| |
| |||||||
Log-Analyse und Auswertung: System läuft langsam Lyrics container und weiteres?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.08.2013, 14:06
| #1 |
| |  System läuft langsam Lyrics container und weiteres? Hallo Mein System läuft sehr langsam und blendet Werbung ein, wenn ich die Maus über einen Link bewege, so dass man dann auf die Anzeige klickt. Zudem werden im Internet Explorer Anzeigen eingeblendet (ads not by this site). Zudem kommen Anzeigen wie "Harddisk voll" oder "Fehler in Registry - klicken sie hier". Kaspersky (kostenpflichtig) läuft auf dem System - ein Suchlauf findet auch was - kriegt es aber nicht weg. Mit CCleaner hab ich versucht (Sorry - Hinweis erst bei Trojaner-board.de gelesen). Spy Hunter kann ihn auch sehen, Reinigen jedoch nicht versucht, da Kaspersky ihn auch nicht weg bringt? Würde mich sehr über Hilfe freuen - schon vorweg mal vielen Dank! Gruss Blarilon Hier die verschiedenen Logs: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:02 on 27/08/2013 (user1)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-08-2013 01
Ran by user1 (administrator) on 27-08-2013 12:07:05
Running from C:\Users\user1\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
() C:\Program Files (x86)\LyricsContainer\LrcsCtrUpdr.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(1und1 Mail und Media GmbH) C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\klwtblfs.exe
(Adobe Systems, Inc.) C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
==================== Registry (Whitelisted) ==================
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2583040 2009-09-21] (VIA)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-07-01] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - DefaultScope {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=a8b5d9a7000000000000944452c4709b
SearchScopes: HKCU - {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {739111B9-032E-4E22-90D3-C2C6193C2F90} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {A6814DBE-4BE2-43A4-90E1-FA49B7DFB707} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D7EEE78E-8FDC-42B5-BB58-A298A40551D5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: LyricsContainer - {77e880b5-cae7-4928-8507-ec2e5007e73e} - C:\Program Files (x86)\LyricsContainer\128.dll (LyricsContainer)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKCU - WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR RestoreOnStartup: "hxxp://search.babylon.com/?affID=119556&babsrc=HP_ss&mntrId=a8b5d9a7000000000000944452c4709b"
CHR DefaultSearchURL: (Search the web (Babylon)) - hxxp://search.babylon.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=a8b5d9a7000000000000944452c4709b
CHR DefaultSuggestURL: (Search the web (Babylon)) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Extension: (LyricsContainer) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\abfmigjiaapipflmopkaaooigcjjdojh\1.128_0
CHR Extension: (Google Docs) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Gmail) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [abfmigjiaapipflmopkaaooigcjjdojh] - C:\Program Files (x86)\LyricsContainer\128.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [fjoijdanhaiflhibkljeklcghcmmfffh] - C:\Program Files (x86)\WebCake\WebCakeLayers.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\virtkbd.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
R2 HPSLPSVC; C:\Users\user1\AppData\Local\Temp\7zS294C\hpslpsvc64.dll [1039360 2013-02-06] (Hewlett-Packard Co.)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-06-27] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-07-04] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-07-04] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-07-04] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-04] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-04] (Kaspersky Lab ZAO)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-27 12:06 - 2013-08-27 10:49 - 01578852 _____ (Farbar) C:\Users\user1\Desktop\FRST64.exe
2013-08-27 12:06 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 12:05 - 2013-08-27 12:05 - 00001088 _____ C:\Users\user1\Desktop\FRST64 - Verknüpfung.lnk
2013-08-27 12:04 - 2013-08-27 12:04 - 00031361 _____ C:\Users\user1\Downloads\FRST.txt
2013-08-27 11:43 - 2013-08-27 11:44 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 11:43 - 2013-08-27 11:43 - 437610776 _____ C:\Windows\MEMORY.DMP
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:50 - 2013-08-27 10:50 - 00022191 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:48 - 2013-08-27 10:49 - 01578852 _____ (Farbar) C:\Users\user1\Downloads\FRST64.exe
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-25 20:29 - 2013-08-27 12:02 - 00007168 _____ C:\Windows\setupact.log
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:36 - 2013-08-25 15:37 - 00000000 ____D C:\sh4ldr
2013-08-25 15:36 - 2013-08-25 15:36 - 00003326 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-25 15:36 - 2013-08-25 15:36 - 00002254 _____ C:\Users\user1\Desktop\SpyHunter.lnk
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:36 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 10:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-25 10:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-25 10:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-25 10:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-25 10:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-16 15:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-16 15:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-16 15:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 15:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 15:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-16 15:52 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 15:51 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-16 15:51 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 15:47 - 2013-08-16 15:48 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 14:16 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 14:16 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 14:11 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 14:11 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 14:11 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 14:11 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 14:11 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 14:11 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 13:51 - 2013-08-25 19:47 - 00000000 ____D C:\Program Files (x86)\LyricsContainer
