| |
| |||||||
Log-Analyse und Auswertung: SoftwareUpdater.Ui.exe bei jedem PC-StartWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
20.10.2013, 16:12
| #1 |
| |  SoftwareUpdater.Ui.exe bei jedem PC-Start Hallo, vor wenigen Tagen hab ich versehentlich statt eines Updates von TuneUp Utilities 2008 ein neues Programm "Free System Utilities" installiert. Nachdem mir der Fehler aufgefallen war, habe ich das Programm deinstalliert. Ich glaube, genau seit diesem Zeitpunkt habe ich nach einem PC-Start immer den SoftwareUpdater.Ui.exe auf dem Schirm. Von diesem Problem ist bei Euch im TB schon oft berichtet worden. Mir scheint dieses Problem ist nur individuell zu beheben. Für Eure Hilfe wäre ich sehr dankbar. Mit freundlichen Grüßen, Ralf Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-10-2013
Ran by ralf at 2013-10-20 15:02:16
Running from C:\Users\ralf\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958)
Adobe AIR (Version: 3.6.0.6090)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Flash Player ActiveX (Version: 9.0.47.0)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8)
AMDAway INF
Apple Application Support (Version: 2.3.3)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.1.116)
Apple Software Update (Version: 2.1.3.127)
ArcSoft PhotoImpression
ATI Catalyst Control Center (Version: 2.007.0914.2138)
Avira Free Antivirus (Version: 14.0.0.383)
Avira SearchFree Toolbar plus Web Protection (Version: 12.2.2.663)
Benutzerhandbuch
Bonjour (Version: 3.0.0.10)
Boot Camp-Dienste (Version: 2.2.0)
Browser Address Error Redirector (Version: 1.00.0000)
Canon MP610 series
Catalyst Control Center Core Implementation (Version: 2007.0914.2139.36828)
Catalyst Control Center Graphics Full Existing (Version: 2007.0914.2139.36828)
Catalyst Control Center Graphics Full New (Version: 2007.0914.2139.36828)
Catalyst Control Center Graphics Light (Version: 2007.0914.2139.36828)
Catalyst Control Center Graphics Previews Common (Version: 2007.0914.2139.36828)
Catalyst Control Center Graphics Previews Vista (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Chinese Standard (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Chinese Traditional (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization French (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization German (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Hungarian (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Italian (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Japanese (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Korean (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Polish (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Portuguese (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Spanish (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Thai (Version: 2007.0914.2139.36828)
Catalyst Control Center Localization Turkish (Version: 2007.0914.2139.36828)
CCC Help Chinese Standard (Version: 2007.0914.2138.36828)
CCC Help Chinese Traditional (Version: 2007.0914.2138.36828)
CCC Help English (Version: 2007.0914.2138.36828)
CCC Help French (Version: 2007.0914.2138.36828)
CCC Help German (Version: 2007.0914.2138.36828)
CCC Help Hungarian (Version: 2007.0914.2138.36828)
CCC Help Italian (Version: 2007.0914.2138.36828)
CCC Help Japanese (Version: 2007.0914.2138.36828)
