win vista läuft langsam/malwarebytes fund: PUP.optional.tarma und andere

dondoedl · 18.09.2013, 11:01

hallo leute,

nachdem mein win vista rechner seit einiger zeit bluescreen fehler hatte (auto reboot) und ständig die verbindung mit dns server abgebrochen ist, hatte ich die systemwiederherstellung aktiviert und danach Malwarebytes laufen lassen. log datei anligend.

anhängend die logs
frst und mbam

ich kann mich erinnern, eine mail mit virusanhang erhalten zu haben. die mail hatte ich geöffnet, den anhang (zip) damals aber nicht. könnte ja meine rettung sein?!
hier noch eine seltsame feststellung: nach boot höre ich den plug in ton (wie beim einstecken vom usb) schaltet sich da irgendetwas von selbst an und aus??

im voraus schonmal lieben dank für eure unterstützung

markus

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-18 12:21:10
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 TOSHIBA_MK5076GSX rev.GS001A 465,76GB
Running: 33g0y1bc.exe; Driver: C:\Users\MARKUS~1\AppData\Local\Temp\uftcypog.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwAdjustPrivilegesToken [0x911A36BA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwAlpcConnectPort [0x91156C02]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwAlpcCreatePort [0x91156F4A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwAlpcSendWaitReceivePort [0x91157390]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwClose [0x9113F28C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwConnectPort [0x911568DC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateEvent [0x9113F804]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateMutant [0x9113F6EA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreatePort [0x91156DAE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateSection [0x911A6528]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateSemaphore [0x9113F924]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateThread [0x911A59BC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateWaitablePort [0x91156E7C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwDebugActiveProcess [0x911A5506]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwDeviceIoControlFile [0x9113F2D0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwDuplicateObject [0x911A37FC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwLoadDriver [0x911A3464]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwMapViewOfSection [0x911A6320]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwNotifyChangeKey [0x9115506C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwOpenEvent [0x9113F89A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwOpenMutant [0x9113F77A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwOpenProcess [0x911A50AE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwOpenSection [0x911A67D4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwOpenSemaphore [0x9113F9BA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwOpenThread [0x911A5718]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwQueryDirectoryObject [0x9113FA44]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwQueryObject [0x9115527A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwQueueApcThread [0x911A61D4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwReplyPort [0x91157174]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwReplyWaitReceivePort [0x91157002]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwReplyWaitReceivePortEx [0x911570B8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwRequestWaitReplyPort [0x911571E4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwResumeThread [0x911A5EFE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwSecureConnectPort [0x91156A6A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwSetContextThread [0x911A605C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwSetInformationToken [0x9113FAE6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwSetSystemInformation [0x911A356E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwSuspendProcess [0x911A524E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwSuspendThread [0x911A5DA6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwSystemDebugControl [0x9113FAF8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwTerminateProcess [0x911A53AE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwTerminateThread [0x911A58B8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwUnmapViewOfSection [0x911A693C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwWriteVirtualMemory [0x911A6666]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateThreadEx [0x911A5BFC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys                                                                           ZwCreateUserProcess [0x911A5660]

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!KeSetEvent + 119                                                                                   82CC7764 4 Bytes  [BA, 36, 1A, 91]
.text           ntkrnlpa.exe!KeSetEvent + 13D                                                                                   82CC7788 8 Bytes  [02, 6C, 15, 91, 4A, 6F, 15, ...]
.text           ntkrnlpa.exe!KeSetEvent + 181                                                                                   82CC77CC 4 Bytes  JMP 98400853 
.text           ntkrnlpa.exe!KeSetEvent + 1A9                                                                                   82CC77F4 4 Bytes  [8C, F2, 13, 91]
.text           ntkrnlpa.exe!KeSetEvent + 1C1                                                                                   82CC780C 4 Bytes  [DC, 68, 15, 91] {FSUBR QWORD [EAX+0x15]; XCHG ECX, EAX}
.text           ...                                                                                                             

