.9.0) Warhammer® 40,000™: Dawn of War® II - Chaos Rising™ (x32) Warhammer® 40,000™: Dawn of War® II – Retribution™ (x32) Warhammer® 40,000™: Dawn of War® II (x32) Winamp (x32 Version: 5.623 ) Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1) WinCDEmu (x32 Version: 3.3) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3555.0308) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3555.0308) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Mobile-Gerätecenter (Version: 6.1.6965.0) WinRAR World of Warcraft (x32 Version: 5.3.0.17128) Worms Revolution (x32) ==================== Restore Points ========================= 31-07-2013 03:36:00 Windows Defender Checkpoint 31-07-2013 20:50:51 DirectX wurde installiert 31-07-2013 21:43:55 DirectX wurde installiert ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0A497062-D94E-4B1F-BAC7-BCCA9E5884CF} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {1CADA3BA-51E5-4531-A8A6-89CDB6007F22} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation) Task: {44725BAE-96DC-4697-AF1E-924BE7C1418B} - System32\Tasks\{F080E6D6-EECC-4B6F-9C59-2F06CC59B45F} => C:\Users\David\Desktop\SkypeSetup_3.8.0.139.exe No File Task: {6E7DF967-082A-4D41-B870-DCC5A1609CF7} - System32\Tasks\User_Feed_Synchronization-{A536AF18-E296-403C-ADD0-944C29FD563C} => C:\Windows\system32\msfeedssync.exe [2013-06-21] (Microsoft Corporation) Task: {81482A1C-0B5C-4D4E-A947-CDF67A2C965A} - System32\Tasks\{AE46656B-8AEA-47E5-92E6-3FF6C4DFCDF9} => E:\Skype\Phone\Skype.exe No File Task: {9AE6B105-C31B-4C1F-906C-41DA6F13D700} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation) Task: {A663857F-D89E-4FDB-AAA3-1F14287702C9} - System32\Tasks\{A0AE77ED-BCC4-446C-9544-7600468E1091} => C:\Users\David\Desktop\SkypeSetup_3.8.0.139.exe No File Task: {A844DEF1-8EB5-43C2-B22A-F7363E586A1B} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {AEE179AC-C48D-4AD4-8941-2BB86B8345CC} - System32\Tasks\{87FEB4A8-1709-4153-939C-1DB7BB8E3DA3} => E:\Skype\Phone\Skype.exe No File Task: {B14918AB-6746-4DA9-8A55-0C14B39DF0DD} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {C19249A9-A488-453E-A1F6-9059FAE2FE31} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {EE4871CB-9B5E-4CDC-A340-4B92F14E0F54} - System32\Tasks\ASUS\ASUS SIX Engine => C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe [2009-06-26] () Task: {FB7D9A9F-F20C-42BF-88F0-704119669E90} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/01/2013 03:16:29 AM) (Source: ESENT) (User: ) Description: taskhost (1904) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log. Error: (08/01/2013 03:16:29 AM) (Source: ESENT) (User: ) Description: taskhost (1904) WebCacheLocal: Versuch, Datei "C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (08/01/2013 03:16:19 AM) (Source: ESENT) (User: ) Description: taskhost (1904) WebCacheLocal: Fehler -1032 (0xfffffbf8) beim Öffnen von Protokolldatei C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log. Error: (08/01/2013 03:16:19 AM) (Source: ESENT) (User: ) Description: taskhost (1904) WebCacheLocal: Versuch, Datei "C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log" für den Lesezugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (07/31/2013 10:53:06 PM) (Source: Application Hang) (User: ) Description: Programm braid.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1a9c Startzeit: 01ce8e2fc76ec907 Endzeit: 20 Anwendungspfad: F:\Braid\braid.exe Berichts-ID: Error: (07/31/2013 02:41:58 PM) (Source: Application Hang) (User: ) Description: Programm Cube.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 2458 Startzeit: 01ce8de87cf72369 Endzeit: 178 Anwendungspfad: E:\Cube World\Cube.exe Berichts-ID: 933ae4e8-f9de-11e2-80ea-20cf301f4d1a Error: (07/31/2013 05:35:59 AM) (Source: VSS) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert . Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess. Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {4da33673-78f0-405a-8198-8beae2fd8767} Error: (07/31/2013 01:40:30 AM) (Source: Application Hang) (User: ) Description: Programm Cube.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 56e8 Startzeit: 01ce8d7d472767fd Endzeit: 243 Anwendungspfad: E:\Cube World\Cube.exe Berichts-ID: 6859fc93-f971-11e2-80ea-20cf301f4d1a Error: (07/31/2013 01:33:58 AM) (Source: Application Hang) (User: ) Description: Programm Cube.