CCC Help Korean (Version: 2007.0914.2138.36828)
CCC Help Polish (Version: 2007.0914.2138.36828)
CCC Help Portuguese (Version: 2007.0914.2138.36828)
CCC Help Spanish (Version: 2007.0914.2138.36828)
CCC Help Thai (Version: 2007.0914.2138.36828)
CCC Help Turkish (Version: 2007.0914.2138.36828)
ccc-core-static (Version: 2007.0914.2139.36828)
ccc-utility (Version: 2007.0914.2139.36828)
CCleaner (Version: 4.01)
CDDRV_Installer (Version: 4.20)
Dell Handbuch zum Einstieg (Version: 1.00.0000)
devolo dLAN Cockpit (Version: 4.1.3.0)
dLAN Cockpit (Version: 3.2.28)
dLAN Cockpit (Version: 3.23.12)
Dropbox (HKCU Version: 2.0.22)
EPSON Copy Utility
EPSON Smart Panel
EPSON TWAIN 5 (Version: 5.71.0000)
Free Video Dub version 2.0.18.430 (Version: 2.0.18.430)
Free YouTube Download version 3.2.13.925 (Version: 3.2.13.925)
Free YouTube to MP3 Converter version 3.12.2.430 (Version: 3.12.2.430)
IrfanView (remove only) (Version: 4.30)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Java(TM) SE Runtime Environment 6 (Version: 1.6.0.0)
JavaFX 2.1.1 (Version: 2.1.1)
KhalInstallWrapper (Version: 4.20.131)
Logitech SetPoint (Version: 4.20)
Mediencenter Assistent (Version: 2.7.0.1451)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 08.05.0822)
Microsoft XML Parser (Version: 8.70.1104.04)
Mozilla Firefox 24.0 (x86 de) (Version: 24.0)
Mozilla Maintenance Service (Version: 24.0.1)
Mozilla Thunderbird 24.0.1 (x86 de) (Version: 24.0.1)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
My Dell (Version: 3.4.6308.28)
Naviextras Toolbox Prerequesities (Version: 1.0.0)
Nero 8 Essentials (Version: 8.10.209)
neroxml (Version: 1.0.0)
NVIDIA Drivers
NVIDIANetworkDiagnostic (Version: 1.00.0000)
Presto! PixExpress
QuickTime (Version: 7.74.80.86)
Ralink RT2870 Wireless LAN Card (Version: 1.5.12.0)
Realtek High Definition Audio Driver (Version: 6.0.1.5512)
ScanToWeb
Seagate DiscWizard (Version: 13.0.14387)
Silverfrost FTN95 (Version: 6.00)
Skins (Version: 2007.0914.2139.36828)
Sonic Activation Module (Version: 1.0)
Spybot - Search & Destroy (Version: 2.1.19)
Steuersparer 2013 (Version: 20.00.8137)
TP-LINK Driver Installation Program (Version: 7.1)
TreeSize Free V2.7 (Version: 2.7)
TuneUp Utilities 2008 (Version: 7.0.8009)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
VCRedistSetup (Version: 1.0.0)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
Windows Mobile-Gerätecenter: Treiberupdate (Version: 6.1.6965.0)
WinRAR 4.01 (32-Bit) (Version: 4.01.0)
==================== Restore Points =========================
13-10-2013 18:00:02 Windows-Sicherung
14-10-2013 09:59:57 Geplanter Prüfpunkt
15-10-2013 07:07:29 Windows Update
16-10-2013 08:53:42 Geplanter Prüfpunkt
17-10-2013 12:10:56 Geplanter Prüfpunkt
18-10-2013 09:07:51 Windows Update
19-10-2013 09:27:04 Geplanter Prüfpunkt
20-10-2013 11:51:59 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {32EA0277-720C-4B5A-8187-1E90CE68F236} - System32\Tasks\Automatische Wartung => C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-08-21] (TuneUp Software GmbH)
Task: {35314DF3-723A-4BCD-902C-46C0D0DA397D} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {4BF06606-9236-42AD-9850-9156EA330EC7} - System32\Tasks\Freemium1ClickMaint => C:\Users\ralf\Desktop\1Click.exe
Task: {4D34D17A-C947-46A1-B136-7B5F6D4DD3CB} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-09-06] (PC-Doctor, Inc.)