---- User code sections - GMER 2.1 ----

?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[652] C:\Windows\system32\ntdll.dll      time/date stamp mismatch; 
?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[652] C:\Windows\system32\kernel32.dll   time/date stamp mismatch; 
?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[652] C:\Windows\system32\ole32.dll      time/date stamp mismatch; unknown module: MPR.dllunknown module: msiltcfg.dllunknown module: CLBCatQ.DLLunknown module: OLEAUT32.dllunknown module: imagehlp.dll
.text           C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[652] USER32.dll!SetScrollInfo + 7A8     77D97980 4 Bytes  [83, 30, 0C, 73]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtCreateFile + 6                          77C2426A 4 Bytes  [28, F8, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtCreateFile + B                          77C2426F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtMapViewOfSection + 6                    77C249BA 4 Bytes  [28, FB, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtMapViewOfSection + B                    77C249BF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenFile + 6                            77C24A4A 4 Bytes  [68, F8, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenFile + B                            77C24A4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenProcess + 6                         77C24ACA 4 Bytes  [A8, F9, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenProcess + B                         77C24ACF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenProcessToken + B                    77C24ADF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenProcessTokenEx + 6                  77C24AEA 4 Bytes  [A8, FA, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenProcessTokenEx + B                  77C24AEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenThread + 6                          77C24B3A 4 Bytes  [68, F9, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenThread + B                          77C24B3F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenThreadToken + 6                     77C24B4A 4 Bytes  [68, FA, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenThreadToken + B                     77C24B4F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtOpenThreadTokenEx + B                   77C24B5F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtQueryAttributesFile + 6                 77C24BEA 4 Bytes  [A8, F8, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtQueryAttributesFile + B                 77C24BEF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtQueryFullAttributesFile + B             77C24C9F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtSetInformationFile + 6                  77C2517A 4 Bytes  [28, F9, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtSetInformationFile + B                  77C2517F 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtSetInformationThread + 6                77C251CA 4 Bytes  [28, FA, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtSetInformationThread + B                77C251CF 1 Byte  [E2]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtTerminateProcess                        77C25384 5 Bytes  JMP 00EC2612 C:\Program Files\Google\Chrome\Application\chrome.exe
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtUnmapViewOfSection + 6                  77C2546A 4 Bytes  [68, FB, D7, 00]
.text           C:\Program Files\Google\Chrome\Application\chrome.exe[2624] ntdll.dll!NtUnmapViewOfSection + B                  77C2546F 1 Byte  [E2]
?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[3292] C:\Windows\system32\ntdll.dll     time/date stamp mismatch; 
?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[3292] C:\Windows\system32\kernel32.dll  time/date stamp mismatch; 
?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[3292] C:\Windows\system32\ole32.dll     time/date stamp mismatch; unknown module: MPR.dllunknown module: msiltcfg.dllunknown module: CLBCatQ.DLLunknown module: OLEAUT32.dllunknown module: imagehlp.dll
.text           C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe[3292] USER32.dll!SetScrollInfo + 7A8    77D97980 4 Bytes  [83, 30, 0C, 73]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                         kltdi.sys
AttachedDevice  \Driver\tdx \Device\Udp                                                                                         kltdi.sys
AttachedDevice  \Driver\tdx \Device\RawIp                                                                                       kltdi.sys

---- EOF - GMER 2.1 ----

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-09-2013 03
Ran by Markus Thönnes at 2013-09-18 11:40:28
Running from C:\Users\Markus Thönnes\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

32 Bit HP CIO Components Installer (Version: 6.1.2)
7-Zip 9.20
Adobe Shockwave Player 11.6 (Version: 11.6.8.638)
AMD Catalyst Install Manager (Version: 3.0.838.0)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ATK Hotkey (Version: 1.00.0020)
Bonjour (Version: 3.0.0.10)
bpd_scan (Version: 3.00.0000)
CCleaner (Version: 4.00)
ElsterFormular (Version: 14.3.11574)
Foxit Reader (Version: 5.4.5.114)
Free YouTube to iPhone Converter version 2.11.37.1212 (Version: 2.11.37.1212)
Free YouTube to MP3 Converter version 3.12.1.320 (Version: 3.12.1.320)
Google Chrome (Version: 29.0.1547.66)
Google Earth (Version: 7.1.1.1888)
Google Update Helper (Version: 1.3.21.153)
HP Deskjet 3070 B611 series - Grundlegende Software für das Gerät (Version: 23.0.504.0)
HP Deskjet 3070 B611 series Hilfe (Version: 140.0.2.2)
HP Update (Version: 5.002.007.004)
iTunes (Version: 11.0.5.5)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
JMB36X Raid Configurer (Version: 1.00.0000)
Kaspersky Internet Security 2013 (Version: 13.0.1.4190)
KPS DesignStudio 2010 (Version: 171.03)
LifeFrame3 (Version: 3.0.2)
Malwarebytes Anti-Malware Version 1.70.0.1100 (Version: 1.70.0.1100)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Motorola SM56 Speakerphone Modem (Version: 6.12.25.06)
OpenOffice.org 3.4.1 (Version: 3.41.9593)
PDFCreator (Version: 1.6.2)
QuickTime (Version: 7.74.80.86)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (Version: 3.51.01)
Samsung AllShare (Version: 2.1.0.12031_10)
Sentinel Protection Installer 7.6.1 (Version: 7.6.1)
Skype™ 6.1 (Version: 6.1.129)
swMSM (Version: 12.0.0.1)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
USB 2.0 1.3M UVC WebCam
VLC media player 2.0.3 (Version: 2.0.3)
VoiceOver Kit (Version: 1.42.128.0)
WinRAR 4.20 (32-Bit) (Version: 4.20.0)
WinTer Windows Terminplaner
Wireless Console 2 (Version: 2.0.8)

