| |
| |||||||
Log-Analyse und Auswertung: Win7: PC säubern nach schädlichem Mail-Anhang und diversen "Programmen"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
09.08.2013, 18:44
| #1 |
| |  Win7: PC säubern nach schädlichem Mail-Anhang und diversen "Programmen" Hey, ich hab hier einen PC von einem Kollegen, an dem ich vor paar Wochen schon "gearbeitet" habe. Der PC steht relativ frei zugänglich, so dass auf ihm sowohl etwas "gearbeitet" wird, aber auch viele Leute zugriffen haben und dementsprechend ihren Mist installieren / verwenden können ohne dass etwas darauf aufgepasst wird. Kurzverlauf:
ich habe hier noch die "ScanObject" Datei von der Kaspersky Rescue Disk gefunden, vielleicht hilft das ja auch: Code:
ATTFilter Untersuchung von Objekten: Störung vor (Ereignis: 2, Objekte: 0, Zeit: 00:00:00)
23.06.13 14:52 Aufgabenstart nicht möglich Die Datenbanken sind beschädigt
23.06.13 14:52 Aufgabe wurde gestartet
Untersuchung von Objekten: wurde beendet vor weniger als einer Minute (Ereignis: 10, Objekte: 310324, Zeit: 00:30:17)
23.06.13 15:28 Aufgabe wurde beendet
23.06.13 15:10 Nicht desinfizierte Objekte: Backdoor.Win32.Androm.xpe C:/Users/Büro/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/MGGQOIMF/Mahnung Vorname_Nachname vom 17.06.2013 Rechtsanwalt Baur GmbH Online.zip/Forderung fur Vorname_Nachname Inkasso Baur GmbH Online 17.06.2013.zip/Vorname_Nachname Rechnung 17.06.2013 Anwaltschaft Baur GmbH Online.com Zurückgestellt
23.06.13 15:10 Gefunden: Backdoor.Win32.Androm.xpe C:/Users/Büro/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/MGGQOIMF/Mahnung Vorname_Nachname vom 17.06.2013 Rechtsanwalt Baur GmbH Online.zip/Forderung fur Vorname_Nachname Inkasso Baur GmbH Online 17.06.2013.zip/Vorname_Nachname Rechnung 17.06.2013 Anwaltschaft Baur GmbH Online.com
23.06.13 15:10 Nicht desinfizierte Objekte: Backdoor.Win32.Androm.xpe C:/Users/Büro/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/MGGQOIMF/Mahnung Vorname_Nachname vom 17.06.2013 Rechtsanwalt Baur GmbH Online (1).zip/Forderung fur Vorname_Nachname Inkasso Baur GmbH Online 17.06.2013.zip/Vorname_Nachname Rechnung 17.06.2013 Anwaltschaft Baur GmbH Online.com Zurückgestellt
23.06.13 15:10 Gefunden: Backdoor.Win32.Androm.xpe C:/Users/Büro/AppData/Local/Microsoft/Windows/Temporary Internet Files/Content.IE5/MGGQOIMF/Mahnung Vorname_Nachname vom 17.06.2013 Rechtsanwalt Baur GmbH Online (1).zip/Forderung fur Vorname_Nachname Inkasso Baur GmbH Online 17.06.2013.zip/Vorname_Nachname Rechnung 17.06.2013 Anwaltschaft Baur GmbH Online.com
23.06.13 15:05 Nicht desinfizierte Objekte: Trojan.Win32.Bublik.azqb C:/Users/Büro/AppData/Roaming/monpplay.exe Zurückgestellt
23.06.13 15:05 Gefunden: Trojan.Win32.Bublik.azqb C:/Users/Büro/AppData/Roaming/monpplay.exe
23.06.13 15:03 Nicht desinfizierte Objekte: HEUR:Trojan.Win32.Generic C:/ProgramData/COMODO/Cis/Quarantine/data/{C468F30A-EA35-4CF7-93A7-B4BF3BA60B52} Zurückgestellt
23.06.13 15:03 Gefunden: HEUR:Trojan.Win32.Generic C:/ProgramData/COMODO/Cis/Quarantine/data/{C468F30A-EA35-4CF7-93A7-B4BF3BA60B52}
23.06.13 14:58 Aufgabe wurde gestartet
deshalb bin ich mal die Anleitung durchgegangen, und poste nun hier ... Schritt 1: Laufwerksemulationen abschalten mit Defogger check -> defogger_disable Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:59 on 09/08/2013 (Büro)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
check -> FRST / Addition Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2013 02
Ran by Büro (administrator) on 09-08-2013 19:02:36
Running from C:\Users\Büro\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Iminent) C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
MountPoints2: J - J:\LaunchU3.exe -a
MountPoints2: {07c0a885-45e4-11e1-a030-0025227d9650} - J:\Startme.exe