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
2013-07-30 11:13 - 2013-07-05 09:16 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help
==================== One Month Modified Files and Folders =======
2013-08-27 12:05 - 2013-08-27 12:05 - 00001088 _____ C:\Users\user1\Desktop\FRST64 - Verknüpfung.lnk
2013-08-27 12:04 - 2013-08-27 12:04 - 00031361 _____ C:\Users\user1\Downloads\FRST.txt
2013-08-27 12:03 - 2013-07-02 13:53 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-27 12:02 - 2013-08-25 20:29 - 00007168 _____ C:\Windows\setupact.log
2013-08-27 11:56 - 2013-07-04 19:02 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-27 11:56 - 2013-07-02 13:53 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-27 11:55 - 2013-07-05 09:31 - 00000398 _____ C:\Windows\Tasks\LyricsContainer Update.job
2013-08-27 11:51 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-27 11:51 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-27 11:47 - 2013-07-02 12:07 - 01759600 _____ C:\Windows\WindowsUpdate.log
2013-08-27 11:44 - 2013-08-27 11:43 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 11:44 - 2013-07-02 12:56 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-27 11:44 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-27 11:43 - 2013-08-27 11:43 - 437610776 _____ C:\Windows\MEMORY.DMP
2013-08-27 11:43 - 2013-07-05 11:29 - 00000000 ____D C:\Windows\Minidump
2013-08-27 10:52 - 2013-08-27 12:06 - 00377856 _____ C:\Users\user1\Desktop\gmer_2.1.19163.exe
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:50 - 2013-08-27 10:50 - 00022191 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 10:49 - 2013-08-27 12:06 - 01578852 _____ (Farbar) C:\Users\user1\Desktop\FRST64.exe
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:49 - 2013-08-27 10:48 - 01578852 _____ (Farbar) C:\Users\user1\Downloads\FRST64.exe
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:47 - 2013-07-02 12:07 - 00000000 ____D C:\Users\user1
2013-08-27 10:46 - 2013-08-27 12:06 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-27 10:34 - 2013-07-02 14:06 - 00000000 ____D C:\Users\user1\Documents\Outlook-Dateien
2013-08-25 22:13 - 2011-04-12 09:43 - 00653928 _____ C:\Windows\system32\perfh007.dat
2013-08-25 22:13 - 2011-04-12 09:43 - 00129800 _____ C:\Windows\system32\perfc007.dat
2013-08-25 22:13 - 2009-07-14 07:13 - 01518986 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:57 - 2013-07-02 12:26 - 00000000 ____D C:\Windows\Panther
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 19:47 - 2013-08-16 13:51 - 00000000 ____D C:\Program Files (x86)\LyricsContainer
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:37 - 2013-08-25 15:36 - 00000000 ____D C:\sh4ldr
2013-08-25 15:36 - 2013-08-25 15:36 - 00003326 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-25 15:36 - 2013-08-25 15:36 - 00002254 _____ C:\Users\user1\Desktop\SpyHunter.lnk
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:31 - 2013-07-17 13:03 - 00000000 ____D C:\Users\user1\AppData\Roaming\Systweak
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 13:18 - 2013-07-04 18:36 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-08-25 13:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-25 11:23 - 2013-07-05 10:55 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-24 18:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-16 15:48 - 2013-08-16 15:47 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 15:46 - 2013-07-10 11:26 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-16 13:51 - 2013-07-05 09:31 - 00003046 _____ C:\Windows\System32\Tasks\LyricsContainer Update
2013-08-14 16:15 - 2013-07-04 18:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\HpUpdate
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-05 14:06 - 2013-07-02 13:53 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-31 08:17 - 2013-07-21 11:51 - 00000000 ____D C:\Users\user1\Documents\Mein Steuer-Sparbuch Heute
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
Files to move or delete:
====================
C:\Users\user1\AppData\Local\Temp\SHSetup.exe
C:\Users\user1\AppData\Local\Temp\7zS294C\HPSLPSVC64.DLL
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-25 12:54
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-27 12:24:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005c Hitachi_ rev.JP2O 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\user1\AppData\Local\Temp\pgloapob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1724] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007771faa8 5 bytes JMP 0000000172e319b0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1724] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077720038 5 bytes JMP 0000000172e32066
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075871465 2 bytes [87, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758714bb 2 bytes [87, 75]
.text ... * 2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075871465 2 bytes [87, 75]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758714bb 2 bytes [87, 75]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\WUDFHost.exe [2216:2468] 000007fef76924a0
---- EOF - GMER 2.1 ----
Code:
ATTFilter Typ: Adware (1)
not-a-virus:AdWare.Win32.Lyckriks.cs Inaktiv 27.08.2013 12:09:01 hxxp://app.updateserv.net/u/v122/LyricsContainer_1060-8001_v122.exe?id=9AB04266B15106F0&rand=6030// LrcsCtrUpdr.exe
|
|
27.08.2013, 14:23
| #2 |
| /// TB-Ausbilder   | System läuft langsam Lyrics container und weiteres? Hallo,
__________________kannst du mir bitte auch noch den Inhalt des zweiten Logfiles posten, welche FRST erstellt (Addidtion.txt)? Wenn du es nicht mehr findest, dann erstell es folgendermassen neu: Starte noch einmal FRST.