Task: {518752A9-1CFA-4A7D-A736-9BEC34E1E930} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {7028648D-F3BE-424E-937A-14F8048C11A7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {83389A7C-B857-404F-A9F5-FDF1A5406BDB} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {8BFC85B0-7F17-4996-BE5A-4E06F345D209} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {8C833CFE-89B9-4CA5-90A9-DD167D98BD62} - System32\Tasks\Software Updater Ui => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-10-18] ()
Task: {95681A43-3865-4A50-9063-5B80702C730D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {9F37E742-298C-4D03-AC49-CE9B4E7F4A09} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation)
Task: {A19C20BA-7D8F-4015-9F19-2423875390DB} - System32\Tasks\Software Updater => C:\Program Files\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-10-09] ()
Task: {B2F7BC30-BB59-459D-96AA-ED553C6E45F6} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - ralf => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-10] (Microsoft Corporation)
Task: {C1DCF1CD-8397-4AEA-B86F-A4BFFAE62F8F} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-06] (PC-Doctor, Inc.)
Task: {CD035338-0EEB-4A87-A23C-C17E96A34E84} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {CEBB725B-712B-42C9-BD20-B01A88461AC1} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {F4C8C399-88F8-4FB6-8189-3DF6BF809952} - System32\Tasks\1-Klick-Wartung => C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-08-21] (TuneUp Software GmbH)
Task: {FAB46FB5-EE16-42FD-AE59-1A5934534DD0} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe
Task: C:\Windows\Tasks\1-Klick-Wartung.job => C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe
Task: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
==================== Loaded Modules (whitelisted) =============
2008-01-30 23:13 - 2007-10-24 10:50 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2011-06-30 15:52 - 2011-06-30 15:52 - 00071008 _____ () C:\Program Files\Seagate\DiscWizard\Common\rpc_client.dll
2013-06-23 21:37 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-06-23 21:37 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl
2013-06-23 21:37 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\ralf\AppData\Roaming\Dropbox\bin\libcef.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\ralf\Desktop\Notizen:Roxio EMC Stream
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Acronis Backup Archive Explorer
Description: Acronis Backup Archive Explorer
Class Guid: {1860459d-4692-4825-b761-44a725991050}
Manufacturer: Acronis, Inc.
Service: timounter
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
==================== Event log errors: =========================
Application errors:
==================
Error: (10/19/2013 11:38:43 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (10/19/2013 04:19:49 PM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (10/19/2013 04:19:49 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (10/18/2013 07:07:26 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {1c8a6c6a-af2f-47d3-99b9-801bb422c6d2}
Error: (10/17/2013 01:41:22 PM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (10/17/2013 01:41:22 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (10/16/2013 01:00:09 PM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (10/16/2013 01:00:09 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (10/14/2013 01:12:17 PM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4
Error: (10/14/2013 01:12:15 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
System errors:
=============
Error: (10/20/2013 00:13:58 PM) (Source: Service Control Manager) (User: )
Description: Seagate Scheduler2 Service%%1740
Error: (10/20/2013 00:13:35 PM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2
Error: (10/20/2013 00:13:35 PM) (Source: Service Control Manager) (User: )
Description: Mediencenter Service%%1053
Error: (10/20/2013 00:13:35 PM) (Source: Service Control Manager) (User: )
Description: 30000Mediencenter Service
Error: (10/20/2013 00:13:35 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (10/20/2013 11:29:19 AM) (Source: Service Control Manager) (User: )
Description: Seagate Scheduler2 Service%%1740
Error: (10/20/2013 11:29:01 AM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2
Error: (10/20/2013 11:29:01 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (10/13/2013 03:49:05 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "MAC001FF345A88C",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{86EE4030-6760-4720-9A05-BE-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (10/13/2013 01:02:25 PM) (Source: Service Control Manager) (User: )
Description: Seagate Scheduler2 Service%%1740
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2012-06-18 16:36:17.586
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-06-18 16:36:17.224
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-06-18 16:32:05.510
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-06-18 16:32:05.149
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-06-18 16:24:48.376
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-06-18 16:24:48.017
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-06-18 16:20:32.808
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-06-18 16:20:32.445
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-15 18:46:21.218