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 451c Startzeit: 01ce8d773d4ef719 Endzeit: 180 Anwendungspfad: E:\Cube World\Cube.exe Berichts-ID: 7e1c17e8-f970-11e2-80ea-20cf301f4d1a Error: (07/31/2013 00:25:43 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: javaw.exe, Version: 7.0.10.8, Zeitstempel: 0x4e8975e3 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e Ausnahmecode: 0xc0000374 Fehleroffset: 0x00000000000c40f2 ID des fehlerhaften Prozesses: 0x442c Startzeit der fehlerhaften Anwendung: 0xjavaw.exe0 Pfad der fehlerhaften Anwendung: javaw.exe1 Pfad des fehlerhaften Moduls: javaw.exe2 Berichtskennung: javaw.exe3 System errors: ============= Error: (08/01/2013 02:42:00 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "VisualSVN Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%1. Error: (08/01/2013 02:23:59 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "VisualSVN Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%1. Error: (08/01/2013 01:52:39 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "VisualSVN Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%1. Error: (08/01/2013 00:31:49 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: AFD AsIO DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx Wanarpv6 WfpLwf Error: (08/01/2013 00:31:49 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "VisualSVN Server" ist vom Dienst "Ancillary Function Driver for Winsock" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%31 Error: (08/01/2013 00:31:49 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/01/2013 00:31:49 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/01/2013 00:31:49 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/01/2013 00:31:49 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "SMB-Miniredirector-Wrapper und -Modul" ist vom Dienst "Umgeleitetes Puffersubsystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%31 Error: (08/01/2013 00:31:49 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "IP-Hilfsdienst" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Microsoft Office Sessions: ========================= Error: (08/01/2013 03:16:29 AM) (Source: ESENT)(User: ) Description: taskhost1904WebCacheLocal: C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8) Error: (08/01/2013 03:16:29 AM) (Source: ESENT)(User: ) Description: taskhost1904WebCacheLocal: C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (08/01/2013 03:16:19 AM) (Source: ESENT)(User: ) Description: taskhost1904WebCacheLocal: C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8) Error: (08/01/2013 03:16:19 AM) (Source: ESENT)(User: ) Description: taskhost1904WebCacheLocal: C:\Users\David\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (07/31/2013 10:53:06 PM) (Source: Application Hang)(User: ) Description: braid.exe0.0.0.01a9c01ce8e2fc76ec90720F:\Braid\braid.exe Error: (07/31/2013 02:41:58 PM) (Source: Application Hang)(User: ) Description: Cube.exe0.0.0.0245801ce8de87cf72369178E:\Cube World\Cube.exe933ae4e8-f9de-11e2-80ea-20cf301f4d1a Error: (07/31/2013 05:35:59 AM) (Source: VSS)(User: ) Description: 0x80070005, Zugriff verweigert Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {4da33673-78f0-405a-8198-8beae2fd8767} Error: (07/31/2013 01:40:30 AM) (Source: Application Hang)(User: ) Description: Cube.exe0.0.0.056e801ce8d7d472767fd243E:\Cube World\Cube.exe6859fc93-f971-11e2-80ea-20cf301f4d1a Error: (07/31/2013 01:33:58 AM) (Source: Application Hang)(User: ) Description: Cube.exe0.0.0.0451c01ce8d773d4ef719180E:\Cube World\Cube.exe7e1c17e8-f970-11e2-80ea-20cf301f4d1a Error: (07/31/2013 00:25:43 AM) (Source: Application Error)(User: ) Description: javaw.exe7.0.10.84e8975e3ntdll.dll6.1.7601.177254ec4aa8ec000037400000000000c40f2442c01ce8d6939f9d79eC:\Program Files\Java\jre7\bin\javaw.exeC:\Windows\SYSTEM32\ntdll.dllf8288040-f966-11e2-80ea-20cf301f4d1a ==================== Memory info =========================== Percentage of memory in use: 35% Total physical RAM: 6135.11 MB Available physical RAM: 3944.02 MB Total Pagefile: 12268.41 MB Available Pagefile: 10457.36 MB Total Virtual: 8192 MB Available Virtual: 8191.84 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:100 GB) (Free:22.03 GB) NTFS (Disk=0 Partition=2) Drive e: (Volume) (Fixed) (Total:831.41 GB) (Free:96.3 GB) NTFS (Disk=0 Partition=3) Drive h: (D-BOX) (Removable) (Total:7.52 GB) (Free:7.51 GB) FAT32 (Disk=1 Partition=1) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 99643145) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=100 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=831 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 8 GB) (Disk ID: 03FB86F6) Partition 1: (Not Active) - (Size=8 GB) - (Type=0C) ==================== End Of Log ============================ |
|
01.08.2013, 21:13
| #8 |
| /// the machine /// TB-Ausbilder | Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten ModusESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Gesellschaft Zur Verfolgung und Urheberrechtsverletzung - komme nicht in den Abgesicherten Modus |
| abgesicherte, abgesicherten, abgesicherten modus, backdoor.bot, beiträge, bereits, bitcoinminer, direkt, erwischt, malware.packer.wt, modus, trojan.downloader.ed, trojan.ransom.fg, trojan.zbot.fv, urheberrechtsverletzung, windows |
Linear-Darstellung