==================== Restore Points  =========================

18-08-2013 11:17:43 Geplanter Prüfpunkt
19-08-2013 08:54:25 Geplanter Prüfpunkt
20-08-2013 15:41:21 Windows Update
21-08-2013 09:52:23 Geplanter Prüfpunkt
22-08-2013 09:41:43 Geplanter Prüfpunkt
23-08-2013 13:43:02 Geplanter Prüfpunkt
24-08-2013 11:13:43 Geplanter Prüfpunkt
26-08-2013 15:25:44 Geplanter Prüfpunkt
27-08-2013 11:13:23 Geplanter Prüfpunkt
28-08-2013 08:04:09 Geplanter Prüfpunkt
31-08-2013 13:45:39 Geplanter Prüfpunkt
01-09-2013 09:16:47 Geplanter Prüfpunkt
01-09-2013 20:13:57 Konfiguriert Wireless Console 2
01-09-2013 20:17:10 Entfernt ATK Hotkey
01-09-2013 20:38:35 Windows Update
01-09-2013 20:42:04 Windows Update
02-09-2013 09:11:13 Geplanter Prüfpunkt
02-09-2013 19:12:17 Gerätetreiber-Paketinstallation: Intel Netzwerkadapter
02-09-2013 19:12:29 Gerätetreiber-Paketinstallation: Intel Netzwerkadapter
02-09-2013 19:21:07 Konfiguriert Wireless Console 2
02-09-2013 19:22:12 Entfernt Wireless Console 2
02-09-2013 19:22:40 Installiert Wireless Console 2
02-09-2013 19:45:54 vor hotfix
03-09-2013 09:28:14 Removed Bonjour
03-09-2013 09:31:06 Removed Bonjour
03-09-2013 09:32:58 Installed Bonjour Print Services
03-09-2013 22:04:04 Geplanter Prüfpunkt
05-09-2013 06:36:57 Installiert ATK Hotkey
05-09-2013 10:55:51 Removed Bonjour-Druckdienste
06-09-2013 06:42:59 Geplanter Prüfpunkt
07-09-2013 10:25:15 Geplanter Prüfpunkt
09-09-2013 08:57:01 Geplanter Prüfpunkt
10-09-2013 11:02:17 Geplanter Prüfpunkt
11-09-2013 08:04:15 Geplanter Prüfpunkt
12-09-2013 11:09:05 Geplanter Prüfpunkt
14-09-2013 10:55:19 Geplanter Prüfpunkt
15-09-2013 10:49:24 Wiederherstellungsvorgang
15-09-2013 11:49:59 Windows Update
15-09-2013 12:35:55 Entfernt Wireless Console 2
15-09-2013 12:42:09 Installiert Wireless Console 2
15-09-2013 12:57:11 Windows Update

