| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Problem mit MonsterMarketPlaceWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
27.08.2013, 13:14
| #1 |
| |  Problem mit MonsterMarketPlace Hallo zusammen, ich habe die gleichen Probleme wie die Person im Thread Eigentlich wollte ich darunter posten. Die Regelung besagte, ich müsse einen eigenen Thread hierzu öffnen. Sollte ich es falsch verstanden haben, bitte ich um Entschuldigung. Mein PC ist "eigentlich" seit ich ihn habe rein und wird eigentlich nur ab und an zum Surfen benutzt. Als ich mir einen Font gedownloaded habe, scheine ich mir Monster Market Place eingefangen zu haben. Mir ist anfänglich nichts aufgefallen, außer dass diverse Worte grün sind. Eigentlich ging ich von einer Add On aus. Da ich die vermeintliche Add on aber weder wissentlich installiert habe, noch diese überhaupt in Firefox finden konnte, bin ich stutzig geworden und habe euch bei Google gefunden. Gemäß des oben verlinkten Threads habe ich FRST 64bit gedownloadet und starten lassen. Hier nun die Daten, die mir das System gegeben hat. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-08-2013 01
Ran by areisha (administrator) on 27-08-2013 13:58:32
Running from C:\Users\areisha\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesApp64.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [itype] - C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] - c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2495088 2010-10-27] (VIA)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com/?l=dis&o=14597
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: (No Name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No File
SearchScopes: HKCU - DefaultScope {5E21DA43-A3D7-4DB8-9ACC-D189E11E1660} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {03BB546E-DB37-466F-9E6F-AC143ADC1462} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=crm&q={searchTerms}&locale=&apn_ptnrs=^FV&apn_dtid=^YYYYYY^YY^CA&apn_uid=b1379444-98c2-4bc0-972d-20c245a19393&apn_sauid=DAA82FC7-50DB-413D-ACA2-CD5EF25566BF
SearchScopes: HKCU - {5E21DA43-A3D7-4DB8-9ACC-D189E11E1660} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=20&locale=de_DE&gct=kwd&qsrc=2869
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Lyrics-Pal - {3368cedd-e315-4f93-96a1-3d50a47a3f40} - C:\Program Files (x86)\LyricsPal\125.dll (LyricsPal Soft. LTD)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\5.9\pdfforgeToolbarIE.dll (Spigot, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\5.9\pdfforgeToolbarIE.dll (Spigot, Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: msdaipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\areisha\AppData\Roaming\Mozilla\Firefox\Profiles\mwgw58wf.default
FF user.js: detected! => C:\Users\areisha\AppData\Roaming\Mozilla\Firefox\Profiles\mwgw58wf.default\user.js
FF Homepage: about:home
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\areisha\AppData\Roaming\Mozilla\Firefox\Profiles\mwgw58wf.default\searchplugins\askcom.xml
FF Extension: pdfforge - C:\Users\areisha\AppData\Roaming\Mozilla\Firefox\Profiles\mwgw58wf.default\Extensions\pdfforge@mybrowserbar.com
FF Extension: wtxpcom - C:\Users\areisha\AppData\Roaming\Mozilla\Firefox\Profiles\mwgw58wf.default\Extensions\wtxpcom@mybrowserbar.com
FF Extension: No Name - C:\Users\areisha\AppData\Roaming\Mozilla\Firefox\Profiles\mwgw58wf.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFFPlgn\
FF HKCU\...\Firefox\Extensions: [{9309FA47-1B48-4768-AFA4-9E0556F5DC81}] C:\Program Files (x86)\LyricsPal\125.xpi
FF Extension: No Name - C:\Program Files (x86)\LyricsPal\125.xpi
==================== Services (Whitelisted) =================
R2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)
S4 AdobeActiveFileMonitor6.0; C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832 2007-09-11] ()
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [2143072 2012-05-29] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
S3 a8djavs; C:\Windows\System32\Drivers\a8djavs.sys [358480 2012-02-22] (Native Instruments GmbH)
S3 a8djavs_x64; C:\Windows\System32\Drivers\a8djavs_x64.sys [46096 2008-09-10] (Native Instruments GmbH)
S3 a8djusb_svc; C:\Windows\System32\Drivers\a8djusb.sys [97872 2012-02-22] (Native Instruments GmbH)