__________________ |
|
27.08.2013, 19:42
| #3 |
| | System läuft langsam Lyrics container und weiteres? Hallo
__________________Vielen Dank für deine Hilfe. Hab Addition.txt nicht gefunden, nochmals frst gestartet (Neuste Version). Hier die Logs: Danke und Gruss Blarilon FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-08-2013 03
Ran by user1 (administrator) on 27-08-2013 20:34:26
Running from C:\Users\user1\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\klwtblfs.exe
(Adobe Systems, Inc.) C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
==================== Registry (Whitelisted) ==================
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2583040 2009-09-21] (VIA)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-07-01] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - DefaultScope {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=a8b5d9a7000000000000944452c4709b
SearchScopes: HKCU - {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {739111B9-032E-4E22-90D3-C2C6193C2F90} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {A6814DBE-4BE2-43A4-90E1-FA49B7DFB707} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D7EEE78E-8FDC-42B5-BB58-A298A40551D5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: LyricsContainer - {77e880b5-cae7-4928-8507-ec2e5007e73e} - C:\Program Files (x86)\LyricsContainer\128.dll (LyricsContainer)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKCU - WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR RestoreOnStartup: "hxxp://search.babylon.com/?affID=119556&babsrc=HP_ss&mntrId=a8b5d9a7000000000000944452c4709b"
CHR DefaultSearchURL: (Search the web (Babylon)) - hxxp://search.babylon.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=a8b5d9a7000000000000944452c4709b
CHR DefaultSuggestURL: (Search the web (Babylon)) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Extension: (LyricsContainer) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\abfmigjiaapipflmopkaaooigcjjdojh\1.128_0
CHR Extension: (Google Docs) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Gmail) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [abfmigjiaapipflmopkaaooigcjjdojh] - C:\Program Files (x86)\LyricsContainer\128.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [fjoijdanhaiflhibkljeklcghcmmfffh] - C:\Program Files (x86)\WebCake\WebCakeLayers.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\virtkbd.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
R2 HPSLPSVC; C:\Users\user1\AppData\Local\Temp\7zS294C\hpslpsvc64.dll [1039360 2013-02-06] (Hewlett-Packard Co.)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-06-27] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-07-04] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-07-04] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-07-04] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-04] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-04] (Kaspersky Lab ZAO)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-27 14:39 - 2013-08-27 14:36 - 00005430 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_140140.log
2013-08-27 14:39 - 2013-08-27 12:37 - 00008749 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_115634.log
2013-08-27 14:39 - 2013-08-27 10:09 - 00004072 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_100904.log
2013-08-27 14:39 - 2013-08-25 19:46 - 00153976 _____ C:\Users\user1\Desktop\SpyHunter4_20130825_153701.log
2013-08-27 12:48 - 2013-08-27 12:48 - 00487384 _____ C:\Windows\Minidump\082713-17984-01.dmp
2013-08-27 12:24 - 2013-08-27 12:24 - 00001939 _____ C:\Users\user1\Desktop\Gmer.txt
2013-08-27 12:07 - 2013-08-27 12:07 - 00032109 _____ C:\Users\user1\Desktop\FRST.txt
2013-08-27 12:06 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Desktop\gmer_2.1.19163.exe
2013-08-27 12:06 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 11:43 - 2013-08-27 12:48 - 330967192 _____ C:\Windows\MEMORY.DMP
2013-08-27 11:43 - 2013-08-27 11:44 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:50 - 2013-08-27 10:50 - 00022191 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:47 - 2013-08-27 12:02 - 00000472 _____ C:\Users\user1\Desktop\defogger_disable.log
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-25 20:29 - 2013-08-27 20:32 - 00011312 _____ C:\Windows\setupact.log
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:36 - 2013-08-25 15:37 - 00000000 ____D C:\sh4ldr
2013-08-25 15:36 - 2013-08-25 15:36 - 00003326 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-25 15:36 - 2013-08-25 15:36 - 00002254 _____ C:\Users\user1\Desktop\SpyHunter.lnk
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:36 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 10:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-25 10:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-25 10:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-25 10:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-25 10:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-16 15:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-16 15:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-16 15:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 15:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 15:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-16 15:52 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 15:51 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-16 15:51 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 15:47 - 2013-08-16 15:48 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 14:16 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 14:16 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 14:11 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 14:11 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 14:11 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 14:11 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 14:11 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 14:11 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 13:51 - 2013-08-25 19:47 - 00000000 ____D C:\Program Files (x86)\LyricsContainer
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
2013-07-30 11:13 - 2013-07-05 09:16 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help
==================== One Month Modified Files and Folders =======
2013-08-27 20:32 - 2013-08-27 19:59 - 01579024 _____ (Farbar) C:\Users\user1\Downloads\FRST64.exe
2013-08-27 20:32 - 2013-08-25 20:29 - 00011312 _____ C:\Windows\setupact.log
2013-08-27 20:32 - 2013-07-02 12:07 - 01796726 _____ C:\Windows\WindowsUpdate.log
2013-08-27 20:03 - 2013-07-02 13:53 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-27 19:47 - 2013-07-04 19:02 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-27 19:39 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-27 19:39 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-27 19:33 - 2013-07-05 09:31 - 00000398 _____ C:\Windows\Tasks\LyricsContainer Update.job