==================== Hosts content: ==========================

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {29E5D6AC-9E15-46D9-83E1-731226101C73} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2008-01-21] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {3D89417D-4083-4AF7-8893-48BB55D190B9} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {492A358A-517A-48E7-8722-0074E002AA98} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {562A3A71-B4B4-4B49-B59F-2F4D635EF219} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-03-27] (Google Inc.)
Task: {70C15586-DF59-4F38-B9C0-2A75CFF11A25} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd)
Task: {C2876143-B012-4D50-927E-725860DEB466} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {F269FF5F-4A1F-4FC7-BD49-2287CB01F929} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-03-27] (Google Inc.)
Task: {F7AFDFF8-C073-432D-95A0-360D98998934} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Markus Thönnes => C:\Program Files\Windows Calendar\wincal.exe [2009-04-10] (Microsoft Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-08-17 21:39 - 2012-08-17 21:39 - 00159672 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\prremote.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00369080 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\prloader.dll
2012-09-01 19:36 - 2007-09-21 00:43 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2012-08-17 21:40 - 2013-07-25 08:54 - 00083648 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ushata.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00013240 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avpinit.dll
2012-12-14 13:45 - 2013-07-25 08:54 - 00828096 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avpmain.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00097720 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\fssync.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00147896 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\DumpWriter.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00611768 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\service.dll
2012-08-17 21:41 - 2012-08-17 21:41 - 00110008 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\nfio.ppl
2012-08-17 21:41 - 2012-08-17 21:41 - 00021432 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\fsdrvplg.ppl
2012-08-17 21:41 - 2012-08-17 21:41 - 00038840 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\winreg.ppl
2012-12-14 13:45 - 2013-07-25 08:55 - 00045576 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\pxstub.ppl
2012-12-14 13:45 - 2013-07-25 08:55 - 01329008 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\params.ppl
2012-08-17 21:38 - 2012-08-17 21:38 - 01108408 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\app_core_legacy.dll
2012-08-17 21:39 - 2013-07-25 08:54 - 00609288 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\key_value_storage.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00254392 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\eka_meta.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00253368 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\updater_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00126904 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\content_filtering_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00256440 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\am_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00434616 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ac_meta.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00362936 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\app_core_meta.dll
2012-12-14 13:45 - 2012-12-14 13:45 - 00825784 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\product_metainfo.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00208824 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\plugins_meta.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00297400 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ksn_meta.dll
2012-08-17 21:40 - 2013-07-25 08:54 - 00238272 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ucp_meta.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00183224 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\klifpp_meta.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00097720 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\instrumental_meta.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00395192 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\storage.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00036280 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avpservice.dll
2012-12-14 13:45 - 2013-07-25 08:55 - 04885872 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avpgui.ppl
2012-08-17 21:39 - 2012-08-17 21:39 - 02321336 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\QtCore4.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 02289080 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\QtDeclarative4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 01296824 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\QtScript4.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00182200 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\QtSql4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 07269816 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\QtGui4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 02051512 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\QtNetwork4.dll
2012-08-17 21:38 - 2012-08-17 21:38 - 00479160 _____ () C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
2012-12-14 13:45 - 2012-12-14 13:45 - 02162616 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\basegui.ppl
2012-08-17 21:41 - 2013-07-25 08:55 - 00041328 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\thpimpl.ppl
2012-08-17 21:39 - 2012-08-17 21:39 - 00085944 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\memmon.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00657336 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\localization_manager.dll
2012-12-14 13:45 - 2012-12-14 13:45 - 00288696 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\parental_control_gui.dll
2012-08-17 21:41 - 2012-08-17 21:41 - 00018360 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\hashmd5.ppl
2012-08-17 21:40 - 2012-08-17 21:40 - 00034232 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\imageformats\qgif4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00036792 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\imageformats\qico4.dll
2012-08-17 21:40 - 2012-08-17 21:40 - 00189368 _____ (Digia Plc) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\imageformats\qjpeg4.dll
2012-08-17 21:41 - 2012-08-17 21:41 - 00088504 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\propmap.ppl
2012-05-30 20:06 - 2012-05-30 20:06 - 00053608 _____ (Open Source Software community project) C:\Program Files\Common Files\Apple\Apple Application Support\pthreadVC2.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-08-30 23:05 - 2011-08-30 23:05 - 00073064 _____ (Apple Inc.) C:\Windows\system32\dnssd.dll
2006-11-02 14:35 - 2006-11-02 14:35 - 00116736 _____ (Microsoft Corporation) C:\Windows\eHome\ehProxy.dll
2012-08-17 21:39 - 2012-08-17 21:39 - 00351160 _____ (Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\office_antivirus.dll
2013-09-15 14:03 - 2013-09-02 22:35 - 04053456 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.66\pdf.dll
2013-09-15 14:03 - 2013-09-02 22:35 - 00410576 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
2013-09-15 14:03 - 2013-09-02 22:35 - 01604560 _____ () C:\Program Files\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

==================== Faulty Device Manager Devices =============

Name: Microsoft-ISATAP-Adapter
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver


==================== Event log errors: =========================

Application errors:
==================
Error: (09/18/2013 11:35:38 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/18/2013 09:29:56 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 11:59:58 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 03:06:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 02:39:40 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 02:35:50 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {51f600cb-fbce-455d-a5ac-a14174a4edbc}

Error: (09/15/2013 02:08:21 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 01:42:46 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: -528

Error: (09/15/2013 01:42:46 PM) (Source: ESENT) (User: )
Description: Catalog Database (1576) Catalog Database: Fehler -1811 beim Öffnen von Protokolldatei C:\Windows\system32\CatRoot2\edb00111.log.