S3 a8djusb_x64; C:\Windows\System32\Drivers\a8djusb_x64.sys [233488 2008-09-10] (Native Instruments GmbH)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130826.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130826.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [27648 2008-01-19] (Microsoft Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130826.025\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130826.025\ENG64.SYS [126040 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130826.025\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20130826.025\EX64.SYS [2098776 2013-05-22] (Symantec Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-11-16] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2010-11-16] (RapidSolution Software AG)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-20] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [11856 2012-05-08] (TuneUp Software)
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
S3 netr7364; system32\DRIVERS\netr7364.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-27 13:57 - 2013-08-27 13:57 - 01578852 _____ (Farbar) C:\Users\areisha\Downloads\FRST64.exe
2013-08-26 23:20 - 2013-08-26 23:20 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\areisha\Downloads\SpyHunter-Installer.exe
2013-08-26 18:39 - 2013-08-27 12:26 - 00000112 _____ C:\Windows\setupact.log
2013-08-24 12:40 - 2013-08-24 12:50 - 383069206 _____ C:\Users\areisha\Downloads\X17-24288.iso.part
2013-08-24 11:21 - 2013-08-24 11:25 - 05487040 _____ (Microsoft Corporation) C:\Users\areisha\Downloads\Windows8-Setup.exe
2013-08-19 22:35 - 2013-08-19 22:35 - 00071010 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_NichtGelistet.xlsx
2013-08-19 22:33 - 2013-08-19 22:33 - 01929886 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_NeuDistribution(1).xlsx
2013-08-19 22:18 - 2013-08-19 22:18 - 00806969 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_Übersichten.xlsx
2013-08-19 21:58 - 2013-08-19 21:58 - 00563420 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_NeuDistribution.xlsx
2013-08-18 21:43 - 2013-08-18 21:46 - 00000000 ____D C:\Users\areisha\Desktop\19082013
2013-08-18 03:07 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-18 03:07 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-18 03:07 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-18 03:07 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-18 03:07 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-18 03:07 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-18 03:07 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-18 03:07 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-18 03:07 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-18 03:07 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-18 03:07 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-18 03:07 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-18 03:07 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-18 03:07 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-18 03:01 - 2013-08-18 03:02 - 00000000 ____D C:\Windows\system32\MRT
2013-08-17 14:28 - 2013-08-17 14:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 11:43 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-17 11:43 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-17 11:43 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-17 11:43 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-17 11:43 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-17 11:43 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-17 11:43 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-17 11:43 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-17 11:43 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-17 11:43 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-17 11:43 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-17 11:43 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-17 11:43 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-17 11:43 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-17 11:43 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-17 11:43 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-10 15:23 - 2013-08-18 15:55 - 00000000 ____D C:\Users\areisha\Desktop\springg
2013-08-07 16:15 - 2013-08-08 15:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-06 15:13 - 2013-08-26 23:44 - 00000000 ____D C:\Program Files (x86)\LyricsPal
2013-08-06 15:11 - 2013-08-06 15:11 - 00771345 _____ C:\Users\areisha\Desktop\logo_nobile.psd