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-05-15 18:46:20.801
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 53%
Total physical RAM: 2045.76 MB
Available physical RAM: 946.79 MB
Total Pagefile: 4330.07 MB
Available Pagefile: 2960.58 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.43 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:288.03 GB) (Free:222.17 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:4.86 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 80000000)
Partition 1: (Not Active) - (Size=63 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=288 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-10-2013
Ran by ralf (administrator) on RALF-PC on 20-10-2013 15:01:28
Running from C:\Users\ralf\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
() C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
(Apple Inc.) C:\Program Files\Boot Camp\KbdMgr.exe
(Logitech Inc.) C:\Program Files\Logitech\SetPoint\LBTWiz.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Dropbox, Inc.) C:\Users\ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Seagate) C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\system32\AppleOSSMgr.exe
(Apple Inc.) C:\Windows\system32\AppleTimeSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) C:\Program Files\devolo\dlan\devolonetsvc.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4706304 2008-04-15] (Realtek Semiconductor)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [ISUSScheduler] - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2006-10-03] (Macrovision Corporation)
HKLM\...\Run: [DiscWizardMonitor.exe] - C:\Program Files\Seagate\DiscWizard\DiscWizardMonitor.exe [2674104 2011-06-30] ()
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395624 2011-06-30] (Seagate)
HKLM\...\Run: [ISUSPM Startup] - C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [221184 2006-10-03] (Macrovision Corporation)
HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG)
HKLM\...\Run: [Skytel] - C:\Windows\Skytel.exe [1826816 2008-04-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Apple_KbdMgr] - C:\Program Files\Boot Camp\KbdMgr.exe [427296 2009-11-15] (Apple Inc.)
HKLM\...\Run: [Bluetooth Connection Assistant] - LBTWIZ.EXE -silent
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [56080 2007-06-12] (Logitech, Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM\...\Run: [Seagate Scheduler2 Service] - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe [395624 2011-06-30] (Seagate)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
MountPoints2: L - L:\Setup.exe
HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
Startup: C:\Users\ralf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\ralf\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
ProxyServer: localhost:21320
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE0539926CF95CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\ralf\AppData\Roaming\Mozilla\Firefox\Profiles\aahare9t.default-1347825037386
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20(url.indexOf('turntable.fm')%20!%3D%20-1%20%26%26%20url.indexOf('static.turntable.fm')%20%3D%3D%20-1%20%26%26%20url.indexOf('s3.amazonaws.com')%20%3D%3D%20-1%20%26%26%20url.indexOf('ping.chartbeat.net')%20%3D%3D%20-1%20%26%26%20url.indexOf('.png')%20%3D%3D%20-1)%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*'))%20%7B%20return%20'PROXY%20ab-us03.personalitycores.com%3A8000%3B%20PROXY%20ab-us13.personalitycores.com%3A8000%3B%20PROXY%20ab-us21.personalitycores.com%3A8000%3B%20PROXY%20ab-us07.personalitycores.com%3A8000%3B%20PROXY%20ab-us17.personalitycores.com%3A8000%3B%20PROXY%20ab-us08.personalitycores.com%3A8000%3B%20PROXY%20ab-us22.personalitycores.com%3A8000%3B%20PROXY%20ab-us20.personalitycores.com%3A8000%3B%20PROXY%20ab-us10.personalitycores.com%3A8000%3B%20PROXY%20ab-us01.personalitycores.com%3A8000%3B%20PROXY%20ab-us15.personalitycores.com%3A8000%3B%20PROXY%20ab-us16.personalitycores.com%3A8000%3B%20PROXY%20ab-us09.personalitycores.com%3A8000%3B%20PROXY%20ab-us14.personalitycores.com%3A8000%3B%20PROXY%20ab-us02.personalitycores.com%3A8000%3B%20PROXY%20ab-us18.personalitycores.com%3A8000%3B%20PROXY%20ab-us12.personalitycores.com%3A8000%3B%20PROXY%20ab-us11.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\ralf\AppData\Roaming\Mozilla\Firefox\Profiles\aahare9t.default-1347825037386\searchplugins\ixquick.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: jid1-QpHD8URtZWJC2A - C:\Users\ralf\AppData\Roaming\Mozilla\Firefox\Profiles\aahare9t.default-1347825037386\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi
FF Extension: toolbar_AVIRA-V7 - C:\Users\ralf\AppData\Roaming\Mozilla\Firefox\Profiles\aahare9t.default-1347825037386\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi
FF Extension: No Name - C:\Users\ralf\AppData\Roaming\Mozilla\Firefox\Profiles\aahare9t.default-1347825037386\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\ralf\AppData\Roaming\Mozilla\Firefox\Profiles\aahare9t.default-1347825037386\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
========================== Services (Whitelisted) =================
R2 AcrSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [846296 2011-06-30] (Seagate)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 AppleOSSMgr; C:\Windows\system32\AppleOSSMgr.exe [136504 2009-11-15] ()
R2 AppleTimeSrv; C:\Windows\system32\AppleTimeSrv.exe [99640 2009-11-15] (Apple Inc.)