MountPoints2: {1fac21e7-d1bb-11e2-b336-0025227d9650} - J:\DPFMate.exe
MountPoints2: {824bb73d-9abe-11e2-8ef5-0025227d9650} - J:\LaunchU3.exe -a
MountPoints2: {c9c27b06-77c4-11e0-9547-0025227d9650} - K:\AutoRun.exe
MountPoints2: {fb938322-9a82-11e1-83d7-0025227d9650} - J:\Startme.exe
MountPoints2: {fb93833b-9a82-11e1-83d7-0025227d9650} - J:\Startme.exe
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-04-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-07-05] (Kaspersky Lab ZAO)
==================== Internet (Whitelisted) ====================
ProxyServer: http=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
URLSearchHook: (No Name) - {D8278076-BC68-4484-9233-6E7F1628B56C} - No File
SearchScopes: HKLM-x32 - DefaultScope {410C57FB-D30D-47B9-91B2-E2BA033B68DA} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=313812821&q={searchTerms}
SearchScopes: HKCU - DefaultScope {410C57FB-D30D-47B9-91B2-E2BA033B68DA} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3242337&CUI=UN32107749341169918&UM=1
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&affID=119556&tt=gc_&babsrc=SP_ss&mntrId=72860025227D9650
SearchScopes: HKCU - {410C57FB-D30D-47B9-91B2-E2BA033B68DA} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3242337&CUI=UN32107749341169918&UM=1
SearchScopes: HKCU - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=313812821&q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Iminent.WebBooster.InternetExplorer.dll (Iminent)
BHO-x32: Wajam - {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} - C:\Program Files (x86)\Wajam\IE\priam_bho.dll No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default
FF user.js: detected! => C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\user.js
FF Homepage: www.google.de
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.6.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.6.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Büro\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Büro\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\searchplugins\BrowserProtect.xml
FF SearchPlugin: C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\searchplugins\ChatZumSearch.xml
FF SearchPlugin: C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\searchplugins\delta.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF Extension: No Name - C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\Extensions\staged
FF Extension: No Name - C:\Users\Büro\AppData\Roaming\Mozilla\Firefox\Profiles\p8lmd6ji.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [webbooster@iminent.com] C:\Program Files (x86)\Iminent\webbooster@iminent.com
FF Extension: No Name - C:\Program Files (x86)\Iminent\webbooster@iminent.com
FF HKLM-x32\...\Firefox\Extensions: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
Chrome:
=======
CHR HomePage: hxxp://www.search.ask.com/?l=dis&o=APN10462cr&gct=hp&apn_ptnrs=^AKM&apn_dtid=^zzz035^YY^DE&p2=^AKM^zzz035^YY^DE&tpid=ATU4&apn_dbr=cr_26.0.1410.64&apn_uid=82C0293C-EA81-42D5-9B15-3E8E00EF86C7&itbv=11.8.2.658&doi=2013-05-14
CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?affID=119556&tt=gc_&babsrc=HP_ss&mntrId=72860025227D9650"
CHR DefaultSearchURL: (Delta Search) - hxxp://www1.delta-search.com/?q={searchTerms}&affID=119556&tt=gc_&babsrc=SP_ss&mntrId=72860025227D9650
CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.60.24) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U6) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Unity Player) - C:\Users\B\u00FCro\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Extension: (Kaspersky URL Advisor) - C:\Users\BRO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (DealPly) - C:\Users\BRO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.5.3.0_0
