| |
| |||||||
Log-Analyse und Auswertung: System läuft langsam Lyrics container und weiteres?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.08.2013, 14:06
| #1 |
| |  System läuft langsam Lyrics container und weiteres? Hallo Mein System läuft sehr langsam und blendet Werbung ein, wenn ich die Maus über einen Link bewege, so dass man dann auf die Anzeige klickt. Zudem werden im Internet Explorer Anzeigen eingeblendet (ads not by this site). Zudem kommen Anzeigen wie "Harddisk voll" oder "Fehler in Registry - klicken sie hier". Kaspersky (kostenpflichtig) läuft auf dem System - ein Suchlauf findet auch was - kriegt es aber nicht weg. Mit CCleaner hab ich versucht (Sorry - Hinweis erst bei Trojaner-board.de gelesen). Spy Hunter kann ihn auch sehen, Reinigen jedoch nicht versucht, da Kaspersky ihn auch nicht weg bringt? Würde mich sehr über Hilfe freuen - schon vorweg mal vielen Dank! Gruss Blarilon Hier die verschiedenen Logs: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:02 on 27/08/2013 (user1)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-08-2013 01
Ran by user1 (administrator) on 27-08-2013 12:07:05
Running from C:\Users\user1\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
() C:\Program Files (x86)\LyricsContainer\LrcsCtrUpdr.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(1und1 Mail und Media GmbH) C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\klwtblfs.exe
(Adobe Systems, Inc.) C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
==================== Registry (Whitelisted) ==================
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2583040 2009-09-21] (VIA)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [MailCheck IE Broker] - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [1519680 2013-07-01] (1und1 Mail und Media GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - DefaultScope {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=a8b5d9a7000000000000944452c4709b
SearchScopes: HKCU - {1FF4259F-93AA-4444-8F75-73D707651E37} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {739111B9-032E-4E22-90D3-C2C6193C2F90} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {A6814DBE-4BE2-43A4-90E1-FA49B7DFB707} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {D7EEE78E-8FDC-42B5-BB58-A298A40551D5} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: LyricsContainer - {77e880b5-cae7-4928-8507-ec2e5007e73e} - C:\Program Files (x86)\LyricsContainer\128.dll (LyricsContainer)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WEB.DE MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKLM-x32 - WEB.DE MailCheck - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Toolbar: HKCU - WEB.DE MailCheck - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll (1und1 Mail und Media GmbH)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR RestoreOnStartup: "hxxp://search.babylon.com/?affID=119556&babsrc=HP_ss&mntrId=a8b5d9a7000000000000944452c4709b"
CHR DefaultSearchURL: (Search the web (Babylon)) - hxxp://search.babylon.com/?q={searchTerms}&affID=119556&babsrc=SP_ss&mntrId=a8b5d9a7000000000000944452c4709b
CHR DefaultSuggestURL: (Search the web (Babylon)) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Extension: (LyricsContainer) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\abfmigjiaapipflmopkaaooigcjjdojh\1.128_0
CHR Extension: (Google Docs) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Gmail) - C:\Users\user1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [abfmigjiaapipflmopkaaooigcjjdojh] - C:\Program Files (x86)\LyricsContainer\128.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [fjoijdanhaiflhibkljeklcghcmmfffh] - C:\Program Files (x86)\WebCake\WebCakeLayers.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\virtkbd.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356376 2013-07-04] (Kaspersky Lab ZAO)
R2 HPSLPSVC; C:\Users\user1\AppData\Local\Temp\7zS294C\hpslpsvc64.dll [1039360 2013-02-06] (Hewlett-Packard Co.)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-06-27] (Enigma Software Group USA, LLC.)