R2 DevoloNetworkService; C:\Program Files\devolo\dlan\devolonetsvc.exe [3526136 2013-08-27] (devolo AG)
S2 MCSWASVR; C:\Program Files\Telekom\Mediencenter\DTAG.Mediencenter.BackgroundService.exe [12800 2012-08-13] (Deutsche Telekom AG)
R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S2 SgtSch2Svc; C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe [846296 2011-06-30] (Seagate)
S2 SystemStoreService; C:\Program Files\SoftwareUpdater\SystemStore.exe [296448 2013-10-18] ()
S3 TuneUp.Defrag; C:\Windows\System32\TuneUpDefragService.exe [361728 2009-05-14] (TuneUp Software GmbH)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [28048 2010-02-05] (CSR, plc)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [57800 2009-10-22] (FTDI Ltd.)
S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-07-29] (Initio Corporation)
S3 Jukebox3; C:\Windows\System32\DRIVERS\ctpdusb.sys [16880 2004-05-18] (Creative Technology Ltd.)
R2 KeyAgent; C:\Windows\system32\drivers\KeyAgent.sys [5760 2009-11-15] (Apple Inc.)
R3 KeyMagic; C:\Windows\System32\DRIVERS\KeyMagic.sys [19968 2008-04-15] (Apple Inc.)
R2 MacHALDriver; C:\Windows\system32\drivers\MacHALDriver.sys [6528 2008-04-15] (Apple Inc.)
S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [1128512 2011-04-25] (Ralink Technology Corp.)
R2 NPF_devolo; C:\Windows\system32\drivers\npf_devolo.sys [35840 2013-08-27] (CACE Technologies)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [32768 2008-03-18] (Acronis)
S3 TNET1130; C:\Windows\System32\DRIVERS\tnet1130.sys [386688 2004-06-18] (Texas Instruments)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [125472 2013-06-26] (Acronis)
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [83392 2013-07-05] (Acronis)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-20 14:59 - 2013-10-20 14:59 - 00000000 ____D C:\FRST
2013-10-20 14:58 - 2013-10-20 14:58 - 01087515 _____ (Farbar) C:\Users\ralf\Desktop\FRST.exe
2013-10-20 13:29 - 2013-10-20 13:29 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 13:29 - 2013-10-20 13:29 - 00000000 _____ C:\Windows\setupact.log
2013-10-18 19:05 - 2013-10-18 19:05 - 00000000 ____D C:\Users\ralf\AppData\Local\Freemium
2013-10-18 18:43 - 2013-10-18 18:44 - 00000000 ____D C:\Program Files\SoftwareUpdater
2013-10-11 13:31 - 2013-10-11 13:31 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-10-10 14:35 - 2013-09-22 12:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 14:35 - 2013-09-22 12:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 14:35 - 2013-09-22 12:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 14:35 - 2013-09-22 12:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-10 14:35 - 2013-09-22 12:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 14:35 - 2013-09-22 12:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 14:35 - 2013-09-22 12:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-10 14:35 - 2013-09-22 12:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 14:35 - 2013-09-22 12:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-10 14:35 - 2013-09-22 12:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 14:35 - 2013-09-22 12:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-10 14:35 - 2013-09-22 12:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 14:35 - 2013-09-22 12:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 14:35 - 2013-09-22 12:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 14:35 - 2013-09-22 12:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-10 14:35 - 2013-09-22 11:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 14:16 - 2013-08-29 09:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 14:16 - 2013-08-27 04:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-10 14:16 - 2013-08-27 04:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-10 14:16 - 2013-08-27 04:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-10 14:16 - 2013-08-27 04:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-10 14:16 - 2013-08-27 03:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-10 14:16 - 2013-08-27 03:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-10 