2013-08-27 19:32 - 2013-07-02 13:53 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-27 19:32 - 2013-07-02 12:56 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-27 19:32 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-27 14:36 - 2013-08-27 14:39 - 00005430 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_140140.log
2013-08-27 12:48 - 2013-08-27 12:48 - 00487384 _____ C:\Windows\Minidump\082713-17984-01.dmp
2013-08-27 12:48 - 2013-08-27 11:43 - 330967192 _____ C:\Windows\MEMORY.DMP
2013-08-27 12:48 - 2013-07-05 11:29 - 00000000 ____D C:\Windows\Minidump
2013-08-27 12:37 - 2013-08-27 14:39 - 00008749 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_115634.log
2013-08-27 12:24 - 2013-08-27 12:24 - 00001939 _____ C:\Users\user1\Desktop\Gmer.txt
2013-08-27 12:07 - 2013-08-27 12:07 - 00032109 _____ C:\Users\user1\Desktop\FRST.txt
2013-08-27 12:02 - 2013-08-27 10:47 - 00000472 _____ C:\Users\user1\Desktop\defogger_disable.log
2013-08-27 11:44 - 2013-08-27 11:43 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 10:52 - 2013-08-27 12:06 - 00377856 _____ C:\Users\user1\Desktop\gmer_2.1.19163.exe
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:50 - 2013-08-27 10:50 - 00022191 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:47 - 2013-07-02 12:07 - 00000000 ____D C:\Users\user1
2013-08-27 10:46 - 2013-08-27 12:06 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-27 10:34 - 2013-07-02 14:06 - 00000000 ____D C:\Users\user1\Documents\Outlook-Dateien
2013-08-27 10:09 - 2013-08-27 14:39 - 00004072 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_100904.log
2013-08-25 22:13 - 2011-04-12 09:43 - 00653928 _____ C:\Windows\system32\perfh007.dat
2013-08-25 22:13 - 2011-04-12 09:43 - 00129800 _____ C:\Windows\system32\perfc007.dat
2013-08-25 22:13 - 2009-07-14 07:13 - 01518986 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:57 - 2013-07-02 12:26 - 00000000 ____D C:\Windows\Panther
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 19:47 - 2013-08-16 13:51 - 00000000 ____D C:\Program Files (x86)\LyricsContainer
2013-08-25 19:46 - 2013-08-27 14:39 - 00153976 _____ C:\Users\user1\Desktop\SpyHunter4_20130825_153701.log
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:37 - 2013-08-25 15:36 - 00000000 ____D C:\sh4ldr
2013-08-25 15:36 - 2013-08-25 15:36 - 00003326 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-25 15:36 - 2013-08-25 15:36 - 00002254 _____ C:\Users\user1\Desktop\SpyHunter.lnk
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:31 - 2013-07-17 13:03 - 00000000 ____D C:\Users\user1\AppData\Roaming\Systweak
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 13:18 - 2013-07-04 18:36 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-08-25 13:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-25 11:23 - 2013-07-05 10:55 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-24 18:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-16 15:48 - 2013-08-16 15:47 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 15:46 - 2013-07-10 11:26 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-16 13:51 - 2013-07-05 09:31 - 00003046 _____ C:\Windows\System32\Tasks\LyricsContainer Update
2013-08-14 16:15 - 2013-07-04 18:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\HpUpdate
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-05 14:06 - 2013-07-02 13:53 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-31 08:17 - 2013-07-21 11:51 - 00000000 ____D C:\Users\user1\Documents\Mein Steuer-Sparbuch Heute
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
Files to move or delete:
====================
C:\Users\user1\AppData\Local\Temp\LyricsContainertmp.exe
C:\Users\user1\AppData\Local\Temp\SHSetup.exe
C:\Users\user1\AppData\Local\Temp\7zS294C\HPSLPSVC64.DLL
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-25 12:54
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-08-2013 03
Ran by user1 at 2013-08-27 20:35:12
Running from C:\Users\user1\Downloads
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
64 Bit HP CIO Components Installer (Version: 6.2.2)
Adobe Flash Player 10 ActiveX (x32 Version: 10.0.32.18)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
B110 (x32 Version: 140.0.142.000)
BufferChm (x32 Version: 140.0.212.000)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Destinations (x32 Version: 140.0.77.000)
DeviceDiscovery (x32 Version: 140.0.212.000)
eaner (Version: 4.04)
Google Chrome (x32 Version: 28.0.1500.95)
Google Update Helper (x32 Version: 1.3.21.153)
GPBaseService2 (x32 Version: 140.0.211.000)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7 (Version: 14.0)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Update (x32 Version: 5.002.002.002)
HPAppStudio (x32 Version: 140.0.95.000)
HPPhotoGadget (x32 Version: 140.0.524.000)
HPProductAssistant (x32 Version: 140.0.212.000)
HPSSupply (x32 Version: 140.0.211.000)
Kaspersky Anti-Virus 2013 (x32 Version: 13.0.1.4190)
LyricsContainer (x32)
MarketResearch (x32 Version: 140.0.212.000)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Network64 (Version: 140.0.212.000)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Platform (x32 Version: 1.34)
PS_AIO_07_B110_SW_Min (x32 Version: 140.0.142.000)
QuickTransfer (x32 Version: 140.0.98.000)
Scan (x32 Version: 140.0.77.000)
Shop for HP Supplies (Version: 14.0)
SmartWebPrinting (x32 Version: 140.0.186.000)
SolutionCenter (x32 Version: 140.0.211.000)
SpyHunter (Version: 4.14.5.4268)
Status (x32 Version: 140.0.212.000)
Toolbox (x32 Version: 140.0.424.000)
TrayApp (x32 Version: 140.0.212.000)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553092) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
VIA Plattform-Geräte-Manager (x32 Version: 1.34)
WEB.DE Desktop Icons (x32 Version: 3.0.3.0)
WEB.DE MailCheck für Internet Explorer (x32 Version: 2.3.0.2)
WEB.DE Softwareaktualisierung (x32 Version: 3.0.0.54)
WebCake 3.00 (Version: 3.00)
WebReg (x32 Version: 140.0.212.017)
WISO Steuer-Sparbuch 2013 (x32 Version: 20.00.8137)
==================== Restore Points =========================
25-07-2013 20:00:45 Windows Update
27-07-2013 09:43:20 Windows Defender Checkpoint
29-07-2013 15:13:38 Windows-Sicherung
29-07-2013 15:25:47 Windows Defender Checkpoint
30-07-2013 11:57:49 Windows Update
05-08-2013 11:31:33 Windows Update
05-08-2013 11:35:19 Windows-Sicherung
09-08-2013 16:05:55 Windows Update
12-08-2013 10:21:59 Windows-Sicherung
16-08-2013 11:55:00 Windows Update
16-08-2013 13:46:20 Windows Update
20-08-2013 10:22:41 Windows Update
20-08-2013 10:24:58 Windows-Sicherung
24-08-2013 16:06:21 Windows Update
25-08-2013 13:35:46 Installed SpyHunter
25-08-2013 17:47:23 Windows-Sicherung
25-08-2013 20:11:46 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {153029FB-6184-450F-B547-B00246113848} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-02] (Google Inc.)
Task: {6B2EF477-26C7-4E1B-9B2C-B3A4FF83A1C0} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2013-06-27] (Enigma Software Group USA, LLC.)
Task: {72D2AB84-1D9C-4617-A933-6CD95E472C3E} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {75965D9D-B7BA-424C-837A-1C9278C6F998} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-02] (Google Inc.)