2013-08-06 15:10 - 2013-08-06 15:10 - 01428318 _____ C:\Users\areisha\Downloads\khryskreations_kbplanetearth.zip
2013-08-06 15:10 - 2013-08-06 15:10 - 00206828 _____ C:\Users\areisha\Downloads\agasilva_starspromo.zip
2013-08-06 15:10 - 2013-08-06 15:10 - 00091032 _____ C:\Users\areisha\Downloads\nymphont_lt-chickenhawk.zip
2013-08-06 15:10 - 2013-08-06 15:10 - 00054299 _____ C:\Users\areisha\Downloads\bythebutterfly_lovenessthree.zip
2013-08-06 15:09 - 2013-08-06 15:09 - 01428625 _____ C:\Users\areisha\Downloads\khryskreations_kbthesilentnight.zip
2013-08-06 15:09 - 2013-08-06 15:09 - 00353495 _____ C:\Users\areisha\Downloads\luedecke-design-font-co_nineteenohfive.zip
2013-08-06 15:09 - 2013-08-06 15:09 - 00304562 _____ C:\Users\areisha\Downloads\intellecta-design_cornpop.zip
2013-08-06 15:08 - 2013-08-06 15:08 - 00619425 _____ C:\Users\areisha\Downloads\billy-argel_panhead.zip
2013-08-06 15:08 - 2013-08-06 15:08 - 00619425 _____ C:\Users\areisha\Downloads\billy-argel_panhead(1).zip
2013-08-06 15:08 - 2013-08-06 15:08 - 00057011 _____ C:\Users\areisha\Downloads\david-kerkhoff_neues-bauen.zip
2013-08-06 15:07 - 2013-08-06 15:07 - 01503188 _____ C:\Users\areisha\Downloads\kc-fonts_scribble-box.zip
2013-08-06 15:07 - 2013-08-06 15:07 - 00623930 _____ C:\Users\areisha\Downloads\kc-fonts_urban-jungle.zip
2013-08-06 15:06 - 2013-08-06 15:06 - 00163384 _____ () C:\Users\areisha\Downloads\WoodShapes_downloader_by_Ffonts.exe
2013-08-06 15:05 - 2013-08-06 15:05 - 00163312 _____ () C:\Users\areisha\Downloads\CartwrightRegular_downloader_by_Ffonts.exe
2013-08-06 15:05 - 2013-08-06 15:05 - 00163224 _____ () C:\Users\areisha\Downloads\AlphaWood_downloader_by_Ffonts.exe
2013-08-05 23:58 - 2013-08-05 23:58 - 06093590 _____ C:\Users\areisha\Downloads\decade-typefoundry_appleton.zip
2013-08-05 23:58 - 2013-08-05 23:58 - 01641081 _____ C:\Users\areisha\Downloads\måns-grebäck_recorda-script-personal-use-onl.zip
2013-08-05 16:42 - 2013-08-05 16:42 - 00000000 ____D C:\Program Files\Common Files\Steinberg
2013-08-05 16:41 - 2013-08-05 16:42 - 00000000 ____D C:\Program Files (x86)\eLicenser
2013-08-05 16:41 - 2013-08-05 16:41 - 00000000 ____D C:\Program Files (x86)\Syncrosoft
2013-08-05 16:30 - 2013-08-05 17:04 - 00000000 ____D C:\Users\areisha\Desktop\05082013
2013-08-05 10:42 - 2013-08-06 15:11 - 00000000 ____D C:\Users\areisha\Desktop\Sommerfest
2013-07-31 16:50 - 2013-07-31 16:52 - 61425512 _____ C:\Users\areisha\Downloads\Audials_One-Setup(3).exe
==================== One Month Modified Files and Folders =======
2013-08-27 13:58 - 2013-08-27 13:58 - 00000000 ____D C:\FRST
2013-08-27 13:57 - 2013-08-27 13:57 - 01578852 _____ (Farbar) C:\Users\areisha\Downloads\FRST64.exe
2013-08-27 13:49 - 2011-08-11 18:30 - 00003946 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{DAF85A5E-7D83-4AF9-AA33-394C79A498C6}
2013-08-27 13:43 - 2013-05-26 18:56 - 00000000 ___RD C:\Users\areisha\Desktop\Records
2013-08-27 13:42 - 2011-12-12 22:57 - 00000000 ____D C:\Users\areisha\Desktop\2011
2013-08-27 13:37 - 2010-11-21 08:50 - 00696832 _____ C:\Windows\system32\perfh007.dat
2013-08-27 13:37 - 2010-11-21 08:50 - 00148128 _____ C:\Windows\system32\perfc007.dat
2013-08-27 13:37 - 2009-07-14 07:13 - 01613340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-27 13:33 - 2013-05-13 22:44 - 00000000 ____D C:\Users\areisha\Desktop\areisha
2013-08-27 13:06 - 2011-08-09 21:14 - 01669928 _____ C:\Windows\WindowsUpdate.log
2013-08-27 12:34 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-27 12:34 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-27 12:26 - 2013-08-26 18:39 - 00000112 _____ C:\Windows\setupact.log
2013-08-27 12:26 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-27 07:44 - 2012-04-05 22:44 - 00000000 ____D C:\Users\areisha\AppData\Roaming\Spotify
2013-08-26 23:45 - 2012-03-12 22:15 - 00000000 ____D C:\Program Files (x86)\Vstplugins
2013-08-26 23:44 - 2013-08-06 15:13 - 00000000 ____D C:\Program Files (x86)\LyricsPal
2013-08-26 23:20 - 2013-08-26 23:20 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\areisha\Downloads\SpyHunter-Installer.exe
2013-08-26 23:14 - 2012-04-05 22:45 - 00000000 ____D C:\Users\areisha\AppData\Local\Spotify
2013-08-25 21:47 - 2012-09-24 07:17 - 00000000 ____D C:\Users\areisha\Desktop\STUDIUM
2013-08-24 12:50 - 2013-08-24 12:40 - 383069206 _____ C:\Users\areisha\Downloads\X17-24288.iso.part