14:16 - 2013-08-27 03:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-10 14:16 - 2013-08-27 03:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-10 14:16 - 2013-08-27 03:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-10 14:16 - 2013-08-01 05:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 14:16 - 2013-08-01 04:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-10 14:16 - 2013-07-20 12:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 14:15 - 2013-07-04 06:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 14:15 - 2013-07-03 04:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 14:15 - 2013-07-03 04:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 14:15 - 2013-06-29 04:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 14:15 - 2013-06-29 04:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 14:15 - 2013-06-29 04:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 14:15 - 2013-06-29 04:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 14:15 - 2013-06-27 01:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 14:15 - 2013-06-04 06:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 14:15 - 2013-06-04 03:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 14:15 - 2011-05-05 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 14:15 - 2011-05-05 15:54 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-09 22:59 - 2013-10-10 15:16 - 00001218 _____ C:\Users\ralf\Desktop\Lampe_LED.lnk
2013-10-06 20:36 - 2013-10-06 20:36 - 00000000 ____D C:\Users\ralf\Dokumente
2013-10-01 20:07 - 2013-10-01 20:07 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-23 21:10 - 2013-09-25 17:15 - 97787360 _____ C:\Windows\system32\笇몷ᴼŠ
==================== One Month Modified Files and Folders =======
2013-10-20 15:00 - 2012-09-30 18:02 - 00000498 _____ C:\Windows\Tasks\1-Klick-Wartung.job
2013-10-20 15:00 - 2012-04-03 10:32 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-20 14:59 - 2013-10-20 14:59 - 00000000 ____D C:\FRST
2013-10-20 14:58 - 2013-10-20 14:58 - 01087515 _____ (Farbar) C:\Users\ralf\Desktop\FRST.exe
2013-10-20 14:29 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-20 14:29 - 2006-11-02 14:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-20 13:29 - 2013-10-20 13:29 - 00000000 _____ C:\Windows\setuperr.log
2013-10-20 13:29 - 2013-10-20 13:29 - 00000000 _____ C:\Windows\setupact.log
2013-10-20 12:16 - 2008-01-30 15:19 - 01055593 ____N C:\Windows\WindowsUpdate.log
2013-10-20 12:14 - 2013-06-23 21:37 - 00000644 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job
2013-10-20 12:14 - 2013-04-28 21:42 - 00000000 ___RD C:\Users\ralf\Dropbox
2013-10-20 12:14 - 2013-04-28 21:34 - 00000000 ____D C:\Users\ralf\AppData\Roaming\Dropbox
2013-10-20 12:12 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-20 12:11 - 2008-01-30 15:31 - 00003336 _____ C:\Windows\bthservsdp.dat
2013-10-20 12:11 - 2006-11-02 15:01 - 00032514 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-20 11:28 - 2013-09-11 16:21 - 00000000 ____D C:\Users\ralf\Desktop\abc
2013-10-19 18:05 - 2013-07-31 08:31 - 00000000 ___RD C:\Users\ralf\Desktop\Neubau Fotos
2013-10-19 18:02 - 2006-11-02 12:33 - 01445352 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-18 19:05 - 2013-10-18 19:05 - 00000000 ____D C:\Users\ralf\AppData\Local\Freemium
2013-10-18 18:44 - 2013-10-18 18:43 - 00000000 ____D C:\Program Files\SoftwareUpdater
2013-10-18 18:28 - 2013-05-11 21:55 - 00000000 ____D C:\Users\ralf\AppData\Roaming\DVDVideoSoft
2013-10-18 18:28 - 2013-05-11 21:55 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-10-18 18:28 - 2013-04-29 16:25 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-10-17 20:31 - 2008-02-23 22:59 - 00000000 ___RD C:\Users\ralf\Lampe
2013-10-17 11:29 - 2008-02-25 22:42 - 00000000 ____D C:\Users\ralf\Word
2013-10-16 09:32 - 2013-06-23 21:37 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
2013-10-14 15:28 - 2013-03-18 22:32 - 00000000 ___RD C:\Users\ralf\Desktop\Spanisch
2013-10-13 18:42 - 2008-02-23 22:59 - 00000000 ____D C:\Users\ralf\Excel