CHR Extension: (Safe Money) - C:\Users\BRO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Content Blocker) - C:\Users\BRO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0
CHR Extension: (Iminent) - C:\Users\BRO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl\6.21.4.1_0
CHR Extension: (Virtual Keyboard) - C:\Users\BRO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Anti-Banner) - C:\Users\BRO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [gaiilaahiahdejapggenmdmafpmbipje] - C:\Program Files (x86)\DealPly\DealPly.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-04-05] (Advanced Micro Devices, Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-07-05] (Kaspersky Lab ZAO)
R2 SProtection; C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe [2864448 2013-08-08] (Iminent)
S2 WajamUpdater; "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [x]
==================== Drivers (Whitelisted) ====================
S3 BrSerIf; C:\Windows\System32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [27648 2008-01-19] (Microsoft Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-07-05] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2012-10-25] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2012-10-25] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-05] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-05] (Kaspersky Lab ZAO)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-09 19:01 - 2013-08-09 19:01 - 01790169 _____ (Farbar) C:\Users\Büro\Desktop\FRST64.exe
2013-08-09 18:59 - 2013-08-09 18:59 - 00000470 _____ C:\Users\Büro\Desktop\defogger_disable.log
2013-08-09 18:59 - 2013-08-09 18:59 - 00000000 _____ C:\Users\Büro\defogger_reenable
2013-08-09 18:57 - 2013-08-09 18:57 - 00050477 _____ C:\Users\Büro\Desktop\Defogger.exe
2013-08-02 15:26 - 2013-08-02 15:26 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{EBDF2421-34D6-46F0-9509-36B9386E4031}
2013-08-01 15:09 - 2013-08-01 15:09 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{0A18896C-AC19-4A5A-89E9-1874F59A8128}
2013-08-01 12:08 - 2013-08-01 12:08 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{A36BF81B-5087-43D2-AB01-FCA2EFECDA10}
2013-07-31 10:09 - 2013-07-31 10:10 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{C41FD4F6-8888-4722-A6CF-FF2B65C4C74C}
2013-07-30 11:39 - 2013-07-30 11:39 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{99CF0FC4-65A3-4FB8-BC89-E97D73D4ECBA}
2013-07-29 19:15 - 2013-07-29 19:15 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{CE9ED7E4-40A9-4D74-AEAD-BBB24C21A7F9}
2013-07-29 10:13 - 2013-07-29 10:13 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{E5C62744-F069-479A-85C1-477FA1504B62}
2013-07-28 13:22 - 2013-07-28 13:22 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{3B3FA79A-DABC-4DEB-9C49-D7C173975537}
2013-07-26 17:09 - 2013-07-26 17:09 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{C04FC9BE-3E47-4BFF-A729-DA1BD71BA461}
2013-07-25 20:13 - 2013-07-25 20:13 - 00282760 _____ C:\Windows\Minidump\072513-18782-01.dmp
2013-07-24 17:51 - 2013-07-27 16:52 - 00037376 _____ C:\Users\Büro\Desktop\Dienstplan.xls
2013-07-24 17:51 - 2013-07-27 16:49 - 00037376 _____ C:\Users\Büro\Desktop\C4F9FB56.tmp
2013-07-24 17:51 - 2013-07-24 17:51 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{7A43C54B-64B5-412A-8575-EFD6AE08D417}
2013-07-22 08:47 - 2013-07-22 08:47 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{8043330C-A4AC-4977-9E03-C71785294155}
2013-07-21 18:38 - 2013-07-21 18:38 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{80332F91-F1BB-4FC4-862D-56A4419A071D}
2013-07-20 16:32 - 2013-07-20 16:33 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{912098F7-6884-4D71-9AB2-0E2AF62FB7DC}