Error: (09/15/2013 01:05:44 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (09/18/2013 11:35:50 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/18/2013 11:34:58 AM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2711

Error: (09/18/2013 11:34:57 AM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2711

Error: (09/18/2013 11:34:46 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032

Error: (09/18/2013 11:34:06 AM) (Source: NETLOGON) (User: )
Description: Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert, nicht als
Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser
Konfiguration nicht gestartet zu sein.

Error: (09/18/2013 11:32:54 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (09/18/2013 09:30:10 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/18/2013 09:29:58 AM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2711

Error: (09/18/2013 09:29:58 AM) (Source: WMPNetworkSvc) (User: )
Description: 0xc00d2711

Error: (09/18/2013 09:29:09 AM) (Source: Microsoft-Windows-LanguagePackSetup) (User: NT-AUTORITÄT)
Description: 0x80070032


Microsoft Office Sessions:
=========================
Error: (09/18/2013 11:35:38 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/18/2013 09:29:56 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/17/2013 11:59:58 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 03:06:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 02:39:40 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 02:35:50 PM) (Source: VSS)(User: )
Description: 0x80070005

Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {51f600cb-fbce-455d-a5ac-a14174a4edbc}

Error: (09/15/2013 02:08:21 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/15/2013 01:42:46 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: -528

Error: (09/15/2013 01:42:46 PM) (Source: ESENT)(User: )
Description: Catalog Database1576Catalog Database: C:\Windows\system32\CatRoot2\edb00111.log-1811

Error: (09/15/2013 01:05:44 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-09-18 11:39:56.071
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kl1.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:39:55.977
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kl1.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:39:55.864
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kl1.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:39:55.747
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\kl1.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:00:04.721
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:00:04.629
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:00:04.513
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:00:04.421
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:00:04.327
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 11:00:04.234
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22636_none_b38d4a937f96be60\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 37%
Total physical RAM: 3070.29 MB
Available physical RAM: 1922.95 MB
Total Pagefile: 6340.85 MB
Available Pagefile: 5201.45 MB
Total Virtual: 2047.88 MB
Available Virtual: 1906.41 MB

==================== Drives ================================

Drive c: (VistaOS) (Fixed) (Total:465.76 GB) (Free:113.44 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 60C11E70)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-09-2013 03
Ran by Markus Thönnes (administrator) on MARKUSTHÖNNE-PC on 18-09-2013 11:38:47
Running from C:\Users\Markus Thönnes\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
() C:\Program Files\ATK Hotkey\ASLDRSrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SafeNet, Inc.) C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
(SafeNet, Inc) C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
(SafeNet, Inc.) C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
(Microsoft Corporation) C:\Windows\system32\iashost.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Motorola Inc.) C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(ATK0100) C:\Program Files\ATK Hotkey\Hcontrol.exe
() C:\Program Files\Wireless Console 2\wcourier.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
() C:\Program Files\ATK Hotkey\ATKOSD.exe
() C:\Program Files\ATK Hotkey\KBFiltr.exe
() C:\Program Files\ATK Hotkey\WDC.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2012-09-01] ()
HKLM\...\Run: [SMSERIAL] - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [1458176 2009-10-26] (Motorola Inc.)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [AVP] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-12-14] (Kaspersky Lab ZAO)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\MT\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\MT\...\RunOnce: [Application Restart #0] - C:\Program Files\Windows Sidebar\sidebar.exe [ 2009-04-10] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.asus.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKCU - No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} -  No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome: 
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U15) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.150.3) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Angry Birds) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0
CHR Extension: (Google Drive) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Safe Money) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Content Blocker) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\MARKUS~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0
CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

========================== Services (Whitelisted) =================

R2 ASLDRService; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [94208 2007-02-05] ()
R2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2012-12-14] (Kaspersky Lab ZAO)
S3 SamsungAllShareV2.0; C:\Program Files\Samsung\AllShare\AllShareDMS\AllShareDMS.exe [25504 2012-03-02] (Samsung Electronics Co., Ltd.)
R2 SentinelKeysServer; C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [369952 2009-09-17] (SafeNet, Inc.)
R2 SentinelProtectionServer; C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe [1246496 2009-09-17] (SafeNet, Inc)
R2 SentinelSecurityRuntime; C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe [292128 2009-09-17] (SafeNet, Inc.)
S3 SimpleSlideShowServer; C:\Program Files\Samsung\AllShare\AllShareSlideShowService.exe [27584 2012-03-02] (Samsung Electronics Co., Ltd.)