==================== Drivers (Whitelisted) ====================
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-07-04] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-07-04] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-07-04] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-04] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-07-04] (Kaspersky Lab ZAO)
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-27 12:06 - 2013-08-27 10:49 - 01578852 _____ (Farbar) C:\Users\user1\Desktop\FRST64.exe
2013-08-27 12:06 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 12:05 - 2013-08-27 12:05 - 00001088 _____ C:\Users\user1\Desktop\FRST64 - Verknüpfung.lnk
2013-08-27 12:04 - 2013-08-27 12:04 - 00031361 _____ C:\Users\user1\Downloads\FRST.txt
2013-08-27 11:43 - 2013-08-27 11:44 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 11:43 - 2013-08-27 11:43 - 437610776 _____ C:\Windows\MEMORY.DMP
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:50 - 2013-08-27 10:50 - 00022191 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:48 - 2013-08-27 10:49 - 01578852 _____ (Farbar) C:\Users\user1\Downloads\FRST64.exe
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-25 20:29 - 2013-08-27 12:02 - 00007168 _____ C:\Windows\setupact.log
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:36 - 2013-08-25 15:37 - 00000000 ____D C:\sh4ldr
2013-08-25 15:36 - 2013-08-25 15:36 - 00003326 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-25 15:36 - 2013-08-25 15:36 - 00002254 _____ C:\Users\user1\Desktop\SpyHunter.lnk
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:36 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 10:47 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-25 10:47 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-25 10:47 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-25 10:47 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-25 10:47 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-25 10:47 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-25 10:47 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-25 10:47 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-16 15:52 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-16 15:52 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-16 15:52 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-16 15:52 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 15:52 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 15:52 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 15:52 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 15:52 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-16 15:52 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 15:51 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-16 15:51 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-16 15:51 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 15:51 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 15:51 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 15:51 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 15:47 - 2013-08-16 15:48 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 14:16 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 14:16 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 14:16 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 14:11 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 14:11 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 14:11 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 14:11 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 14:11 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 14:11 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 14:11 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 13:51 - 2013-08-25 19:47 - 00000000 ____D C:\Program Files (x86)\LyricsContainer
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
2013-07-30 11:13 - 2013-07-05 09:16 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help
==================== One Month Modified Files and Folders =======
2013-08-27 12:05 - 2013-08-27 12:05 - 00001088 _____ C:\Users\user1\Desktop\FRST64 - Verknüpfung.lnk
2013-08-27 12:04 - 2013-08-27 12:04 - 00031361 _____ C:\Users\user1\Downloads\FRST.txt
2013-08-27 12:03 - 2013-07-02 13:53 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-27 12:02 - 2013-08-25 20:29 - 00007168 _____ C:\Windows\setupact.log
2013-08-27 11:56 - 2013-07-04 19:02 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-27 11:56 - 2013-07-02 13:53 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-27 11:55 - 2013-07-05 09:31 - 00000398 _____ C:\Windows\Tasks\LyricsContainer Update.job
2013-08-27 11:51 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-27 11:51 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-27 11:47 - 2013-07-02 12:07 - 01759600 _____ C:\Windows\WindowsUpdate.log
2013-08-27 11:44 - 2013-08-27 11:43 - 00487680 _____ C:\Windows\Minidump\082713-18296-01.dmp
2013-08-27 11:44 - 2013-07-02 12:56 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-27 11:44 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-27 11:43 - 2013-08-27 11:43 - 437610776 _____ C:\Windows\MEMORY.DMP
2013-08-27 11:43 - 2013-07-05 11:29 - 00000000 ____D C:\Windows\Minidump
2013-08-27 10:52 - 2013-08-27 12:06 - 00377856 _____ C:\Users\user1\Desktop\gmer_2.1.19163.exe
2013-08-27 10:52 - 2013-08-27 10:52 - 00377856 _____ C:\Users\user1\Downloads\gmer_2.1.19163.exe
2013-08-27 10:50 - 2013-08-27 10:50 - 00022191 _____ C:\Users\user1\Downloads\Addition.txt