2013-07-19 12:31 - 2013-07-19 12:32 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{789F9EA5-31DD-4BE3-B9B7-3A6CBBBC5C21}
2013-07-17 18:35 - 2013-07-17 18:35 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{16A0FBE8-DE1E-4A0C-9768-6917A7289416}
2013-07-14 18:52 - 2013-07-14 18:53 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{B66D0304-A14E-4C1A-AE63-C92329D38117}
2013-07-11 20:01 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 20:01 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 20:01 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 20:01 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 20:01 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 20:01 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 20:01 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 20:01 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 20:01 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 20:01 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 20:01 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 20:01 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 20:01 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 20:01 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 20:01 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 20:01 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 20:01 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 20:01 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 20:01 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 20:01 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 20:01 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 20:01 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 11:20 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 11:20 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 11:20 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 11:20 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 11:20 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 11:19 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 11:19 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-08-09 19:02 - 2013-08-09 19:02 - 00000000 ____D C:\FRST
2013-08-09 19:01 - 2013-08-09 19:01 - 01790169 _____ (Farbar) C:\Users\Büro\Desktop\FRST64.exe
2013-08-09 18:59 - 2013-08-09 18:59 - 00000470 _____ C:\Users\Büro\Desktop\defogger_disable.log
2013-08-09 18:59 - 2013-08-09 18:59 - 00000000 _____ C:\Users\Büro\defogger_reenable
2013-08-09 18:59 - 2011-04-29 18:55 - 00000000 ____D C:\Users\Büro
2013-08-09 18:58 - 2013-06-27 13:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-09 18:58 - 2009-07-14 06:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-09 18:58 - 2009-07-14 06:45 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-09 18:57 - 2013-08-09 18:57 - 00050477 _____ C:\Users\Büro\Desktop\Defogger.exe
2013-08-09 18:55 - 2011-04-29 18:46 - 01472019 _____ C:\Windows\WindowsUpdate.log
2013-08-09 18:51 - 2013-07-05 15:24 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-09 18:51 - 2013-03-27 14:45 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-09 18:50 - 2013-04-03 13:30 - 00014528 _____ C:\Windows\setupact.log
2013-08-09 18:50 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 21:10 - 2013-03-27 14:45 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-08 20:43 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-02 20:40 - 2012-06-27 17:26 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-02 15:26 - 2013-08-02 15:26 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{EBDF2421-34D6-46F0-9509-36B9386E4031}