==================== Drivers (Whitelisted) ====================

R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [81936 2011-06-07] (Advanced Micro Devices)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation)
R0 JGOGO; C:\Windows\System32\DRIVERS\JGOGO.sys [6912 2012-09-01] (JMicron )
R0 JRAID; C:\Windows\System32\DRIVERS\jraid.sys [48000 2012-09-01] (JMicron Technology Corp.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [5632 2012-09-01] ( )
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [136024 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [594528 2013-07-25] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [24408 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25944 2012-12-14] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25944 2012-12-14] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [44000 2013-07-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [145040 2013-07-25] (Kaspersky Lab ZAO)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2012-09-01] (ATK0100)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1743232 2012-09-02] ()
S3 SNTNLUSB; C:\Windows\System32\DRIVERS\SNTNLUSB.SYS [38376 2009-09-17] (SafeNet, Inc.)
S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [74848 2013-07-25] (Kaspersky Lab ZAO)
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-18 11:38 - 2013-09-18 11:38 - 00000000 ____D C:\FRST
2013-09-18 11:37 - 2013-09-18 11:37 - 01083437 _____ (Farbar) C:\Users\Markus Thönnes\Downloads\FRST.exe
2013-09-18 11:32 - 2013-09-18 11:32 - 01039554 _____ C:\Users\Markus Thönnes\Downloads\adwcleaner.exe
2013-09-18 11:26 - 2013-09-18 11:27 - 00000490 _____ C:\Users\Markus Thönnes\Downloads\defogger_disable.log
2013-09-18 11:26 - 2013-09-18 11:26 - 00000000 _____ C:\Users\Markus Thönnes\defogger_reenable
2013-09-18 11:25 - 2013-09-18 11:25 - 00050477 _____ C:\Users\Markus Thönnes\Downloads\Defogger.exe
2013-09-18 09:20 - 2013-09-18 09:20 - 00001671 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-18 09:19 - 2013-09-18 09:20 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-09-18 09:19 - 2013-09-18 09:19 - 00000000 ____D C:\Program Files\iPod
2013-09-15 14:42 - 2013-09-15 14:42 - 00000000 ____D C:\Program Files\Wireless Console 2
2013-09-15 14:41 - 2013-09-15 14:41 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Roaming\InstallShield
2013-09-15 14:06 - 2013-09-15 14:06 - 00000300 _____ C:\Windows\PFRO.log
2013-09-15 14:03 - 2013-09-15 14:03 - 00001978 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-15 13:53 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-15 13:53 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-15 13:53 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-15 13:53 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-15 13:53 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-15 13:53 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-15 13:53 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-15 13:53 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-15 13:53 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-15 13:53 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-15 13:53 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-15 13:53 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-15 13:53 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-15 13:53 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-15 13:53 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-15 13:53 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-15 13:49 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-15 13:49 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-09-15 13:49 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-15 13:49 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-15 13:49 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-09-15 13:49 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-15 13:49 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-15 13:49 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-09-15 13:49 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-15 13:48 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-15 13:48 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-15 13:47 - 2013-09-15 13:49 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Local\Deployment
2013-09-15 13:47 - 2013-09-15 13:47 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Local\Apps\2.0
2013-09-15 13:46 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-15 13:46 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-15 13:46 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-15 13:46 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-14 16:25 - 2013-09-14 16:25 - 00000000 _____ C:\Windows\setuperr.log
2013-09-14 16:25 - 2013-09-14 16:25 - 00000000 _____ C:\Windows\setupact.log
2013-09-09 08:56 - 2013-09-09 09:05 - 00019202 _____ C:\Users\Markus Thönnes\Documents\013 Kadel.odt
2013-09-05 09:44 - 2013-09-05 09:44 - 00000000 ____D C:\Users\Markus Thönnes\Downloads\INFUpdate_VT_071009
2013-09-05 09:43 - 2013-09-05 09:43 - 01997844 _____ C:\Users\Markus Thönnes\Downloads\chipset INFUpdate_VT_071009.zip
2013-09-05 09:35 - 2013-09-05 09:38 - 04136446 _____ C:\Users\Markus Thönnes\Downloads\JMB36X_WinDrv_R1.17.62_WHQL.zip
2013-09-03 11:32 - 2013-09-18 09:17 - 00000000 ____D C:\Program Files\Bonjour
2013-09-02 21:52 - 2013-09-02 21:52 - 00000000 ____D C:\Users\Markus Thönnes\Downloads\symbols
2013-09-02 21:10 - 2013-09-02 21:10 - 00000000 ____D C:\Users\Markus Thönnes\Downloads\WLAN_3945ABG_4965AGN_VT
2013-09-02 21:06 - 2013-09-02 21:07 - 22168067 _____ C:\Users\Markus Thönnes\Downloads\WLAN_3945ABG_4965AGN_VT (1).zip
2013-08-21 10:48 - 2013-08-21 10:49 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1(62)
2013-08-21 10:48 - 2013-08-21 10:48 - 00000000 ____D C:\Program Files\iPod(36)
2013-08-20 17:55 - 2013-09-15 13:53 - 00000000 ____D C:\Windows\system32\MRT