2013-10-13 13:00 - 2012-09-16 20:54 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-11 13:31 - 2013-10-11 13:31 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-10-10 15:16 - 2013-10-09 22:59 - 00001218 _____ C:\Users\ralf\Desktop\Lampe_LED.lnk
2013-10-10 15:08 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 14:53 - 2006-11-02 14:47 - 00412216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 14:45 - 2012-03-25 21:36 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 14:41 - 2013-08-15 23:48 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 14:38 - 2006-11-02 12:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-10 09:59 - 2012-04-03 10:32 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-10 09:59 - 2011-06-12 16:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-08 17:49 - 2011-10-18 22:05 - 00000000 ___RD C:\Users\ralf\Desktop\Unerledigt
2013-10-06 20:36 - 2013-10-06 20:36 - 00000000 ____D C:\Users\ralf\Dokumente
2013-10-06 20:36 - 2008-02-05 20:57 - 00000000 ____D C:\Users\ralf
2013-10-04 18:06 - 2008-07-17 18:33 - 00000000 ____D C:\Users\ralf\Zuletzt
2013-10-01 20:07 - 2013-10-01 20:07 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-01 12:19 - 2013-07-04 11:13 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 12:19 - 2013-07-04 11:13 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 12:19 - 2013-07-04 11:13 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 11:10 - 2013-06-23 21:37 - 00000446 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job
2013-09-29 12:40 - 2010-03-31 13:31 - 00000000 ____D C:\Windows\Minidump
2013-09-26 16:53 - 2008-04-14 22:32 - 00012231 _____ C:\Windows\wininit.ini
2013-09-25 17:15 - 2013-09-23 21:10 - 97787360 _____ C:\Windows\system32\笇몷ᴼŠ
2013-09-22 12:29 - 2013-10-10 14:35 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-22 12:22 - 2013-10-10 14:35 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-22 12:22 - 2013-10-10 14:35 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-22 12:14 - 2013-10-10 14:35 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-22 12:13 - 2013-10-10 14:35 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-22 12:13 - 2013-10-10 14:35 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-22 12:12 - 2013-10-10 14:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-22 12:09 - 2013-10-10 14:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-22 12:08 - 2013-10-10 14:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-22 12:07 - 2013-10-10 14:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-22 12:06 - 2013-10-10 14:35 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-22 12:05 - 2013-10-10 14:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-22 12:03 - 2013-10-10 14:35 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-22 12:03 - 2013-10-10 14:35 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-22 12:03 - 2013-10-10 14:35 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-22 11:59 - 2013-10-10 14:35 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
Some content of TEMP:
====================
C:\Users\ralf\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-20 12:19
==================== End Of Log ============================
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:25 on 20/10/2013 (ralf)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-20 16:40:33
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\00000059 WDC_WD32 rev.12.0 298.09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\ralf\AppData\Local\Temp\pxldrpob.sys
---- System - GMER 2.1 ----
SSDT 894DC136 ZwCreateSection
SSDT 894DC140 ZwRequestWaitReplyPort
SSDT 894DC13B ZwSetContextThread
SSDT 894DC145 ZwSetSecurityObject
SSDT 894DC14A ZwSystemDebugControl
SSDT 894DC0D7 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 826CB860 4 Bytes [36, C1, 4D, 89]
.text ntkrnlpa.exe!KeSetEvent + 539 826CBB84 4 Bytes [40, C1, 4D, 89]
.text ntkrnlpa.exe!KeSetEvent + 56D 826CBBB8 4 Bytes [3B, C1, 4D, 89]
.text ntkrnlpa.exe!KeSetEvent + 5D1 826CBC1C 4 Bytes [45, C1, 4D, 89]
.text ntkrnlpa.exe!KeSetEvent + 619 826CBC64 4 Bytes [4A, C1, 4D, 89]
.text ...