2013-08-02 09:54 - 2010-11-21 08:50 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-08-02 09:54 - 2010-11-21 08:50 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-08-02 09:54 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-01 15:09 - 2013-08-01 15:09 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{0A18896C-AC19-4A5A-89E9-1874F59A8128}
2013-08-01 15:09 - 2012-09-02 15:07 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-08-01 12:08 - 2013-08-01 12:08 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{A36BF81B-5087-43D2-AB01-FCA2EFECDA10}
2013-07-31 10:10 - 2013-07-31 10:09 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{C41FD4F6-8888-4722-A6CF-FF2B65C4C74C}
2013-07-30 12:59 - 2012-06-27 17:26 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-30 12:59 - 2012-04-21 17:04 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-30 12:59 - 2011-06-07 18:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-30 12:59 - 2011-05-01 16:48 - 00000000 ____D C:\Users\BRO~1\AppData\Local\Adobe
2013-07-30 11:39 - 2013-07-30 11:39 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{99CF0FC4-65A3-4FB8-BC89-E97D73D4ECBA}
2013-07-29 19:15 - 2013-07-29 19:15 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{CE9ED7E4-40A9-4D74-AEAD-BBB24C21A7F9}
2013-07-29 10:13 - 2013-07-29 10:13 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{E5C62744-F069-479A-85C1-477FA1504B62}
2013-07-28 13:22 - 2013-07-28 13:22 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{3B3FA79A-DABC-4DEB-9C49-D7C173975537}
2013-07-27 16:52 - 2013-07-24 17:51 - 00037376 _____ C:\Users\Büro\Desktop\Dienstplan.xls
2013-07-27 16:49 - 2013-07-24 17:51 - 00037376 _____ C:\Users\Büro\Desktop\C4F9FB56.tmp
2013-07-26 17:09 - 2013-07-26 17:09 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{C04FC9BE-3E47-4BFF-A729-DA1BD71BA461}
2013-07-25 20:13 - 2013-07-25 20:13 - 00282760 _____ C:\Windows\Minidump\072513-18782-01.dmp
2013-07-25 20:13 - 2013-04-04 23:44 - 243815623 _____ C:\Windows\MEMORY.DMP
2013-07-25 20:13 - 2011-08-06 20:08 - 00000000 ____D C:\Windows\Minidump
2013-07-24 17:51 - 2013-07-24 17:51 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{7A43C54B-64B5-412A-8575-EFD6AE08D417}
2013-07-22 08:47 - 2013-07-22 08:47 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{8043330C-A4AC-4977-9E03-C71785294155}
2013-07-21 18:38 - 2013-07-21 18:38 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{80332F91-F1BB-4FC4-862D-56A4419A071D}
2013-07-20 16:33 - 2013-07-20 16:32 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{912098F7-6884-4D71-9AB2-0E2AF62FB7DC}
2013-07-20 15:14 - 2012-04-21 17:47 - 00000000 ____D C:\Users\Büro\AppData\Roaming\vlc
2013-07-19 12:32 - 2013-07-19 12:31 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{789F9EA5-31DD-4BE3-B9B7-3A6CBBBC5C21}
2013-07-19 11:40 - 2010-11-21 05:47 - 00262796 _____ C:\Windows\PFRO.log
2013-07-17 18:35 - 2013-07-17 18:35 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{16A0FBE8-DE1E-4A0C-9768-6917A7289416}
2013-07-14 18:53 - 2013-07-14 18:52 - 00000000 ____D C:\Users\BRO~1\AppData\Local\{B66D0304-A14E-4C1A-AE63-C92329D38117}
2013-07-13 19:05 - 2013-03-27 14:45 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 19:05 - 2013-03-27 14:45 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 11:42 - 2009-07-14 06:45 - 00386256 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 11:41 - 2013-03-14 19:55 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 11:41 - 2013-03-14 19:55 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 11:41 - 2010-11-21 09:01 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 11:41 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 11:41 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 20:06 - 2011-05-01 17:04 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 20:02 - 2011-04-29 19:05 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-02 00:12
