| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Firefox-Download mit Doko Search, Wajam, Whilokii, Bonanza Deals, qvo6 u. wsys controlWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
20.10.2013, 03:32
| #1 |
| |  Firefox-Download mit Doko Search, Wajam, Whilokii, Bonanza Deals, qvo6 u. wsys control Hallo, mein neues Notebook wollte ich mit Firefox ausstatten - dummer Weise habe ich beim Download nicht genau genug auf die Quelle geachtet und mir anscheinend ein ganzes Paket an unerwünschten Programmen mit heruntergeladen  . Im Setup wurde darauf aufmerksam gemacht, dass man durch den Klick auf "weiter" automatisch der Installation von Doko-Search, Wajam, Whilokii und Bonanza-Deals zustimmt. Die lange Liste der mitzuinstallierenden Programme machte mich stutzig und ich wollte das Ganze abbrechen, erhielt aber nach dem Anklicken des entsprechenden Buttons im Setup die Mitteilung, dass die Installation fertiggestellt wurde! McAfee meldete, dass ein Trojaner entdeckt und entfernt wurde. Firefox war daraufhin nirgendwo zu finden, aber als Startseite im IE erschien fortan - von McAfee blockiert - etwas mit qvo6.com; über die Einstellungen des IE konnte dies auch nicht (dauerhaft) wieder geändert werden. Qvo6 habe ich mit Hilfe eine Tutorials durch das Löschen von so benannten Dateien in der ?Registry? (ausführen --> "regedit") zu entfernen versucht und das Startseitenproblem ist damit behoben. Ich weiß nur nicht, ob qvo6 damit auch komplett 'gelöscht' ist, oder ob es versteckt noch zu anderen Problemen führen kann? Wajam und Bonanza Deals habe ich über die Systemsteuerung unter Programmen gefunden und beides gelöscht, allerdings bin ich mir auch hier unsicher, ob das Problem damit behoben ist? Außerdem geistert in den dort aufgelisteten Programmen noch wsys control herum und google verheißt darüber nichts Gutes. Ich habe es noch nicht aus der Programmliste gelöscht, weiß aber auch nicht, ob es damit getan wäre...Unter Doko-Search habe ich weder via Systemsteuerung noch in der Registry irgendetwas gefunden, aber ich hab Angst, dass es trotzdem installiert wurde. Und Whilokii taucht bei der Suche in der Registry an einigen Stellen auf, aber ich traue mich auch nicht, dort wild irgendwas zu löschen, und habe ebenso das Gefühl, damit wäre es nicht getan...Ich hoffe, dass mir jemand helfen kann, diese Programme vom Rechner runterzukriegen und dass das, was ich schon 'eigenmächtig' gemacht habe nicht allzu destruktiv war - bin leider erst später auf dieses Forum gestoßen. Da es im Threat "Für alle Hilfesucher" gewünscht war, habe ich Scans mit FRST und GMER gemacht, mit folgenden Ergebnissen: FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-10-2013
Ran by z (administrator) on x on 20-10-2013 02:31:10
Running from C:\Users\z\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Wsys Co., Ltd.) C:\ProgramData\eSafe\eGdpSvc.exe
() C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcagent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Whilokii) C:\Program Files (x86)\Whilokii\updateWhilokii.exe
() C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files\Sleep Memory Optimizer\FFSService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PMMUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_222_ActiveX.exe
(McAfee, Inc.) c:\PROGRA~2\mcafee\SITEAD~1\saui.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Secure Applicayion] - C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe [259728 2012-06-07] ()
HKLM\...\Run: [InstantUpdate] - C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-07] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12476520 2012-04-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2816336 2012-03-20] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1020576 2012-02-28] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800416 2012-02-28] (Atheros Commnucations)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [Global Registration] - C:\Program Files (x86)\Acer\Registration\GREG.exe [855144 2012-02-29] (Acer Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1675160 2012-03-21] (McAfee, Inc.)
HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-26] (Intel Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD5000LPVX-22V0TT0_WD-WXH1E43LNTN3LNTN3&ts=1382214510&type=default&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD5000LPVX-22V0TT0_WD-WXH1E43LNTN3LNTN3&ts=1382214510&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD5000LPVX-22V0TT0_WD-WXH1E43LNTN3LNTN3&ts=1382214510&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD5000LPVX-22V0TT0_WD-WXH1E43LNTN3LNTN3&ts=1382214510&type=default&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=WDCXWD5000LPVX-22V0TT0_WD-WXH1E43LNTN3LNTN3&ts=1382214510&type=default&q={searchTerms}
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20131019222644.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Whilokii - {204df522-9a96-4a72-abb0-60f7a216d6d2} - C:\Program Files (x86)\Whilokii\Whilokiibho.dll (Whilokii)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20131019222644.dll (McAfee, Inc.)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx
==================== Services (Whitelisted) =================
R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-02-17] (Diskeeper Corporation)
R2 FFSOpzSvc; C:\Program Files\Sleep Memory Optimizer\FFSService.exe [141192 2011-09-17] (Acer Incorporated)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [240736 2013-10-07] (WildTangent)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-15] ()
S3 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [192856 2012-03-14] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [225216 2011-01-28] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [502064 2012-08-23] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2012-02-22] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [210584 2012-02-22] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [162192 2012-02-22] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-28] (McAfee, Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
R2 Update Whilokii; C:\Program Files (x86)\Whilokii\updateWhilokii.exe [65304 2013-10-05] (Whilokii)
R2 USecuAppSvc; C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe [235664 2012-06-07] ()
R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [1706064 2013-10-19] (Wsys Co., Ltd.)
==================== Drivers (Whitelisted) ====================
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2012-02-22] (McAfee, Inc.)
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-02-17] (Diskeeper Corporation)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [92976 2012-02-17] (Diskeeper Corporation)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-14] (Intel Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160792 2012-02-22] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2012-02-22] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [487296 2012-02-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647208 2012-02-22] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75936 2012-02-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2012-02-22] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [289664 2012-02-22] (McAfee, Inc.)
U3 mfeavfk01; No ImagePath
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-20 02:31 - 2013-10-20 02:31 - 00000000 ____D C:\FRST
2013-10-20 02:28 - 2013-10-20 02:29 - 01954548 _____ (Farbar) C:\Users\z\Desktop\FRST64.exe
2013-10-20 02:25 - 2013-10-20 02:25 - 00000480 _____ C:\Users\z\Desktop\defogger_disable.log
2013-10-20 02:25 - 2013-10-20 02:25 - 00000000 _____ C:\Users\z\defogger_reenable
2013-10-20 02:24 - 2013-10-20 02:24 - 00050477 _____ C:\Users\z\Desktop\Defogger.exe
2013-10-19 23:19 - 2013-10-19 23:24 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-10-19 23:19 - 2013-10-19 23:19 - 00000000 ____D C:\Users\z\AppData\Local\BonanzaDealsLive
2013-10-19 23:19 - 2013-10-19 23:19 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-10-19 23:18 - 2013-10-19 23:22 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-10-19 23:18 - 2013-10-19 23:18 - 00000000 ____D C:\Users\z\AppData\Local\Google