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Mozilla Thunderbird\thunderbird.exe[2836] ntdll.dll!LdrLoadDll 77399378 5 Bytes JMP 5CF25643 C:\Program Files\Mozilla Thunderbird\xul.dll
.text C:\Program Files\Mozilla Thunderbird\thunderbird.exe[2836] kernel32.dll!HeapSetInformation + 26 764BA8B0 7 Bytes JMP 5CF365CD C:\Program Files\Mozilla Thunderbird\xul.dll
.text C:\Program Files\Mozilla Thunderbird\thunderbird.exe[2836] kernel32.dll!LockResource + C 764D6ACB 7 Bytes JMP 5DBB52A1 C:\Program Files\Mozilla Thunderbird\xul.dll
.text C:\Program Files\Mozilla Thunderbird\thunderbird.exe[2836] kernel32.dll!VirtualAllocEx + 54 764DAF50 7 Bytes JMP 5DBB5259 C:\Program Files\Mozilla Thunderbird\xul.dll
.text C:\Program Files\Mozilla Thunderbird\thunderbird.exe[2836] GDI32.dll!SetStretchBltMode + 256 7758745C 7 Bytes JMP 5DBB52C8 C:\Program Files\Mozilla Thunderbird\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3572] ntdll.dll!LdrLoadDll 77399378 5 Bytes JMP 5BC0DFF0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3572] kernel32.dll!HeapSetInformation + 26 764BA8B0 7 Bytes JMP 5BC15F1A C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3572] kernel32.dll!LockResource + C 764D6ACB 7 Bytes JMP 5C399773 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3572] kernel32.dll!VirtualAllocEx + 54 764DAF50 7 Bytes JMP 5C399796 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[3572] GDI32.dll!SetStretchBltMode + 256 7758745C 7 Bytes JMP 5C3996F4 C:\Program Files\Mozilla Firefox\xul.dll
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 snapman.sys
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 snapman.sys
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 snapman.sys
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 snapman.sys
Device \Driver\BTHUSB \Device\00000067 bthport.sys
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 snapman.sys
AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 snapman.sys
Device \Driver\BTHUSB \Device\00000069 bthport.sys
AttachedDevice \Driver\volmgr \Device\HarddiskVolume7 snapman.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc003957
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001bdc003957@001f5bfcd0a4 0x23 0x63 0xB2 0xA8 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001bdc003957 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001bdc003957@001f5bfcd0a4 0x23 0x63 0xB2 0xA8 ...
---- EOF - GMER 2.1 ----
|
| Themen zu SoftwareUpdater.Ui.exe bei jedem PC-Start |
| antivirus, avira, computer, converter, email, error, excel, farbar, farbar recovery scan tool, fehler, firefox, flash player, freemium, help, helper, home, installation, mp3, ntdll.dll, plug-in, problem, programm, refresh, registry, required, s3.amazonaws.com, scan, security, svchost.exe, system, updates, vista, windows |
Baum-Darstellung