2013-08-24 11:25 - 2013-08-24 11:21 - 05487040 _____ (Microsoft Corporation) C:\Users\areisha\Downloads\Windows8-Setup.exe
2013-08-20 07:21 - 2012-05-21 07:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-20 00:10 - 2013-01-11 18:26 - 00000000 ____D C:\Users\areisha\AppData\Local\CrashDumps
2013-08-19 22:35 - 2013-08-19 22:35 - 00071010 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_NichtGelistet.xlsx
2013-08-19 22:33 - 2013-08-19 22:33 - 01929886 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_NeuDistribution(1).xlsx
2013-08-19 22:18 - 2013-08-19 22:18 - 00806969 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_Übersichten.xlsx
2013-08-19 21:58 - 2013-08-19 21:58 - 00563420 _____ C:\Users\areisha\Downloads\Iglo_Dg_2013_1_NeuDistribution.xlsx
2013-08-18 22:07 - 2012-02-23 08:19 - 00000000 ___RD C:\Users\areisha\Desktop\knarzn Project
2013-08-18 21:46 - 2013-08-18 21:43 - 00000000 ____D C:\Users\areisha\Desktop\19082013
2013-08-18 15:55 - 2013-08-10 15:23 - 00000000 ____D C:\Users\areisha\Desktop\springg
2013-08-18 04:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-18 03:02 - 2013-08-18 03:01 - 00000000 ____D C:\Windows\system32\MRT
2013-08-18 03:01 - 2011-11-16 12:16 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-17 14:28 - 2013-08-17 14:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-10 22:04 - 2012-09-28 07:10 - 00000000 ____D C:\Users\areisha\Desktop\Aufnahmen
2013-08-10 03:07 - 2011-08-09 21:21 - 00000000 ____D C:\Users\areisha
2013-08-10 03:06 - 2009-07-14 04:34 - 62652416 _____ C:\Windows\system32\config\SOFTWARE_tureg_old
2013-08-10 03:06 - 2009-07-14 04:34 - 19136512 _____ C:\Windows\system32\config\SYSTEM_tureg_old
2013-08-10 03:06 - 2009-07-14 04:34 - 00024576 _____ C:\Windows\system32\config\SECURITY_tureg_old
2013-08-10 02:57 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\DEFAULT_tureg_old
2013-08-10 02:57 - 2009-07-14 04:34 - 00061440 _____ C:\Windows\system32\config\SAM_tureg_old
2013-08-08 15:03 - 2013-08-07 16:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 19:57 - 2009-07-14 06:45 - 00383024 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-06 16:20 - 2011-08-14 18:39 - 00093320 _____ C:\Users\areisha\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-06 15:11 - 2013-08-06 15:11 - 00771345 _____ C:\Users\areisha\Desktop\logo_nobile.psd
2013-08-06 15:11 - 2013-08-05 10:42 - 00000000 ____D C:\Users\areisha\Desktop\Sommerfest
2013-08-06 15:10 - 2013-08-06 15:10 - 01428318 _____ C:\Users\areisha\Downloads\khryskreations_kbplanetearth.zip
2013-08-06 15:10 - 2013-08-06 15:10 - 00206828 _____ C:\Users\areisha\Downloads\agasilva_starspromo.zip
2013-08-06 15:10 - 2013-08-06 15:10 - 00091032 _____ C:\Users\areisha\Downloads\nymphont_lt-chickenhawk.zip
2013-08-06 15:10 - 2013-08-06 15:10 - 00054299 _____ C:\Users\areisha\Downloads\bythebutterfly_lovenessthree.zip
2013-08-06 15:09 - 2013-08-06 15:09 - 01428625 _____ C:\Users\areisha\Downloads\khryskreations_kbthesilentnight.zip
2013-08-06 15:09 - 2013-08-06 15:09 - 00353495 _____ C:\Users\areisha\Downloads\luedecke-design-font-co_nineteenohfive.zip
2013-08-06 15:09 - 2013-08-06 15:09 - 00304562 _____ C:\Users\areisha\Downloads\intellecta-design_cornpop.zip
2013-08-06 15:08 - 2013-08-06 15:08 - 00619425 _____ C:\Users\areisha\Downloads\billy-argel_panhead.zip
2013-08-06 15:08 - 2013-08-06 15:08 - 00619425 _____ C:\Users\areisha\Downloads\billy-argel_panhead(1).zip
2013-08-06 15:08 - 2013-08-06 15:08 - 00057011 _____ C:\Users\areisha\Downloads\david-kerkhoff_neues-bauen.zip
2013-08-06 15:07 - 2013-08-06 15:07 - 01503188 _____ C:\Users\areisha\Downloads\kc-fonts_scribble-box.zip
2013-08-06 15:07 - 2013-08-06 15:07 - 00623930 _____ C:\Users\areisha\Downloads\kc-fonts_urban-jungle.zip
2013-08-06 15:06 - 2013-08-06 15:06 - 00163384 _____ () C:\Users\areisha\Downloads\WoodShapes_downloader_by_Ffonts.exe
2013-08-06 15:05 - 2013-08-06 15:05 - 00163312 _____ () C:\Users\areisha\Downloads\CartwrightRegular_downloader_by_Ffonts.exe
2013-08-06 15:05 - 2013-08-06 15:05 - 00163224 _____ () C:\Users\areisha\Downloads\AlphaWood_downloader_by_Ffonts.exe
2013-08-05 23:58 - 2013-08-05 23:58 - 06093590 _____ C:\Users\areisha\Downloads\decade-typefoundry_appleton.zip
2013-08-05 23:58 - 2013-08-05 23:58 - 01641081 _____ C:\Users\areisha\Downloads\måns-grebäck_recorda-script-personal-use-onl.zip