==================== One Month Modified Files and Folders =======

2013-09-18 11:38 - 2013-09-18 11:38 - 00000000 ____D C:\FRST
2013-09-18 11:37 - 2013-09-18 11:37 - 01083437 _____ (Farbar) C:\Users\Markus Thönnes\Downloads\FRST.exe
2013-09-18 11:37 - 2013-07-01 19:36 - 01498955 _____ C:\Windows\WindowsUpdate.log
2013-09-18 11:36 - 2013-07-11 20:00 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-09-18 11:34 - 2012-09-01 21:12 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-18 11:34 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-18 11:34 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-18 11:34 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-18 11:33 - 2006-11-02 15:01 - 00032610 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-18 11:32 - 2013-09-18 11:32 - 01039554 _____ C:\Users\Markus Thönnes\Downloads\adwcleaner.exe
2013-09-18 11:27 - 2013-09-18 11:26 - 00000490 _____ C:\Users\Markus Thönnes\Downloads\defogger_disable.log
2013-09-18 11:26 - 2013-09-18 11:26 - 00000000 _____ C:\Users\Markus Thönnes\defogger_reenable
2013-09-18 11:26 - 2012-09-01 18:27 - 00000000 ____D C:\Users\Markus Thönnes
2013-09-18 11:25 - 2013-09-18 11:25 - 00050477 _____ C:\Users\Markus Thönnes\Downloads\Defogger.exe
2013-09-18 11:06 - 2012-09-01 21:12 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-18 10:07 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-18 09:20 - 2013-09-18 09:20 - 00001671 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-18 09:20 - 2013-09-18 09:19 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-09-18 09:20 - 2013-02-20 10:40 - 00000000 ____D C:\Program Files\iTunes
2013-09-18 09:19 - 2013-09-18 09:19 - 00000000 ____D C:\Program Files\iPod
2013-09-18 09:19 - 2012-09-01 22:17 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-09-18 09:17 - 2013-09-03 11:32 - 00000000 ____D C:\Program Files\Bonjour
2013-09-18 09:06 - 2012-09-01 18:27 - 00001356 _____ C:\Users\Markus Thönnes\AppData\Local\d3d9caps.dat
2013-09-15 15:02 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache
2013-09-15 15:01 - 2006-11-02 12:33 - 01468726 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-15 14:42 - 2013-09-15 14:42 - 00000000 ____D C:\Program Files\Wireless Console 2
2013-09-15 14:42 - 2012-09-01 18:59 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-09-15 14:41 - 2013-09-15 14:41 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Roaming\InstallShield
2013-09-15 14:07 - 2006-11-02 14:47 - 00257320 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-15 14:06 - 2013-09-15 14:06 - 00000300 _____ C:\Windows\PFRO.log
2013-09-15 14:04 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE
2013-09-15 14:03 - 2013-09-15 14:03 - 00001978 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-15 14:03 - 2012-09-01 21:12 - 00000000 ____D C:\Program Files\Google
2013-09-15 13:53 - 2013-08-20 17:55 - 00000000 ____D C:\Windows\system32\MRT
2013-09-15 13:49 - 2013-09-15 13:47 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Local\Deployment
2013-09-15 13:47 - 2013-09-15 13:47 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Local\Apps\2.0
2013-09-15 13:04 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\Msdtc
2013-09-15 13:03 - 2012-09-02 19:31 - 00000000 ____D C:\Users\MT
2013-09-15 13:03 - 2006-11-02 12:22 - 54788096 _____ C:\Windows\system32\config\components_previous
2013-09-15 13:03 - 2006-11-02 12:22 - 35389440 _____ C:\Windows\system32\config\software_previous
2013-09-15 13:03 - 2006-11-02 12:22 - 31719424 _____ C:\Windows\system32\config\system_previous
2013-09-15 13:03 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2013-09-15 13:03 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2013-09-15 13:03 - 2006-11-02 12:22 - 00262144 _____ C:\Windows\system32\config\default_previous