2013-10-19 23:18 - 2013-10-19 23:17 - 22404568 _____ (Mozilla) C:\Users\z\Downloads\Firefox_Setup [1].exe
2013-10-19 22:28 - 2013-10-20 02:20 - 00000306 _____ C:\Windows\Tasks\UpdaterEX.job
2013-10-19 22:28 - 2013-10-19 23:31 - 00000000 ____D C:\ProgramData\eSafe
2013-10-19 22:28 - 2013-10-19 23:19 - 00003254 _____ C:\Windows\System32\Tasks\UpdaterEX
2013-10-19 22:28 - 2013-10-19 22:28 - 00000000 ____D C:\Users\z\AppData\Roaming\UpdaterEX
2013-10-19 22:28 - 2013-10-19 22:28 - 00000000 ____D C:\ProgramData\Babylon
2013-10-19 22:28 - 2013-10-19 22:28 - 00000000 ____D C:\Program Files (x86)\Whilokii
2013-10-19 22:22 - 2013-10-19 22:22 - 00000000 ____D C:\Users\z\AppData\Local\EgisTec IPS
2013-10-19 22:21 - 2013-10-19 22:22 - 00000000 ____D C:\Users\z\Documents\Arbeit
2013-10-19 22:21 - 2013-10-19 22:21 - 00000000 ____D C:\Users\z\AppData\Roaming\WildTangent
2013-10-19 22:21 - 2013-10-19 22:21 - 00000000 ____D C:\Users\z\AppData\Local\CrashDumps
2013-10-19 22:20 - 2013-10-19 22:20 - 00000000 ____D C:\Users\z\AppData\Roaming\Adobe
2013-10-19 22:15 - 2013-10-19 22:28 - 00001747 _____ C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-10-19 22:15 - 2013-10-19 22:28 - 00001725 _____ C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-10-19 22:15 - 2013-10-19 22:15 - 00000000 ___RD C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-19 22:15 - 2013-10-19 22:15 - 00000000 ___RD C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-10-19 22:15 - 2013-10-19 22:15 - 00000000 ____D C:\Users\z\AppData\Roaming\Atheros
2013-10-19 22:13 - 2013-10-19 22:13 - 00059968 _____ C:\Users\z\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-19 22:13 - 2013-10-19 22:13 - 00002609 _____ C:\Users\Public\Desktop\eBay.lnk
2013-10-19 22:13 - 2013-10-19 22:13 - 00000991 _____ C:\Users\Public\Desktop\Kobo.lnk
2013-10-19 22:13 - 2013-10-19 22:13 - 00000000 ____D C:\Users\z\AppData\Local\VirtualStore
2013-10-19 22:13 - 2013-10-19 22:13 - 00000000 ____D C:\Program Files (x86)\OEM
2013-10-19 22:13 - 2013-10-19 22:13 - 00000000 ____D C:\Program Files (x86)\Kobo
2013-10-19 22:13 - 2012-06-03 00:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-10-19 22:13 - 2012-06-03 00:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-10-19 22:13 - 2012-06-03 00:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-10-19 22:13 - 2012-06-03 00:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-10-19 22:13 - 2012-06-03 00:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-10-19 22:13 - 2012-06-03 00:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-10-19 22:13 - 2012-06-03 00:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-10-19 22:12 - 2013-10-20 02:25 - 00000000 ____D C:\Users\z
2013-10-19 22:12 - 2013-10-19 22:12 - 00002078 _____ C:\Users\Public\Desktop\Eurosport Player.lnk
2013-10-19 22:12 - 2013-10-19 22:12 - 00001732 _____ C:\Users\Public\Desktop\Online kaufen.lnk
2013-10-19 22:12 - 2013-10-19 22:12 - 00000020 ___SH C:\Users\z\ntuser.ini
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Vorlagen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Startmenü
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Netzwerkumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Lokale Einstellungen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Eigene Dateien
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Druckumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\AppData\Local\Verlauf
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\AppData\Local\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 __SHD C:\Recovery
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 ____D C:\Program Files\Accessory Store
2013-10-19 22:12 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-10-19 22:12 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-10-19 22:12 - 2012-04-26 07:13 - 00000000 ____D C:\Users\z\AppData\Roaming\Macromedia
2013-10-19 22:12 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-10-19 22:12 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