2013-08-27 10:49 - 2013-08-27 12:06 - 01578852 _____ (Farbar) C:\Users\user1\Desktop\FRST64.exe
2013-08-27 10:49 - 2013-08-27 10:49 - 00000000 ____D C:\FRST
2013-08-27 10:49 - 2013-08-27 10:48 - 01578852 _____ (Farbar) C:\Users\user1\Downloads\FRST64.exe
2013-08-27 10:47 - 2013-08-27 10:47 - 00000000 _____ C:\Users\user1\defogger_reenable
2013-08-27 10:47 - 2013-07-02 12:07 - 00000000 ____D C:\Users\user1
2013-08-27 10:46 - 2013-08-27 12:06 - 00050477 _____ C:\Users\user1\Desktop\Defogger.exe
2013-08-27 10:46 - 2013-08-27 10:46 - 00050477 _____ C:\Users\user1\Downloads\Defogger.exe
2013-08-27 10:34 - 2013-07-02 14:06 - 00000000 ____D C:\Users\user1\Documents\Outlook-Dateien
2013-08-25 22:13 - 2011-04-12 09:43 - 00653928 _____ C:\Windows\system32\perfh007.dat
2013-08-25 22:13 - 2011-04-12 09:43 - 00129800 _____ C:\Windows\system32\perfc007.dat
2013-08-25 22:13 - 2009-07-14 07:13 - 01518986 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-25 20:29 - 2013-08-25 20:29 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 19:57 - 2013-07-02 12:26 - 00000000 ____D C:\Windows\Panther
2013-08-25 19:56 - 2013-08-25 19:56 - 00007600 _____ C:\Users\user1\AppData\Local\Resmon.ResmonCfg
2013-08-25 19:47 - 2013-08-16 13:51 - 00000000 ____D C:\Program Files (x86)\LyricsContainer
2013-08-25 15:37 - 2013-08-25 15:37 - 00000000 _____ C:\autoexec.bat
2013-08-25 15:37 - 2013-08-25 15:36 - 00000000 ____D C:\sh4ldr
2013-08-25 15:36 - 2013-08-25 15:36 - 00003326 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-25 15:36 - 2013-08-25 15:36 - 00002254 _____ C:\Users\user1\Desktop\SpyHunter.lnk
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-25 15:36 - 2013-08-25 15:36 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-25 15:31 - 2013-07-17 13:03 - 00000000 ____D C:\Users\user1\AppData\Roaming\Systweak
2013-08-25 15:30 - 2013-08-25 15:30 - 00042086 _____ C:\Users\user1\Documents\Registry sicherheitskopie cc_20130825_152958.reg
2013-08-25 15:30 - 2013-08-25 15:30 - 00006526 _____ C:\Users\user1\Documents\cc_20130825_153048.reg
2013-08-25 15:28 - 2013-08-25 15:28 - 00002772 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-08-25 15:28 - 2013-08-25 15:28 - 00000000 ____D C:\Program Files\CCleaner
2013-08-25 13:18 - 2013-07-04 18:36 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-08-25 13:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-25 11:23 - 2013-07-05 10:55 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-08-24 18:20 - 2013-08-24 18:20 - 00000000 ____D C:\Users\user1\Desktop\Bewerbungsunterlagen Anne
2013-08-24 18:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-16 15:48 - 2013-08-16 15:47 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 15:46 - 2013-07-10 11:26 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-16 13:51 - 2013-07-05 09:31 - 00003046 _____ C:\Windows\System32\Tasks\LyricsContainer Update
2013-08-14 16:15 - 2013-07-04 18:36 - 00000000 ____D C:\Users\user1\AppData\Roaming\HpUpdate
2013-08-12 16:28 - 2013-08-12 16:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-08-05 14:06 - 2013-07-02 13:53 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-31 08:17 - 2013-07-21 11:51 - 00000000 ____D C:\Users\user1\Documents\Mein Steuer-Sparbuch Heute
2013-07-30 16:02 - 2013-07-30 16:02 - 02203648 _____ C:\Users\user1\Downloads\Loor 2013.xls
2013-07-30 13:28 - 2013-07-30 13:28 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HP
2013-07-30 11:14 - 2013-07-30 11:14 - 00109680 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-30 11:14 - 2013-07-30 11:14 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-30 11:13 - 2013-07-30 11:13 - 00000020 ___SH C:\Users\Gast\ntuser.ini
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-30 11:13 - 2013-07-30 11:13 - 00000000 ____D C:\Users\Gast
Files to move or delete:
====================
C:\Users\user1\AppData\Local\Temp\SHSetup.exe
C:\Users\user1\AppData\Local\Temp\7zS294C\HPSLPSVC64.DLL
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-25 12:54
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-27 12:24:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005c Hitachi_ rev.JP2O 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\user1\AppData\Local\Temp\pgloapob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1724] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007771faa8 5 bytes JMP 0000000172e319b0
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1724] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077720038 5 bytes JMP 0000000172e32066
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075871465 2 bytes [87, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758714bb 2 bytes [87, 75]
.text ... * 2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075871465 2 bytes [87, 75]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758714bb 2 bytes [87, 75]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\WUDFHost.exe [2216:2468] 000007fef76924a0
---- EOF - GMER 2.1 ----
Code:
ATTFilter Typ: Adware (1)
not-a-virus:AdWare.Win32.Lyckriks.cs Inaktiv 27.08.2013 12:09:01 hxxp://app.updateserv.net/u/v122/LyricsContainer_1060-8001_v122.exe?id=9AB04266B15106F0&rand=6030// LrcsCtrUpdr.exe
|
| Themen zu System läuft langsam Lyrics container und weiteres? |
| .dll, ads not by this site, esgscanner.sys, farbar, farbar recovery scan tool, internet explorer, minidump, search the web, services.exe, software, spyhunter, spyhunter entfernen, werbung, win32/adware.addlyrics.l, win32/adware.ibryte.g, win32/adware.yontoo.a, win32/adware.yontoo.b, win32/agent.iukdzwi, winlogon.exe |
Baum-Darstellung