Task: {83475F0F-9ED7-4377-A458-2AF1D90CAFE1} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {9214F89C-10BB-4DD9-9884-260D3709D3CE} - System32\Tasks\LyricsContainer Update => C:\Program Files (x86)\LyricsContainer\LrcsCtrUpdr.exe [2013-08-16] ()
Task: {9EFEAA58-350F-4A16-823B-33716D522FDA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {C717BB0D-D61B-4586-9D56-4C728D79399B} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {F3BB6149-5386-49FB-BAB1-A78B31CA8A88} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2013-05-28] (1&1 Mail & Media GmbH)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\LyricsContainer Update.job => C:\Program Files (x86)\LyricsContainer\LrcsCtrUpdr.exe
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/27/2013 07:34:00 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/27/2013 00:50:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/27/2013 11:45:39 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/27/2013 10:08:39 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2013 01:20:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2013 10:40:41 AM) (Source: Application Hang) (User: )
Description: Programm RegCleanPro.exe, Version 6.21.65.2684 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: ed8
Startzeit: 01cea16dbad675a1
Endzeit: 7
Anwendungspfad: C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Berichts-ID: ff27a65c-0d61-11e3-b865-00252216e91e
Error: (08/25/2013 10:33:59 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2013 05:51:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/20/2013 00:31:11 PM) (Source: Application Hang) (User: )
Description: Programm RegCleanPro.exe, Version 6.21.65.2684 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: c40
Startzeit: 01ce9d8e1dc47558
Endzeit: 164
Anwendungspfad: C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Berichts-ID: 97da93ac-0983-11e3-93e9-00252216e91e
Error: (08/20/2013 00:15:53 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (08/27/2013 07:33:17 PM) (Source: Service Control Manager) (User: )
Description: Dienst "HP CUE DeviceDiscovery Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/27/2013 07:33:17 PM) (Source: Service Control Manager) (User: )
Description: Dienst "hpqcxs08" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/27/2013 07:32:08 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.
Error: (08/27/2013 02:35:09 PM) (Source: Service Control Manager) (User: )
Description: Dienst "HP CUE DeviceDiscovery Service" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (08/27/2013 02:35:09 PM) (Source: Service Control Manager) (User: )
Description: Dienst "hpqcxs08" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (08/27/2013 02:01:08 PM) (Source: Service Control Manager) (User: )
Description: Dienst "HP CUE DeviceDiscovery Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/27/2013 02:01:08 PM) (Source: Service Control Manager) (User: )
Description: Dienst "hpqcxs08" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/27/2013 00:48:35 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.
Error: (08/27/2013 00:48:47 PM) (Source: BugCheck) (User: )
Description: 0x0000009f (0x0000000000000004, 0x0000000000000258, 0xfffffa80018cdb50, 0xfffff80000b9c510)C:\Windows\MEMORY.DMP082713-17984-01
|
|
27.08.2013, 19:46
| #4 |
| /// TB-Ausbilder | System läuft langsam Lyrics container und weiteres? Hallo, den SpyHunter kannst du deinstallieren, das ist nix. Schritt 1
Schritt 2 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 3 Starte noch einmal FRST.
Bitte poste in deiner nächsten Antwort:
__________________ cheers, Leo |
|
27.08.2013, 20:55
| #5 |
| | System läuft langsam Lyrics container und weiteres? Hallo Leo Ich konnte MarketResearch nicht finden, die übrigen konnte ich deinstallieren (inkl Spyhunter). Hier die beiden Logs: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-08-2013 03
Ran by user1 (administrator) on 27-08-2013 21:48:43
Running from C:\Users\user1\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(1und1 Mail und Media GmbH) C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\klwtblfs.exe
(Adobe Systems, Inc.) C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
(Farbar) C:\Users\user1\Desktop\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2583040 2009-09-21] (VIA)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-07-01] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - DefaultScope {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {739111B9-032E-4E22-90D3-C2C6193C2F90} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {A6814DBE-4BE2-43A4-90E1-FA49B7DFB707} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D7EEE78E-8FDC-42B5-BB58-A298A40551D5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKCU - WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Search the web (Babylon)) - hxxp://www.google.com
CHR DefaultSuggestURL: (Search the web (Babylon)) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Extension: (Google Docs) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Gmail) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\virtkbd.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
R2 HPSLPSVC; C:\Users\user1\AppData\Local\Temp\7zS294C\hpslpsvc64.dll [1039360 2013-02-06] (Hewlett-Packard Co.)