==================== One Month Modified Files and Folders =======
2013-10-20 04:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-10-20 02:31 - 2013-10-20 02:31 - 00000000 ____D C:\FRST
2013-10-20 02:29 - 2013-10-20 02:28 - 01954548 _____ (Farbar) C:\Users\z\Desktop\FRST64.exe
2013-10-20 02:25 - 2013-10-20 02:25 - 00000480 _____ C:\Users\z\Desktop\defogger_disable.log
2013-10-20 02:25 - 2013-10-20 02:25 - 00000000 _____ C:\Users\z\defogger_reenable
2013-10-20 02:25 - 2013-10-19 22:12 - 00000000 ____D C:\Users\z
2013-10-20 02:24 - 2013-10-20 02:24 - 00050477 _____ C:\Users\z\Desktop\Defogger.exe
2013-10-20 02:20 - 2013-10-19 22:28 - 00000306 _____ C:\Windows\Tasks\UpdaterEX.job
2013-10-20 01:49 - 2012-04-26 07:12 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-20 01:49 - 2012-04-26 07:12 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-19 23:36 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-19 23:36 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-19 23:35 - 2013-08-30 06:47 - 00643866 _____ C:\Windows\system32\perfh007.dat
2013-10-19 23:35 - 2013-08-30 06:47 - 00126394 _____ C:\Windows\system32\perfc007.dat
2013-10-19 23:35 - 2009-07-14 07:13 - 01472002 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-19 23:32 - 2012-04-26 06:55 - 00001832 _____ C:\Users\Public\Desktop\McAfee Internet Security Suite.lnk
2013-10-19 23:31 - 2013-10-19 22:28 - 00000000 ____D C:\ProgramData\eSafe
2013-10-19 23:28 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-19 23:28 - 2009-07-14 06:51 - 00040513 _____ C:\Windows\setupact.log
2013-10-19 23:24 - 2013-10-19 23:19 - 00000000 ____D C:\Program Files (x86)\BonanzaDealsLive
2013-10-19 23:22 - 2013-10-19 23:18 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-10-19 23:19 - 2013-10-19 23:19 - 00000000 ____D C:\Users\z\AppData\Local\BonanzaDealsLive
2013-10-19 23:19 - 2013-10-19 23:19 - 00000000 ____D C:\ProgramData\BonanzaDealsLive
2013-10-19 23:19 - 2013-10-19 22:28 - 00003254 _____ C:\Windows\System32\Tasks\UpdaterEX
2013-10-19 23:18 - 2013-10-19 23:18 - 00000000 ____D C:\Users\z\AppData\Local\Google
2013-10-19 23:17 - 2013-10-19 23:18 - 22404568 _____ (Mozilla) C:\Users\z\Downloads\Firefox_Setup [1].exe
2013-10-19 22:43 - 2012-04-26 06:54 - 00000000 ____D C:\ProgramData\McAfee
2013-10-19 22:36 - 2013-08-29 20:53 - 00237793 _____ C:\Windows\WindowsUpdate.log
2013-10-19 22:36 - 2010-11-21 05:47 - 00008612 _____ C:\Windows\PFRO.log
2013-10-19 22:28 - 2013-10-19 22:28 - 00000000 ____D C:\Users\z\AppData\Roaming\UpdaterEX
2013-10-19 22:28 - 2013-10-19 22:28 - 00000000 ____D C:\ProgramData\Babylon
2013-10-19 22:28 - 2013-10-19 22:28 - 00000000 ____D C:\Program Files (x86)\Whilokii
2013-10-19 22:28 - 2013-10-19 22:15 - 00001747 _____ C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-10-19 22:28 - 2013-10-19 22:15 - 00001725 _____ C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-10-19 22:22 - 2013-10-19 22:22 - 00000000 ____D C:\Users\z\AppData\Local\EgisTec IPS
2013-10-19 22:22 - 2013-10-19 22:21 - 00000000 ____D C:\Users\z\Documents\Arbeit
2013-10-19 22:21 - 2013-10-19 22:21 - 00000000 ____D C:\Users\z\AppData\Roaming\WildTangent
2013-10-19 22:21 - 2013-10-19 22:21 - 00000000 ____D C:\Users\z\AppData\Local\CrashDumps
2013-10-19 22:21 - 2012-04-26 06:53 - 00002662 ____N C:\Users\Public\Desktop\WildTangent Games App - acer.lnk
2013-10-19 22:21 - 2012-04-26 06:53 - 00000000 ____D C:\ProgramData\WildTangent
2013-10-19 22:21 - 2012-04-26 06:53 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2013-10-19 22:20 - 2013-10-19 22:20 - 00000000 ____D C:\Users\z\AppData\Roaming\Adobe
2013-10-19 22:16 - 2012-04-26 06:57 - 00014133 _____ C:\Windows\patch.log
2013-10-19 22:15 - 2013-10-19 22:15 - 00000000 ___RD C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-19 22:15 - 2013-10-19 22:15 - 00000000 ___RD C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-10-19 22:15 - 2013-10-19 22:15 - 00000000 ____D C:\Users\z\AppData\Roaming\Atheros
2013-10-19 22:15 - 2012-04-26 07:42 - 00000000 ___HD C:\OEM