2013-08-05 17:04 - 2013-08-05 16:30 - 00000000 ____D C:\Users\areisha\Desktop\05082013
2013-08-05 16:42 - 2013-08-05 16:42 - 00000000 ____D C:\Program Files\Common Files\Steinberg
2013-08-05 16:42 - 2013-08-05 16:41 - 00000000 ____D C:\Program Files (x86)\eLicenser
2013-08-05 16:42 - 2011-08-28 13:06 - 00001101 _____ C:\Users\Public\Desktop\WaveLab LE 7.lnk
2013-08-05 16:42 - 2011-08-28 13:04 - 00000051 _____ C:\Windows\SysWOW64\SYNSOPOS.exe.cfg
2013-08-05 16:41 - 2013-08-05 16:41 - 00000000 ____D C:\Program Files (x86)\Syncrosoft
2013-08-05 16:41 - 2011-08-28 13:04 - 00000000 ____D C:\ProgramData\eLicenser
2013-07-31 16:52 - 2013-07-31 16:50 - 61425512 _____ C:\Users\areisha\Downloads\Audials_One-Setup(3).exe
Files to move or delete:
====================
C:\Users\areisha\AppData\Local\Temp\lyricspal_1060-8101_v122.exe
C:\Users\areisha\AppData\Local\Temp\SHSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-12 00:58
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-08-2013 01
Ran by areisha at 2013-08-27 13:59:10
Running from C:\Users\areisha\Downloads
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
7-Zip 9.20 (x32)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Ableton Live 8 Beta (Version: 8.0.0.0)
Adobe AIR (x32 Version: 3.2.0.2070)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Photoshop Elements 10 (x32 Version: 10.0)
Adobe Photoshop Elements 6.0 (x32 Version: 6.0)
Adobe Reader X (10.1.2) (x32 Version: 10.1.2)
Adobe Reader X (10.1.3) - Deutsch (x32 Version: 10.1.3)
Ashampoo Burning Studio 6 FREE v.6.83 (x32 Version: 6.8.3)
Audials (x32 Version: 10.2.18602.200)
Audials (x32 Version: 9.1.31900.0)
Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6514.5001)
DHTML Editing Component (x32 Version: 6.02.0001)
Direct Show Ogg Vorbis Filter (remove only) (x32)
Elements 10 Organizer (x32 Version: 10.0)
eLicenser Control (x32)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2104)
Java Auto Updater (x32 Version: 2.0.5.1)
Java(TM) 6 Update 26 (x32 Version: 6.0.260)
K-Lite Codec Pack 6.0.4 (Basic) (x32 Version: 6.0.4)
Live 8.0 (x32)
Live 8.2.2 (x32)
Live 8.2.6 (x32)
Lyrics-Pal (x32)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0)
Microsoft IntelliType Pro 8.2 (Version: 8.20.469.0)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
minimoog-v Original 2.5.3 (x32 Version: 2.5.3)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.8 (x86 en-US) (x32 Version: 17.0.8)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Native Instruments Audio 8 DJ Driver (Version: 3.0.3.696)
Native Instruments Audio 8 DJ Driver (x32)
Native Instruments Service Center (HKCU)
Native Instruments Service Center (Version: 2.0.5)
Native Instruments Traktor (Version: 1.0)
Native Instruments Traktor (x32)
Norton Internet Security CBE (x32 Version: 20.4.0.40)
pdfforge Toolbar v5.9 (x32 Version: 5.9)
PixiePack Codec Pack (x32 Version: 1.1.1200.0)
Platform (x32 Version: 1.34)
PSE10 STI Installer (x32 Version: 10.0)
Realtek Ethernet Controller Driver For Windows Vista and Later (x32 Version: 1.00.0009)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Samsung_MonSetup (x32 Version: 1.00.0000)
Service Center Setup (x32 Version: 1.0)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Tunebite (x32 Version: 7.2.13700.0)
TuneUp Utilities 2012 (x32 Version: 12.0.3600.73)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4600.4)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.3600.73)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.6030.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
VIA Plattform-Geräte-Manager (x32 Version: 1.34)
VLC media player 1.1.11 (x32 Version: 1.1.11)
WaveLab LE 7 (x32 Version: 7.1.0.543)
WinRAR 4.01 (64-Bit) (Version: 4.01.0)
XILS 3 (x32 Version: 1.0.71)
==================== Restore Points =========================
25-08-2013 12:55:21 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0A956C34-96D2-4D1F-A4F3-18F2B6D70B0A} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => C:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation)
Task: {0F39DC49-6B9B-4DFC-B5CA-CB75AEC7C323} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {15489FE5-3701-4EDC-9CBA-9436043740BD} - System32\Tasks\Norton Internet Security CBE\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation)
Task: {15FD0559-9128-4BFB-89B9-DDEB2A5F5CBA} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-04-08] (Sun Microsystems, Inc.)