2013-09-15 13:02 - 2006-11-02 13:18 - 00000000 __RSD C:\Windows\Media
2013-09-15 13:01 - 2013-07-02 11:14 - 00000000 ____D C:\Program Files\WinTer
2013-09-15 13:01 - 2013-02-28 00:27 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-09-15 13:01 - 2012-09-11 10:29 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Roaming\vlc
2013-09-15 13:01 - 2012-09-11 10:28 - 00000000 ____D C:\Program Files\VideoLAN
2013-09-15 13:01 - 2012-09-04 12:59 - 00000000 ____D C:\Program Files\ATK Hotkey
2013-09-15 13:01 - 2012-09-04 11:16 - 00000000 ____D C:\Users\Markus Thönnes\Downloads\Wireless_Console_VT
2013-09-15 13:01 - 2012-09-02 02:17 - 00000000 ___RD C:\Program Files\Skype
2013-09-15 13:01 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\spool
2013-09-15 13:00 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\registration
2013-09-14 16:25 - 2013-09-14 16:25 - 00000000 _____ C:\Windows\setuperr.log
2013-09-14 16:25 - 2013-09-14 16:25 - 00000000 _____ C:\Windows\setupact.log
2013-09-12 10:35 - 2012-09-04 01:11 - 00000000 ____D C:\Users\Public\Documents\KPS DesignStudio 2010
2013-09-09 09:11 - 2012-09-01 22:32 - 00000000 ____D C:\Users\Markus Thönnes\Desktop\Exel Dokumente
2013-09-09 09:05 - 2013-09-09 08:56 - 00019202 _____ C:\Users\Markus Thönnes\Documents\013 Kadel.odt
2013-09-05 09:44 - 2013-09-05 09:44 - 00000000 ____D C:\Users\Markus Thönnes\Downloads\INFUpdate_VT_071009
2013-09-05 09:43 - 2013-09-05 09:43 - 01997844 _____ C:\Users\Markus Thönnes\Downloads\chipset INFUpdate_VT_071009.zip
2013-09-05 09:38 - 2013-09-05 09:35 - 04136446 _____ C:\Users\Markus Thönnes\Downloads\JMB36X_WinDrv_R1.17.62_WHQL.zip
2013-09-05 08:55 - 2013-01-31 18:39 - 00000000 ____D C:\Windows\Minidump
2013-09-02 21:52 - 2013-09-02 21:52 - 00000000 ____D C:\Users\Markus Thönnes\Downloads\symbols
2013-09-02 21:10 - 2013-09-02 21:10 - 00000000 ____D C:\Users\Markus Thönnes\Downloads\WLAN_3945ABG_4965AGN_VT
2013-09-02 21:07 - 2013-09-02 21:06 - 22168067 _____ C:\Users\Markus Thönnes\Downloads\WLAN_3945ABG_4965AGN_VT (1).zip
2013-09-01 22:10 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles
2013-09-01 16:57 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-26 23:20 - 2013-01-22 21:21 - 00000000 ____D C:\Users\Markus Thönnes\AppData\Roaming\Skype
2013-08-26 20:56 - 2012-09-02 02:17 - 00000000 ____D C:\ProgramData\Skype
2013-08-21 10:49 - 2013-08-21 10:48 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1(62)
2013-08-21 10:48 - 2013-08-21 10:48 - 00000000 ____D C:\Program Files\iPod(36)

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-18 11:39

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.18.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Markus Thönnes :: MARKUSTHÖNNE-PC [Administrator]

18.09.2013 09:31:18
virus log MBAM-log-2013-09-18 (11-15-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 338839
Laufzeit: 1 Stunde(n), 10 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt.

Infizierte Registrierungswerte: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0G2Y1R2X0G1M2S1M0G1S1H -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 5
C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\Users\Markus Thönnes\AppData\Local\Smartbar (PUP.Optional.SmartBar.A) -> Keine Aktion durchgeführt.
C:\Users\Markus Thönnes\AppData\Local\Smartbar\Application (PUP.Optional.SmartBar.A) -> Keine Aktion durchgeführt.

Infizierte Dateien: 5
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt.

(Ende)

win vista läuft langsam/malwarebytes fund: PUP.optional.tarma und andere

Log-Analyse und Auswertung: win vista läuft langsam/malwarebytes fund: PUP.optional.tarma und andere

win vista läuft langsam/malwarebytes fund: PUP.optional.tarma und andere

Ähnliche Themen: win vista läuft langsam/malwarebytes fund: PUP.optional.tarma und andere