2013-10-19 22:15 - 2012-04-26 06:56 - 00000000 ____D C:\ProgramData\OEM
2013-10-19 22:13 - 2013-10-19 22:13 - 00059968 _____ C:\Users\z\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-19 22:13 - 2013-10-19 22:13 - 00002609 _____ C:\Users\Public\Desktop\eBay.lnk
2013-10-19 22:13 - 2013-10-19 22:13 - 00000991 _____ C:\Users\Public\Desktop\Kobo.lnk
2013-10-19 22:13 - 2013-10-19 22:13 - 00000000 ____D C:\Users\z\AppData\Local\VirtualStore
2013-10-19 22:13 - 2013-10-19 22:13 - 00000000 ____D C:\Program Files (x86)\OEM
2013-10-19 22:13 - 2013-10-19 22:13 - 00000000 ____D C:\Program Files (x86)\Kobo
2013-10-19 22:12 - 2013-10-19 22:12 - 00002078 _____ C:\Users\Public\Desktop\Eurosport Player.lnk
2013-10-19 22:12 - 2013-10-19 22:12 - 00001732 _____ C:\Users\Public\Desktop\Online kaufen.lnk
2013-10-19 22:12 - 2013-10-19 22:12 - 00000020 ___SH C:\Users\z\ntuser.ini
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Vorlagen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Startmenü
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Netzwerkumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Lokale Einstellungen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Eigene Dateien
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Druckumgebung
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Documents\Eigene Musik
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Documents\Eigene Bilder
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\AppData\Local\Verlauf
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\AppData\Local\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Users\z\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Programme
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 __SHD C:\Recovery
2013-10-19 22:12 - 2013-10-19 22:12 - 00000000 ____D C:\Program Files\Accessory Store
2013-10-19 22:12 - 2012-04-26 07:18 - 00000000 ____D C:\Program Files\Preload
2013-10-19 22:12 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\restore
2013-10-19 22:12 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-10-19 22:12 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-10-19 22:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Recovery
2013-10-19 22:12 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Windows NT
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2012-04-26 06:45
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-10-2013
Ran by z at 2013-10-20 02:32:02
Running from C:\Users\z\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {86355677-4064-3EA7-ABB3-1B136EB04637}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall (Enabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
==================== Installed Programs ======================
clear.fi SDK - MVP 2 (x32 Version: 2.0.1505)
clear.fi SDK- Movie 2 (x32 Version: 2.0.1502)
Acer Backup Manager (x32 Version: 3.0.0.100)
Acer Crystal Eye Webcam (x32 Version: 1.5.2728.00)
Acer ePower Management (x32 Version: 6.00.3010)
Acer eRecovery Management (x32 Version: 5.00.3508)
Acer Games (x32 Version: 1.0.2.5)
Acer Instant Update Service (Version: 1.00.3004)
Acer Registration (x32 Version: 1.04.3506)
Acer Theft Shield (Version: 1.00.3005)
Acer Updater (x32 Version: 1.02.3501)
Acer USB Charge Manager (x32 Version: 1.00.3002)
Acer VCM (x32 Version: 4.05.3501)
Adobe AIR (x32 Version: 2.6.0.19120)
Adobe Flash Player 11 ActiveX 64-bit (Version: 11.2.202.222)
Adobe Reader X (10.1.0) MUI (x32 Version: 10.1.0)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98)
Atheros Bluetooth Suite (64) (Version: 7.4.0.125)
Backup Manager V3 (x32 Version: 3.0.0.100)
Bejeweled 3 (x32 Version: 2.2.0.98)
Bing Bar (x32 Version: 7.0.765.0)
Broadcom NetLink Controller (Version: 15.0.6.1)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
clear.fi Media (x32 Version: 2.00.3004)
clear.fi Photo (x32 Version: 2.00.3004)
CyberLink MediaEspresso (x32 Version: 6.5.1720_38230)
D3DX10 (x32 Version: 15.4.2368.0902)
Dolby Home Theater v4 (x32 Version: 7.2.7000.7)