==================== Drivers (Whitelisted) ====================
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-07-04] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-07-04] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-07-04] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-04] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-04] (Kaspersky Lab ZAO)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-27 21:43 - 2013-08-27 21:43 - 00007170 _____ C:\Users\user1\Desktop\AdwCleaner[S0].txt
2013-08-27 21:30 - 2013-08-27 21:37 - 00000000 ____D C:\AdwCleaner
2013-08-27 21:28 - 2013-08-27 21:29 - 00994642 _____ C:\Users\user1\Desktop\adwcleaner.exe
2013-08-27 21:27 - 2013-08-27 21:27 - 00016061 _____ C:\Users\user1\Desktop\download-adwcleaner.htm
2013-08-27 21:23 - 2013-08-27 21:24 - 00000000 ____D C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-08-27 20:36 - 2013-08-27 20:36 - 00021647 _____ C:\Users\user1\Desktop\Addition.txt
2013-08-27 20:35 - 2013-08-27 20:35 - 00033123 _____ C:\Users\user1\Downloads\FRST.txt
2013-08-27 20:35 - 2013-08-27 20:35 - 00033123 _____ C:\Users\user1\Desktop\FRST_2.txt
2013-08-27 19:59 - 2013-08-27 20:32 - 01579024 _____ (Farbar) C:\Users\user1\Downloads\FRST64.exe
2013-08-27 14:39 - 2013-08-27 14:36 - 00005430 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_140140.log
2013-08-27 14:39 - 2013-08-27 12:37 - 00008749 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_115634.log
2013-08-27 14:39 - 2013-08-27 10:09 - 00004072 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_100904.log
2013-08-27 14:39 - 2013-08-25 19:46 - 00153976 _____ C:\Users\user1\Desktop\SpyHunter4_20130825_153701.log
2013-08-27 12:48 - 2013-08-27 12:48 - 00487384 _____ C:\Windows\Minidump\082713-17984-01.dmp
2013-08-27 12:24 - 2013-08-27 12:24 - 00001939 _____ C:\Users\user1\Desktop\Gmer.txt
2013-08-27 12:06 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Desktop\gmer_2.1.19163.exe
2013-08-27 12:06 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 11:43 - 2013-08-27 12:48 - 330967192 _____ C:\Windows\MEMORY.DMP
2013-08-27 11:43 - 2013-08-27 11:44 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:50 - 2013-08-27 20:35 - 00021647 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:47 - 2013-08-27 12:02 - 00000472 _____ C:\Users\user1\Desktop\defogger_disable.log
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-25 20:29 - 2013-08-27 21:47 - 00013048 _____ C:\Windows\setupact.log
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 10:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-25 10:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-25 10:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-25 10:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-25 10:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-16 15:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-16 15:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-16 15:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 15:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 15:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-16 15:52 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 15:51 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-16 15:51 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 15:47 - 2013-08-16 15:48 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 14:16 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 14:16 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 14:11 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 14:11 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 14:11 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 14:11 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 14:11 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 14:11 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
2013-07-30 11:13 - 2013-07-05 09:16 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help
==================== One Month Modified Files and Folders =======
2013-08-27 21:47 - 2013-08-27 21:46 - 01579024 _____ (Farbar) C:\Users\user1\Desktop\FRST64 (1).exe
2013-08-27 21:47 - 2013-08-25 20:29 - 00013048 _____ C:\Windows\setupact.log
2013-08-27 21:43 - 2013-08-27 21:43 - 00007170 _____ C:\Users\user1\Desktop\AdwCleaner[S0].txt
2013-08-27 21:40 - 2013-07-04 19:02 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-27 21:39 - 2013-07-02 13:53 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-27 21:39 - 2013-07-02 12:56 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-27 21:39 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-27 21:38 - 2013-07-02 12:07 - 01823642 _____ C:\Windows\WindowsUpdate.log
2013-08-27 21:37 - 2013-08-27 21:30 - 00000000 ____D C:\AdwCleaner
2013-08-27 21:29 - 2013-08-27 21:28 - 00994642 _____ C:\Users\user1\Desktop\adwcleaner.exe
2013-08-27 21:27 - 2013-08-27 21:27 - 00016061 _____ C:\Users\user1\Desktop\download-adwcleaner.htm
2013-08-27 21:24 - 2013-08-27 21:23 - 00000000 ____D C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-08-27 21:03 - 2013-07-02 13:53 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-27 20:36 - 2013-08-27 20:36 - 00021647 _____ C:\Users\user1\Desktop\Addition.txt
2013-08-27 20:35 - 2013-08-27 20:35 - 00033123 _____ C:\Users\user1\Downloads\FRST.txt
2013-08-27 20:35 - 2013-08-27 20:35 - 00033123 _____ C:\Users\user1\Desktop\FRST_2.txt
2013-08-27 20:35 - 2013-08-27 10:50 - 00021647 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 20:32 - 2013-08-27 19:59 - 01579024 _____ (Farbar) C:\Users\user1\Downloads\FRST64.exe
2013-08-27 19:39 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-27 19:39 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-27 14:36 - 2013-08-27 14:39 - 00005430 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_140140.log
2013-08-27 12:48 - 2013-08-27 12:48 - 00487384 _____ C:\Windows\Minidump\082713-17984-01.dmp
2013-08-27 12:48 - 2013-08-27 11:43 - 330967192 _____ C:\Windows\MEMORY.DMP
2013-08-27 12:48 - 2013-07-05 11:29 - 00000000 ____D C:\Windows\Minidump
2013-08-27 12:37 - 2013-08-27 14:39 - 00008749 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_115634.log