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-08-2013 02
Ran by Büro at 2013-08-09 19:03:28
Running from C:\Users\Büro\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 9.20 (x32)
Adobe AIR (x32 Version: 3.1.0.4880)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.0.112)
Advertising Center (x32 Version: 0.0.0.2)
AMD APP SDK Runtime (Version: 2.4.595.10)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Fuel (Version: 2011.0405.2218.38205)
AMD VISION Engine Control Center (x32 Version: 2011.0405.2218.38205)
ATI Catalyst Install Manager (Version: 3.0.820.0)
Brother MFL-Pro Suite MFC-5490CN (x32 Version: 1.0.1.0)
Bundled software uninstaller (x32)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0405.2218.38205)
Catalyst Control Center InstallProxy (x32 Version: 2011.0405.2218.38205)
CCC Help English (x32 Version: 2011.0405.2217.38205)
ccc-utility64 (Version: 2011.0405.2218.38205)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
DolbyFiles (x32 Version: 2.0)
eReg (x32 Version: 1.20.138.34)
Google Chrome (x32 Version: 28.0.1500.95)
Google Update Helper (x32 Version: 1.3.21.153)
ImagXpress (x32 Version: 7.0.74.0)
Iminent (x32 Version: 6.4.56.0)
Java 7 Update 6 (x32 Version: 7.0.60)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
Logitech SetPoint 6.22 (Version: 6.22.24)
Menu Templates - Starter Kit (x32 Version: 9.4.6.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Movie Templates - Starter Kit (x32 Version: 9.4.6.0)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Nero 9 (x32)
Nero BurnRights (x32 Version: 3.4.13.100)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero CoverDesigner (x32 Version: 4.4.12.100)
Nero Disc Copy Gadget (x32 Version: 2.4.34.0)
Nero DiscSpeed (x32 Version: 5.4.13.100)
Nero DriveSpeed (x32 Version: 4.4.12.100)
Nero InfoTool (x32 Version: 6.4.12.100)
Nero Installer (x32 Version: 4.4.9.0)
Nero PhotoSnap (x32 Version: 2.4.28.0)
Nero Recode (x32 Version: 4.4.38.1)
Nero Rescue Agent (x32 Version: 2.4.14.100)
Nero ShowTime (x32 Version: 5.4.21.100)
Nero StartSmart (x32 Version: 9.4.19.100)
Nero Vision (x32 Version: 6.4.16.100)
Nero WaveEditor (x32 Version: 5.4.37.1)
NeroBurningROM (x32 Version: 9.4.26.100)
NeroExpress (x32 Version: 9.4.26.100)
neroxml (x32 Version: 1.0.0)
NVIDIA PhysX (x32 Version: 9.09.0814)
P 2.8.0 (Version: 2.8.0)
Radmin Viewer 3.4 (x32 Version: 3.41.0000)
SoundTrax (x32 Version: 4.4.37.1)
swMSM (x32 Version: 12.0.0.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
VLC media player 2.0.1 (x32 Version: 2.0.1)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
WinRAR 4.00 (64-Bit) (Version: 4.00.0)
WMV9/VC-1 Video Playback (Version: 1.00.0000)
==================== Restore Points =========================
10-07-2013 17:01:06 Windows Update
11-07-2013 17:57:04 Windows Update
14-07-2013 20:08:15 Windows Update
19-07-2013 11:33:21 Windows Update
25-07-2013 18:54:11 Windows Update
31-07-2013 17:33:17 Windows Update
08-08-2013 19:09:31 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2012-10-06 13:19 - 00000822 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0157BD37-0A02-44D3-8AE3-EC802CA6917C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-27] (Google Inc.)
Task: {27FAF88C-63A8-4625-8FDA-035BA0198D72} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {2D87670D-7729-4AC8-9E95-3D44681FF0D8} - System32\Tasks\DealPlyUpdate => C:\Program Files (x86)\DealPly\DealPlyUpdate.exe [2012-07-23] (DealPly)
Task: {75AEA918-41C9-4417-B10C-8E7584D6763E} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {A2078767-75C6-405E-AAB6-F3FEC5E83C7C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-30] (Adobe Systems Incorporated)
Task: {A9DC6958-BEB7-4611-81A3-543FFCC82EB6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-27] (Google Inc.)