eBay Worldwide (x32 Version: 2.2.0409)
ETDWare PS/2-X64 10.6.10.8_WHQL (Version: 10.6.10.8)
Evernote v. 4.5.2 (x32 Version: 4.5.2.5866)
ExpressCache (Version: 1.0.82)
Extended Update (HKCU)
FATE (x32 Version: 2.2.0.97)
Final Drive: Nitro (x32 Version: 2.2.0.95)
Fooz Kids (x32 Version: 3.1.2)
Fooz Kids Platform (x32 Version: 2.1)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Google Update Helper (x32 Version: 1.3.23.0)
Identity Card (x32 Version: 1.00.3501)
Insaniquarium Deluxe (x32 Version: 2.2.0.97)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 8.0.4.1441)
Intel(R) OpenCL CPU Runtime (x32)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2712)
Intel(R) Rapid Start Technology (x32 Version: 1.0.0.1022)
Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220)
Intel® Trusted Connect Service Client (Version: 1.23.605.1)
Jewel Match 3 (x32 Version: 2.2.0.98)
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98)
John Deere Drive Green (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kobo (x32 Version: 2.1.5)
Launch Manager (x32 Version: 5.1.15)
McAfee Internet Security Suite (x32 Version: 11.0.678)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Silverlight (x32 Version: 4.0.50401.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MyWinLocker (Version: 4.0.14.27)
MyWinLocker 4 (x32 Version: 4.0.14.27)
MyWinLocker Suite (x32 Version: 4.0.14.19)
newsXpresso (x32 Version: 1.0.0.40)
Norton Online Backup (x32 Version: 2.1.17869)
NTI Media Maker 9 (x32 Version: 9.0.2.9006)
Penguins! (x32 Version: 2.2.0.98)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Polar Bowler (x32 Version: 2.2.0.97)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6612)
Realtek PCIE Card Reader (x32 Version: 6.1.7601.28104)
Shredder (Version: 2.0.8.9)
Shredder (x32 Version: 2.0.8.9)
Skype™ 5.5 (x32 Version: 5.5.117)
Sleep Memory Optimizer (x32 Version: 1.00.3004)
Slingo Deluxe (x32 Version: 2.2.0.95)
Smart Timer (x32 Version: 1.00.3004)
Torchlight (x32 Version: 2.2.0.98)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0)
Update Installer for WildTangent Games App (x32)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97)
Wedding Dash (x32 Version: 2.2.0.95)
Welcome Center (x32 Version: 1.02.3507)
WildTangent Games App (x32 Version: 4.0.10.25)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 影像中心 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
Wsys Control 10.2.1.2652 (x32 Version: 10.2.1.2652)
Zuma Deluxe (x32 Version: 2.2.0.95)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922)
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922)
بريد Windows Live (x32 Version: 15.4.3502.0922)
معرض صور Windows Live (x32 Version: 15.4.3502.0922)
==================== Restore Points =========================
19-10-2013 20:12:44 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {440F77D3-C778-45B1-ABFD-BCBF95E8CC23} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-07] (Acer Incorporated)
Task: {4F26350B-95AA-40A1-A0C0-4CD6E0C93969} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2011-05-20] (CyberLink)
Task: {77FE68BD-99DE-486F-BDC1-805E5426DF2F} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2012-03-15] (Acer)
Task: {A1D60D55-A6B8-401B-BC05-2938E02DF2F2} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => d:\program files\windows defender\MpCmdRun.exe
Task: {AB449415-8385-489C-AA5B-9433EC7F4B41} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {B8D646B5-626E-4CDD-A232-5A3F0EEDDBA8} - System32\Tasks\UpdaterEX => C:\Users\z\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: {B92DEADC-87CA-4110-B7A8-46643774F883} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {DBE696BB-2E70-4FF6-96B3-1F18BC6F40C6} - System32\Tasks\Smart Timer Task Scheduler => C:\Windows\System32\Smart_Timer.exe
Task: {F3E54CCE-7485-4386-BFFE-E99171C1C3F9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\ALEXAN~1\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE
==================== Loaded Modules (whitelisted) =============