2013-08-27 12:24 - 2013-08-27 12:24 - 00001939 _____ C:\Users\user1\Desktop\Gmer.txt
2013-08-27 12:02 - 2013-08-27 10:47 - 00000472 _____ C:\Users\user1\Desktop\defogger_disable.log
2013-08-27 11:44 - 2013-08-27 11:43 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 10:52 - 2013-08-27 12:06 - 00377856 _____ C:\Users\user1\Desktop\gmer_2.1.19163.exe
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:47 - 2013-07-02 12:07 - 00000000 ____D C:\Users\user1
2013-08-27 10:46 - 2013-08-27 12:06 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-27 10:34 - 2013-07-02 14:06 - 00000000 ____D C:\Users\user1\Documents\Outlook-Dateien
2013-08-27 10:09 - 2013-08-27 14:39 - 00004072 _____ C:\Users\user1\Desktop\SpyHunter4_20130827_100904.log
2013-08-25 22:13 - 2011-04-12 09:43 - 00653928 _____ C:\Windows\system32\perfh007.dat
2013-08-25 22:13 - 2011-04-12 09:43 - 00129800 _____ C:\Windows\system32\perfc007.dat
2013-08-25 22:13 - 2009-07-14 07:13 - 01518986 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:57 - 2013-07-02 12:26 - 00000000 ____D C:\Windows\Panther
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 19:46 - 2013-08-27 14:39 - 00153976 _____ C:\Users\user1\Desktop\SpyHunter4_20130825_153701.log
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 13:18 - 2013-07-04 18:36 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-08-25 13:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-25 11:23 - 2013-07-05 10:55 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-24 18:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-16 15:48 - 2013-08-16 15:47 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 15:46 - 2013-07-10 11:26 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 16:15 - 2013-07-04 18:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\HpUpdate
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-05 14:06 - 2013-07-02 13:53 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-31 08:17 - 2013-07-21 11:51 - 00000000 ____D C:\Users\user1\Documents\Mein Steuer-Sparbuch Heute
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
Files to move or delete:
====================
C:\Users\user1\AppData\Local\Temp\LyricsContainertmp.exe
C:\Users\user1\AppData\Local\Temp\Quarantine.exe
C:\Users\user1\AppData\Local\Temp\SHSetup.exe
C:\Users\user1\AppData\Local\Temp\7zS294C\HPSLPSVC64.DLL
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-25 12:54
==================== End Of Log ============================
--- --- --- Code:
ATTFilter # AdwCleaner v3.001 - Report created 27/08/2013 at 21:37:07
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : user1 - USER1-PC
# Running from : C:\Users\user1\Desktop\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Program Files (x86)\LyricsContainer
Folder Deleted : C:\Users\user1\AppData\Roaming\Babylon
Folder Deleted : C:\Users\user1\AppData\Roaming\Iminent
Folder Deleted : C:\Users\user1\AppData\Roaming\Systweak
File Deleted : C:\Windows\System32\roboot64.exe
File Deleted : C:\Users\user1\Desktop\eBay.lnk
File Deleted : C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
File Deleted : C:\Windows\Tasks\LyricsContainer Update.job
File Deleted : C:\Windows\System32\Tasks\LyricsContainer Update
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Iminent
Key Deleted : HKCU\Software\AppDataLow\Software\LyricsContainer
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\BabylonToolbar
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\Software\systweak
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
***** [ Browsers ] *****
-\\ Internet Explorer v10.0.9200.16660
-\\ Google Chrome v28.0.1500.95
[ File : C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted : icon_url
Deleted : search_url
Deleted : keyword
Deleted : urls_to_restore_on_startup
*************************
AdwCleaner[R0].txt - [7364 octets] - [27/08/2013 21:30:28]
AdwCleaner[S0].txt - [7026 octets] - [27/08/2013 21:37:07]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7086 octets] ##########
|
|
27.08.2013, 21:06
| #6 |
| /// TB-Ausbilder | System läuft langsam Lyrics container und weiteres? Welche Probleme bestehen aktuell noch?
__________________ --> System läuft langsam Lyrics container und weiteres? |
|
27.08.2013, 21:58
| #7 |
| | System läuft langsam Lyrics container und weiteres? Hallo Leo Die lästige Werbung ist weg, und das System läuft wieder deutlich schneller. Vielen Dank für deine schnelle Hilfe - eine tolle Sache das Trojaner-board!  Gruss Blarilon und Familie! |
|
27.08.2013, 22:10
| #8 |
| /// TB-Ausbilder | System läuft langsam Lyrics container und weiteres? Ok, dann machen wir zum Schluss noch eine Kontrolle: ESET Online Scanner
__________________ cheers, Leo |
|
29.08.2013, 12:37
| #9 |
| | System läuft langsam Lyrics container und weiteres? Hallo Leo Sorry - hat etwas gedauert - WLAN Problem. Wie mir scheint, hat er noch was gefunden: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not read file from internet.ESETSmartInstaller@High as downloader log:
Can not read file from internet.ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a92ffa695f96fe47b13397f0f16b65b3
# engine=14935
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-28 08:05:48
# local_time=2013-08-28 10:05:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 88623 129350198 0 0
# scanned=118970
# found=6
# cleaned=0
# scan_time=6426
sh=EA3158C045983FB09F38361543973D8B3F7016AE ft=1 fh=f3358fe5f6b3f939 vn="multiple threats" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIT0F3UI\LyricsContainer_1060-8001_v122[2]"
sh=3678EF29574BF6DA4B1A3B683DC4FF32BF5CE81A ft=1 fh=eab2e116c8e46ce2 vn="Win32/Adware.AddLyrics.L application" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O9C3NQTM\LyricsContainer_1060-8001_v122[1]"
sh=9B2C313ECB5FCD1F0929490A6D84ECA062F1AB83 ft=1 fh=6ffdbc2e4907c207 vn="a variant of Win32/Adware.iBryte.G application" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O9C3NQTM\setup.exe"
sh=E4309AF4DA5E1192B78BED1C55DEADBCEFC1400A ft=1 fh=3b6d0fe152b824d4 vn="multiple threats" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQG0E4CE\LyricsContainer_1060-8001_v122[1]"