Task: {1935CF28-7B09-4491-BEA5-5B6504E6C7A4} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03] (Adobe Systems Incorporated)
Task: {1ABE81EB-3919-4EED-B25D-C463B9FBA432} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-26] (Adobe Systems Incorporated)
Task: {99851AEF-FCF9-4989-A6D2-AB933C35DA08} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\WSCStub.exe [2013-06-04] (Symantec Corporation)
Task: {A64DE36C-1FE4-4B3D-AB35-231FB786DA65} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2012 => C:\Program Files (x86)\TuneUp Utilities 2012\OneClick.exe [2012-05-29] (TuneUp Software)
Task: {B8597708-43E1-41CC-A018-EE878FACC86F} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files (x86)\TuneUp Utilities 2011\OneClick.exe No File
Task: {C99E1E2C-D9A8-4115-B1A4-7B12F26175F6} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03] (Adobe Systems Incorporated)
Task: {CBC81F25-A512-4361-8C53-A681C3D6D6E3} - System32\Tasks\User_Feed_Synchronization-{DAF85A5E-7D83-4AF9-AA33-394C79A498C6} => C:\Windows\system32\msfeedssync.exe [2013-06-26] (Microsoft Corporation)
Task: {D92EBF83-90D3-4C98-8A24-FDEC2DEE2686} - System32\Tasks\Norton Internet Security CBE\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation)
Task: {EA753E59-204E-4343-B21A-9B07FB449D28} - System32\Tasks\AdobeAAMUpdater-1.0-areisha-PC-areisha => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-06-16] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/27/2013 00:28:22 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/26/2013 06:41:30 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2013 10:33:30 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2013 07:17:27 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2013 11:25:36 AM) (Source: Application Hang) (User: )
Description: Programm Audials.exe, Version 10.2.18602.200 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: f4c
Startzeit: 01ce9f79750b7433
Endzeit: 3424
Anwendungspfad: C:\Program Files (x86)\Audials\Audials 10\Audials.exe
Berichts-ID: c75640f9-0c9e-11e3-aa4e-0025229aab06
Error: (08/22/2013 06:01:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/20/2013 07:23:00 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/20/2013 00:10:32 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Audials.exe, Version: 10.2.18602.200, Zeitstempel: 0x516d5e2c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000028
Fehleroffset: 0x0009087d
ID des fehlerhaften Prozesses: 0xf28
Startzeit der fehlerhaften Anwendung: 0xAudials.exe0
Pfad der fehlerhaften Anwendung: Audials.exe1
Pfad des fehlerhaften Moduls: Audials.exe2
Berichtskennung: Audials.exe3
Error: (08/18/2013 03:29:30 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/17/2013 11:37:17 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (08/27/2013 07:46:24 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR6 gefunden.
Error: (08/27/2013 07:46:22 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR6 gefunden.
Error: (08/18/2013 03:24:36 AM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Error: (08/10/2013 00:26:11 PM) (Source: BROWSER) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{F572844B-91B7-43D1-8904-988843780D30}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.
Error: (08/10/2013 00:07:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.
Error: (08/10/2013 00:07:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%5.
Error: (08/10/2013 03:07:33 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.
Error: (08/10/2013 03:07:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%5.
Error: (08/10/2013 03:06:53 AM) (Source: volmgr) (User: )
Description: Die Initialisierung des Speicherabbildes ist fehlgeschlagen.
Error: (08/10/2013 02:50:35 AM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Microsoft Office Sessions:
=========================
Error: (08/27/2013 00:28:22 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/26/2013 06:41:30 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2013 10:33:30 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2013 07:17:27 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2013 11:25:36 AM) (Source: Application Hang)(User: )
Description: Audials.exe10.2.18602.200f4c01ce9f79750b74333424C:\Program Files (x86)\Audials\Audials 10\Audials.exec75640f9-0c9e-11e3-aa4e-0025229aab06
Error: (08/22/2013 06:01:31 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/20/2013 07:23:00 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/20/2013 00:10:32 AM) (Source: Application Error)(User: )
Description: Audials.exe10.2.18602.200516d5e2cntdll.dll6.1.7601.177254ec49b8fc00000280009087df2801ce9c0a49034da8C:\Program Files (x86)\Audials\Audials 10\Audials.exeC:\Windows\SysWOW64\ntdll.dll29771042-091c-11e3-a47e-0025229aab06
Error: (08/18/2013 03:29:30 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/17/2013 11:37:17 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2012-02-19 16:31:45.385
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 16:31:38.108
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 16:26:05.334
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 16:14:13.110
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 16:12:06.668
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 16:07:02.860
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 13:16:37.427
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 13:16:23.450
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-19 13:02:46.036
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-02-18 23:11:33.713
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\wow64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 58%
Total physical RAM: 3767.05 MB
Available physical RAM: 1546.89 MB
Total Pagefile: 7532.29 MB
Available Pagefile: 5283.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:931.41 GB) (Free:297.06 GB) NTFS
Drive e: (Volume) (Fixed) (Total:1397.26 GB) (Free:1078.23 GB) NTFS
Drive k: (USB-HDD) (Fixed) (Total:931.28 GB) (Free:270.09 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 6C46BD9B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 1397 GB) (Disk ID: 451B6977)
Partition 1: (Not Active) - (Size=-698727006208) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 932 GB) (Disk ID: B8BC2A6F)
Partition 1: (Not Active) - (Size=932 GB) - (Type=0C)
==================== End Of Log ============================
Viele Grüße André |
|
27.08.2013, 13:32
| #2 | |
| /// the machine /// TB-Ausbilder    | Problem mit MonsterMarketPlace hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
27.08.2013, 14:12
| #3 |
| | Problem mit MonsterMarketPlace Gesagt - getan. Das hier hat das Programm ausgegeben:
__________________Code:
ATTFilter ComboFix 13-08-25.01 - areisha 27.08.2013 15:01:33.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3767.1308 [GMT 2:00]
ausgeführt von:: c:\users\areisha\Downloads\ComboFix.exe
AV: Norton Internet Security CBE *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security CBE *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security CBE *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\LyricsPal
c:\program files (x86)\LyricsPal\125.crx
c:\program files (x86)\LyricsPal\125.dat
c:\program files (x86)\LyricsPal\125.dll
c:\program files (x86)\LyricsPal\125.xpi
c:\program files (x86)\LyricsPal\chrome.manifest
c:\program files (x86)\LyricsPal\sqlite3.dll
c:\program files (x86)\LyricsPal\Uninstall.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-27 bis 2013-08-27 ))))))))))))))))))))))))))))))
.