Task: {EFB5ED66-9748-4CBE-8953-5419895CB2E1} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-21] (Microsoft Corporation)
Task: {FE41F38A-9964-4787-832C-1E4B20B2C670} - System32\Tasks\User_Feed_Synchronization-{6547452D-6362-484A-8A61-090ECAD209F4} => C:\Windows\system32\msfeedssync.exe [2013-03-29] (Microsoft Corporation)
Task: {FEE9DD62-AE5E-4FCD-83F9-6D3111D966FB} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/09/2013 06:52:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/08/2013 08:45:04 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/02/2013 08:38:38 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:38.636]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:37 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:37.092]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:35 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:35.547]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:34 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:34.003]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:32 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:32.459]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:30 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:30.914]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:29 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:29.370]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:27 PM) (Source: Brother BrLog) (User: )
Description: WDLMW BrtWDLMW: [2013/08/02 20:38:27.825]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
System errors:
=============
Error: (08/09/2013 06:51:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WajamUpdater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/08/2013 08:43:27 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WajamUpdater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/02/2013 08:19:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WajamUpdater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/02/2013 03:25:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WajamUpdater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/01/2013 00:07:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WajamUpdater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/31/2013 10:05:57 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WajamUpdater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/31/2013 10:05:53 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%-2147014847
Error: (07/31/2013 10:05:47 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 30.07.2013 um 19:24:30 unerwartet heruntergefahren.
Error: (07/30/2013 06:48:47 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WajamUpdater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/30/2013 06:48:35 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 30.07.2013 um 18:47:01 unerwartet heruntergefahren.
Microsoft Office Sessions:
=========================
Error: (08/09/2013 06:52:39 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/08/2013 08:45:04 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/02/2013 08:38:38 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:38.636]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:37 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:37.092]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:35 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:35.547]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:34 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:34.003]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:32 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:32.459]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:30 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:30.914]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:29 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:29.370]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
Error: (08/02/2013 08:38:27 PM) (Source: Brother BrLog)(User: )
Description: WDLMWBrtWDLMW: [2013/08/02 20:38:27.825]: [00003156]: lperrcode->api = 1 , lperrcode->code = 2
CodeIntegrity Errors:
===================================
Date: 2013-08-01 13:51:17.381
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-01 13:51:17.381
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-01 13:51:17.381
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-01 13:51:17.350
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-01 13:51:17.334
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-01 13:51:17.334
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-31 12:00:17.343
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-31 12:00:17.340
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-31 12:00:17.336
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-31 12:00:17.308
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 36%
Total physical RAM: 4095.24 MB
Available physical RAM: 2618.01 MB
Total Pagefile: 8188.67 MB
Available Pagefile: 6213.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:195.21 GB) (Free:140.18 GB) NTFS (Disk=0 Partition=2)
Drive d: (Daten) (Fixed) (Total:736.2 GB) (Free:694.03 GB) NTFS (Disk=0 Partition=3)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 2365085E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=736 GB) - (Type=07 NTFS)
==================== End Of Log ============================
check -> GMER Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-09 19:13:45
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD103SJ rev.1AJ10001 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\BRO~1\AppData\Local\Temp\kwtdqpog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[1560] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007726fa88 5 bytes JMP 00000001736219b0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[1560] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077270018 5 bytes JMP 0000000173622066
.text C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe[652] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076391465 2 bytes [39, 76]
.text C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe[652] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763914bb 2 bytes [39, 76]
.text ... * 2
---- EOF - GMER 2.1 ----
Hoffe ich habe soweit nichts vergessen und bedanke mich schonmal herzlich für die "Bearbeitung"  Viele Grüße m0rPh |
| Themen zu Win7: PC säubern nach schädlichem Mail-Anhang und diversen "Programmen" |
| anwaltschaft, backdoor.win32.androm.xpe, branding, e-mail anhang, ebanking, farbar, farbar recovery scan tool, heur:trojan.win32.generic, hotspot, js/adware.yontoo.a, kaspersky, kaspersky internet security 2013, klelam.sys, minidump, mozilla, ntdll.dll, online.zip/forderung, plug-in, pup.lyricsad, pup.optional.dealply.a, pup.optional.delta.a, pup.optional.inbox, rundll, services.exe, software, svchost.exe, trojan.win32.bublik.azqb, updates, win32/adware.addlyrics.f, win32/hoax.archsms.abz, win32/startpage.oph, winlogon.exe, zugänglich |
Baum-Darstellung