sh=E4309AF4DA5E1192B78BED1C55DEADBCEFC1400A ft=1 fh=3b6d0fe152b824d4 vn="multiple threats" ac=I fn="C:\Users\user1\AppData\Local\Temp\LyricsContainertmp.exe"
sh=F1605E6D08D0470856784DB3DB715656A6BFE2BA ft=1 fh=e609454aa9cc4e00 vn="probably a variant of Win32/Agent.IUKDZWI trojan" ac=I fn="G:\Lokaler Datenträger\t-online\EMAIL4\mui.exe"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a92ffa695f96fe47b13397f0f16b65b3
# engine=14938
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-29 11:12:26
# local_time=2013-08-29 01:12:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 143021 129404596 0 0
# scanned=278734
# found=12
# cleaned=0
# scan_time=8731
sh=EA3158C045983FB09F38361543973D8B3F7016AE ft=1 fh=f3358fe5f6b3f939 vn="multiple threats" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIT0F3UI\LyricsContainer_1060-8001_v122[2]"
sh=3678EF29574BF6DA4B1A3B683DC4FF32BF5CE81A ft=1 fh=eab2e116c8e46ce2 vn="Win32/Adware.AddLyrics.L application" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O9C3NQTM\LyricsContainer_1060-8001_v122[1]"
sh=9B2C313ECB5FCD1F0929490A6D84ECA062F1AB83 ft=1 fh=6ffdbc2e4907c207 vn="a variant of Win32/Adware.iBryte.G application" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O9C3NQTM\setup.exe"
sh=E4309AF4DA5E1192B78BED1C55DEADBCEFC1400A ft=1 fh=3b6d0fe152b824d4 vn="multiple threats" ac=I fn="C:\Users\user1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQG0E4CE\LyricsContainer_1060-8001_v122[1]"
sh=E4309AF4DA5E1192B78BED1C55DEADBCEFC1400A ft=1 fh=3b6d0fe152b824d4 vn="multiple threats" ac=I fn="C:\Users\user1\AppData\Local\Temp\LyricsContainertmp.exe"
sh=F1605E6D08D0470856784DB3DB715656A6BFE2BA ft=1 fh=e609454aa9cc4e00 vn="probably a variant of Win32/Agent.IUKDZWI trojan" ac=I fn="G:\Lokaler Datenträger\t-online\EMAIL4\mui.exe"
sh=F180DEFA96A16DA39C7989A35BF5631B59C3DBBB ft=1 fh=bf6c06fa3ebb6603 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="G:\Program Files\Yontoo Layers Runtime\YontooIEClient.dll"
sh=F180DEFA96A16DA39C7989A35BF5631B59C3DBBB ft=1 fh=bf6c06fa3ebb6603 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="G:\Program Files\Yontoo Layers Runtime\YontooIEClient_2.dll"
sh=4E87476DC084C0FD24240ED0540A5A2B77551FF3 ft=1 fh=d730a63e5b652eb9 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="G:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll"
sh=48EF8B4E06E0F1D3C06C4D6E1EA2B6CE48AA5231 ft=1 fh=ac26df35aa8ade69 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="G:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll"
sh=CDBA97B649DDA56359B6A62FA9F0BF1EE1F0F37E ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="H:\USER1-PC\Backup Set 2013-07-04 073233\Backup Files 2013-07-08 133249\Backup files 1.zip"
sh=E9CDCFD9F07E6FD215501D11499A29EAFC443142 ft=0 fh=0000000000000000 vn="Win32/Adware.AddLyrics.L application" ac=I fn="H:\USER1-PC\Backup Set 2013-07-04 073233\Backup Files 2013-08-20 122435\Backup files 1.zip"
|
|
29.08.2013, 12:49
| #10 |
| /// TB-Ausbilder | System läuft langsam Lyrics container und weiteres? Hallo, diese Funde von ESET sind harmlos. Nur noch ein paar inaktive Dinge in den temporären Dateien und etwas Adware auf einer externen Platte. Ansonsten siehts gut aus und wir räumen noch auf. Schritt 1 Lade dir  TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Schritt 2 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter G:\Program Files\Yontoo Layers Runtime
G:\ProgramData\Tarma Installer
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 3 Dein Flashplayer im Internet Explorer ist veraltet. Installiere folgendermassen die aktuelle Version:
Cleanup Zum Schluss werden wir jetzt noch unsere Tools (inklusive der Quarantäne-Ordner) wegräumen, die verseuchten Systemwiederherstellungspunkte löschen und alle Einstellungen wieder herrichten. Auch diese Schritte sind noch wichtig und sollten in der angegebenen Reihenfolge ausgeführt werden.
>> OK << Wir sind durch, deine Logs sehen für mich im Moment sauber aus.  Ich habe dir nachfolgend ein paar Hinweise und Tipps zusammengestellt, die dazu beitragen sollen, dass du in Zukunft unsere Hilfe nicht mehr brauchen wirst. Bitte gib mir danach noch eine kurze Rückmeldung, wenn auch von deiner Seite keine Probleme oder Fragen mehr offen sind, damit ich dieses Thema als erledigt betrachten kann. Epilog: Tipps, Dos & Don'ts  Aktualität von System und SoftwareDas Betriebsystem Windows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die automatischen Updates aktiviert sind:
Auch die installierte Software sollte immer in der aktuellsten Version vorliegen. Speziell gilt das für den Browser, Java, Flash-Player und PDF-Reader, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.
Sicherheits-SoftwareEine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine verseuchte Datei nicht erkennt). Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.
Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt. Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox einsetzen, für welchen es zwei nützliche Addons zur Empfehlung gibt:
(Un-)Sicheres Verhalten im InternetNebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert. Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
Allgemeine HinweiseAbschliessend noch ein paar grundsätzliche Bemerkungen:
Wenn du möchtest, kannst du das Forum mit einer kleinen Spende unterstützen. Es bleibt mir nur noch, dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. 
__________________ cheers, Leo |
|
16.09.2013, 17:16
| #11 |
| /// TB-Ausbilder | System läuft langsam Lyrics container und weiteres? Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten. Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter. Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.
__________________ cheers, Leo |
|
| Themen zu System läuft langsam Lyrics container und weiteres? |
| .dll, ads not by this site, esgscanner.sys, farbar, farbar recovery scan tool, internet explorer, minidump, search the web, services.exe, software, spyhunter, spyhunter entfernen, werbung, win32/adware.addlyrics.l, win32/adware.ibryte.g, win32/adware.yontoo.a, win32/adware.yontoo.b, win32/agent.iukdzwi, winlogon.exe |
Linear-Darstellung