.
2013-08-27 13:07 . 2013-08-27 13:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-27 11:58 . 2013-08-27 11:58 -------- d-----w- C:\FRST
2013-08-18 01:01 . 2013-08-18 01:02 -------- d-----w- c:\windows\system32\MRT
2013-08-07 14:15 . 2013-08-08 13:03 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2013-08-05 14:42 . 2013-08-05 14:42 -------- d-----w- c:\program files\Common Files\Steinberg
2013-08-05 14:42 . 2013-08-05 14:42 -------- d-----w- c:\program files (x86)\Common Files\Steinberg
2013-08-05 14:41 . 2013-08-05 14:42 -------- d-----w- c:\program files (x86)\eLicenser
2013-08-05 14:41 . 2013-08-05 14:41 -------- d-----w- c:\program files (x86)\Syncrosoft
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-18 01:01 . 2011-11-16 10:16 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-07-26 15:19 . 2012-11-28 14:54 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-26 15:19 . 2011-08-13 22:57 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-26 21:18 . 2013-06-26 21:18 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-06-26 21:18 . 2013-06-26 21:18 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-06-26 21:18 . 2013-06-26 21:18 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-06-26 21:18 . 2013-06-26 21:18 81408 ----a-w- c:\windows\system32\icardie.dll
2013-06-26 21:18 . 2013-06-26 21:18 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-06-26 21:18 . 2013-06-26 21:18 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-06-26 21:18 . 2013-06-26 21:18 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-06-26 21:18 . 2013-06-26 21:18 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-06-26 21:18 . 2013-06-26 21:18 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-06-26 21:18 . 2013-06-26 21:18 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-06-26 21:18 . 2013-06-26 21:18 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-06-26 21:18 . 2013-06-26 21:18 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-06-26 21:18 . 2013-06-26 21:18 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-06-26 21:18 . 2013-06-26 21:18 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-06-26 21:18 . 2013-06-26 21:18 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-06-26 21:18 . 2013-06-26 21:18 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-06-26 21:18 . 2013-06-26 21:18 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-06-26 21:18 . 2013-06-26 21:18 441856 ----a-w- c:\windows\system32\html.iec
2013-06-26 21:18 . 2013-06-26 21:18 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-06-26 21:18 . 2013-06-26 21:18 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-06-26 21:18 . 2013-06-26 21:18 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-06-26 21:18 . 2013-06-26 21:18 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-06-26 21:18 . 2013-06-26 21:18 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-06-26 21:18 . 2013-06-26 21:18 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-06-26 21:18 . 2013-06-26 21:18 235008 ----a-w- c:\windows\system32\url.dll
2013-06-26 21:18 . 2013-06-26 21:18 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-06-26 21:18 . 2013-06-26 21:18 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-06-26 21:18 . 2013-06-26 21:18 216064 ----a-w- c:\windows\system32\msls31.dll
2013-06-26 21:18 . 2013-06-26 21:18 197120 ----a-w- c:\windows\system32\msrating.dll
2013-06-26 21:18 . 2013-06-26 21:18 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-06-26 21:18 . 2013-06-26 21:18 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-06-26 21:18 . 2013-06-26 21:18 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-06-26 21:18 . 2013-06-26 21:18 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-06-26 21:18 . 2013-06-26 21:18 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-06-26 21:18 . 2013-06-26 21:18 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-06-26 21:18 . 2013-06-26 21:18 149504 ----a-w- c:\windows\system32\occache.dll
2013-06-26 21:18 . 2013-06-26 21:18 144896 ----a-w- c:\windows\system32\wextract.exe
2013-06-26 21:18 . 2013-06-26 21:18 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-06-26 21:18 . 2013-06-26 21:18 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-06-26 21:18 . 2013-06-26 21:18 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-06-26 21:18 . 2013-06-26 21:18 13824 ----a-w- c:\windows\system32\mshta.exe
2013-06-26 21:18 . 2013-06-26 21:18 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-06-26 21:18 . 2013-06-26 21:18 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-06-26 21:18 . 2013-06-26 21:18 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-06-26 21:18 . 2013-06-26 21:18 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-06-26 21:18 . 2013-06-26 21:18 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-06-26 21:18 . 2013-06-26 21:18 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-06-26 21:18 . 2013-06-26 21:18 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-06-26 21:18 . 2013-06-26 21:18 102912 ----a-w- c:\windows\system32\inseng.dll