2009-01-22 01:45 - 2009-01-22 01:45 - 01401856 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\LIBEAY32.dll
2012-06-07 14:38 - 2012-06-07 14:38 - 00213648 _____ () C:\Program Files\Acer\Acer Theft Shield\CommPtl.dll
2012-06-07 14:38 - 2012-06-07 14:38 - 00197776 _____ () C:\Program Files\Acer\Acer Theft Shield\LogMgr2.dll
2012-06-07 14:38 - 2012-06-07 14:38 - 00114320 _____ () C:\Program Files\Acer\Acer Theft Shield\SysCtrl.dll
2012-06-07 14:38 - 2012-06-07 14:38 - 00141456 _____ () C:\Program Files\Acer\Acer Theft Shield\WHNCtrl.dll
2012-04-26 07:43 - 2012-03-26 11:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2013-08-29 21:15 - 2013-08-29 21:15 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\5414d746d7fd4675d6ca85f27b32acb4\IsdiInterop.ni.dll
2013-08-29 21:12 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-08-29 21:09 - 2012-03-06 09:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/19/2013 11:29:47 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/19/2013 10:38:09 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/19/2013 10:30:15 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16421 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: e70
Startzeit: 01cecd090a5e5084
Endzeit: 16
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Berichts-ID:
Error: (10/19/2013 10:21:20 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: GameConsole-wt.exe, Version: 4.0.6.121, Zeitstempel: 0x4e7a4bd3
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038dc9
ID des fehlerhaften Prozesses: 0x1a44
Startzeit der fehlerhaften Anwendung: 0xGameConsole-wt.exe0
Pfad der fehlerhaften Anwendung: GameConsole-wt.exe1
Pfad des fehlerhaften Moduls: GameConsole-wt.exe2
Berichtskennung: GameConsole-wt.exe3
System errors:
=============
Error: (10/19/2013 11:29:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet.
Error: (10/19/2013 10:38:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Wsys Service" wurde nicht richtig gestartet.
Microsoft Office Sessions:
=========================
Error: (10/19/2013 11:29:47 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/19/2013 10:38:09 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/19/2013 10:30:15 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16421e7001cecd090a5e508416C:\Program Files (x86)\Internet Explorer\iexplore.exe
Error: (10/19/2013 10:21:20 PM) (Source: Application Error)(User: )
Description: GameConsole-wt.exe4.0.6.1214e7a4bd3ntdll.dll6.1.7601.177254ec49b8fc000000500038dc91a4401cecd08abc6739cC:\Program Files (x86)\WildTangent Games\App\GameConsole-wt.exeC:\Windows\SysWOW64\ntdll.dll03e72968-38fc-11e3-b4b5-089e01a5a99a
==================== Memory info ===========================
Percentage of memory in use: 79%
Total physical RAM: 3933.36 MB
Available physical RAM: 822.6 MB
Total Pagefile: 7864.9 MB
Available Pagefile: 3554.13 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:449.66 GB) (Free:412.55 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 01FFE7F4)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 19 GB) (Disk ID: 1211A26A)
Partition 1: (Not Active) - (Size=4 GB) - (Type=84)
Partition 2: (Not Active) - (Size=15 GB) - (Type=73)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-20 03:00:13
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\ALEXAN~1\AppData\Local\Temp\ugdyqpow.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\70188b867ad4
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\70188b867ad4 (not active ControlSet)
---- EOF - GMER 2.1 ----
|
| Themen zu Firefox-Download mit Doko Search, Wajam, Whilokii, Bonanza Deals, qvo6 u. wsys control |
| adware.whilokii, bingbar, blockiert, bonanza, bonanza deals, einstellungen, farbar, farbar recovery scan tool, flash player, iexplore.exe, launch, ntdll.dll, problem, pup.optional.bonanzadeals.a, pup.optional.browsefox.a, pup.optional.installcore.a, pup.optional.qvo6.a, pup.optional.wajam.a, pup.optional.wsys.a, registry, services.exe, siteadvisor, svchost.exe, symantec, trojaner, usb, wajam, whilokii, wildtangent games |
Baum-Darstellung