2013-06-20 05:22 . 2012-11-28 14:50 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2013-06-08 09:39 . 2012-07-01 17:09 36697 ----a-w- c:\windows\SysWow64\OggDSuninst.exe
2013-06-05 03:34 . 2013-07-10 05:52 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-10 05:52 624128 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-10 05:52 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2012-11-24 17:30 . 2012-11-24 17:09 83188 ----a-w- c:\program files (x86)\Uninstal.exe
2009-03-07 12:22 . 2009-03-07 12:22 1396736 ----a-w- c:\program files (x86)\TopScan.exe
2009-03-07 12:22 . 2003-09-18 05:34 872448 ----a-w- c:\program files (x86)\weds.exe
2004-04-14 07:11 . 2004-04-14 07:11 425984 ----a-w- c:\program files (x86)\gxl2dx8a.dll
2004-03-23 03:54 . 2004-03-23 03:54 438272 ----a-w- c:\program files (x86)\wwmp2wmb.exe
2003-06-16 10:52 . 2003-06-16 10:52 393216 ----a-w- c:\program files (x86)\gxl2dx8.dll
2002-07-03 07:21 . 2002-07-03 07:21 61440 ----a-w- c:\program files (x86)\GxlBase.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}]
2012-06-13 15:37 1209224 ----a-w- c:\program files (x86)\pdfforge Toolbar\IE\5.9\pdfforgeToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{B922D405-6D13-4A2B-AE89-08A030DA4402}"= "c:\program files (x86)\pdfforge Toolbar\IE\5.9\pdfforgeToolbarIE.dll" [2012-06-13 1209224]
.
[HKEY_CLASSES_ROOT\clsid\{b922d405-6d13-4a2b-ae89-08a030da4402}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-10-27 2495088]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SearchSettings"="c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 a8djavs_x64;a8djavs_x64;c:\windows\system32\Drivers\a8djavs_x64.sys;c:\windows\SYSNATIVE\Drivers\a8djavs_x64.sys [x]
R3 a8djusb_svc;Audio 8 DJ;c:\windows\system32\Drivers\a8djusb.sys;c:\windows\SYSNATIVE\Drivers\a8djusb.sys [x]
R3 a8djusb_x64;a8djusb_x64;c:\windows\system32\Drivers\a8djusb_x64.sys;c:\windows\SYSNATIVE\Drivers\a8djusb_x64.sys [x]
R3 AsrCDDrv;AsrCDDrv;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys;c:\windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 netr7364;Belkin Wireless 54G USB Network Adapter Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130715.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security CBE Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130826.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20130826.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]
S2 AdobeActiveFileMonitor10.0;Adobe Active File Monitor V10;c:\program files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [x]
S2 NIS;Norton Internet Security CBE;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 17:02 114688 ----a-w- c:\program files (x86)\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-28 15:19]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.ask.com/?l=dis&o=14597
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\areisha\AppData\Roaming\Mozilla\Firefox\Profiles\mwgw58wf.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-08-06 15:13; {9309FA47-1B48-4768-AFA4-9E0556F5DC81}; c:\program files (x86)\LyricsPal\125.xpi
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{3368cedd-e315-4f93-96a1-3d50a47a3f40} - c:\program files (x86)\LyricsPal\125.dll
AddRemove-lrcspal@lyricspal.co - c:\program files (x86)\LyricsPal\uninstall.exe
AddRemove-OggDS - c:\windows\system32\OggDSuninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3128068607-619231479-3263352510-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2*0*`Må}\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-3128068607-619231479-3263352510-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*2*0**š„:\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-3128068607-619231479-3263352510-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*i*µ$Áx]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3128068607-619231479-3263352510-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*i*µ$Áx\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-3128068607-619231479-3263352510-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*3*»Õ8F\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-3128068607-619231479-3263352510-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*`Må}\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\`%*]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-27 15:09:25
ComboFix-quarantined-files.txt 2013-08-27 13:09
.
Vor Suchlauf: 9 Verzeichnis(se), 357.384.318.976 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 371.344.711.680 Bytes frei
.
- - End Of File - - F4C947042AC590239B2CE62A81F4BFC9
A36C5E4F47E84449FF07ED3517B43A31
|
|
27.08.2013, 20:10
| #4 |
| /// the machine /// TB-Ausbilder | Problem mit MonsterMarketPlace Clean noch nit. Jede Menge Adware. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Problem mit MonsterMarketPlace |
| adobe, desktop, downloader, error, explorer, farbar, farbar recovery scan tool, firefox, firefox 23.0.1, flash player, google, grüne wörter links, helper, home, homepage, launch, monstermarketplace, mozilla, ntdll.dll, ogg, pdfforge toolbar, plug-in, problem, registry, scan, security, services.exe, software, starten, super, svchost.exe, symantec, system, temp, vista, windows-firewall |
Linear-Darstellung
