| |
| |||||||
Log-Analyse und Auswertung: Windows 7: PricePeep, hdvidcodec und einiges anderesWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
17.11.2013, 13:38
| #1 |
| |  Windows 7: PricePeep, hdvidcodec und einiges anderes Hallo Trojaner-Board, heute wurde mir von einem eurer Mitglieder empfohlen, einen Scan mit Malwarebytes zu machen und es wurde tatsächlich einiges gefunden. ich habe von diesen Infektionen bis jetzt nichts bemerkt. Hier sind meine Scanergebnisse: Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:49 on 17/11/2013 (USERNAME)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013
Ran by USERNAME (administrator) on COMPUTERNAME on 17-11-2013 12:50:55
Running from C:\Users\USERNAME\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Adobe Systems Incorporated) c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
() c:\Users\USERNAME\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\USERNAME\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Yontoo LLC) C:\Users\USERNAME\AppData\Roaming\Yontoo\YontooDesktop.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dropbox, Inc.) C:\Users\USERNAME\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Adobe Sytems Incorporated) C:\Users\USERNAME\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2010-04-28] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2531624 2010-12-17] (Synaptics Incorporated)
HKLM\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9753024 2011-11-21] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [5908928 2011-11-21] (Lenovo(beijing) Limited)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2779024 2011-03-14] (CANON INC.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [Spotify Web Helper] - C:\Users\USERNAME\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1168896 2013-11-14] (Spotify Ltd)
HKCU\...\Run: [Yontoo Desktop] - C:\Users\USERNAME\AppData\Roaming\Yontoo\YontooDesktop.exe [42784 2013-03-23] (Yontoo LLC)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify] - C:\Users\USERNAME\AppData\Roaming\Spotify\spotify.exe [5955072 2013-11-14] (Spotify Ltd)
MountPoints2: {d7669fde-145b-11e1-9e7e-806e6f6e6963} - E:\zdata\cobi.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Version Cue CS2] - C:\Users\USERNAME\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [856064 2005-04-06] (Adobe Sytems Incorporated)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
Startup: C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\USERNAME\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x81D07ADEC31DCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
URLSearchHook: HKCU - (No Name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - No File
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\IPS\ipsbho.dll (Symantec Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: wxDownload Class - {FE4000B3-8085-C2A1-9554-8AFFC99AFF6C} - C:\ProgramData\wxDownload\5076bb4e05041.ocx ()
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {C95A4E8E-816D-4655-8C79-D736DA1ADB6D} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Hosts: 127.0.0.1 3dns.adobe.com 127.0.0.1 3dns-1.adobe.com 127.0.0.1 3dns-2.adobe.com 127.0.0.1 3dns-3.adobe.com 127.0.0.1 3dns-4.adobe.com 127.0.0.1 activate.adobe.com 127.0.0.1 activate-sea.adobe.com 127.0.0.1 activate-sea.adobe.com 127.0.0.1 activate-sjc0.adobe.com 127.0.0.1 activate.wip.adobe.com 127.0.0.1 activate.wip1.adobe.com 127.0.0.1 activate.wip2.adobe.com 127.0.0.1 activate.wip3.adobe.com 127.0.0.1 activate.wip4.adobe.com 127.0.0.1 adobe-dns.adobe.com 127.0.0.1 adobe-dns-1.adobe.com 127.0.0.1 adobe-dns-2.adobe.com 127.0.0.1 adobe-dns-3.adobe.com 127.0.0.1 adobe-dns-4.adobe.com 127.0.0.1 crl.verisign.net 127.0.0.1 CRL.VERISIGN.NET 127.0.0.1 ood.opsource.net 127.0.0.1 209-34-83-73.ood.opsource.net 127.0.0.1 practivate.adobe 127.0.0.1 practivate.adobe 127.0.0.1 practivate.adobe.com 127.0.0.1 practivate.adobe.newoa 127.0.0.1 practivate.adobe.ntp 127.0.0.1 practivate.adobe.ipp 127.0.0.1 ereg.adobe.com 127.0.0.1 ereg.wip.adobe.com 127.0.0.1 ereg.wip1.adobe.com 127.0.0.1 ereg.wip2.adobe.com 127.0.0.1 ereg.wip3.adobe.com 127.0.0.1 ereg.wip4.adobe.com 127.0.0.1 wip.adobe.com 127.0.0.1 wip1.adobe.com 127.0.0.1 wip2.adobe.com 127.0.0.1 wip3.adobe.com 127.0.0.1 wip4.adobe.com 127.0.0.1 hxxp://www.wip.adobe.com 127.0.0.1 hxxp://www.wip1.adobe.com 127.0.0.1 hxxp://www.wip2.adobe.com 127.0.0.1 Adobe 127.0.0.1 Adobe 127.0.0.1 wwis-dubc1-vip60.adobe.com 127.0.0.1 installer.nemetschek.net 127.0.0.1 piracy.nemetschek.net 127.0.0.1 secure.nemetschek.net 127.0.0.1 obdev.at 127.0.0.1 192.150.18.108 127.0.0.1 192.150.22.40 127.0.0.1 192.150.14.69 127.0.0.1 192.150.8.118 127.0.0.1 192.150.8.100 127.0.0.1 192.150.18.101 127.0.0.1 192.168.112.207 127.0.0.1 194.224.66.48 127.0.0.1 199.7.52.190 127.0.0.1 199.7.52.190:80 127.0.0.1 209.34.83.73:43 127.0.0.1 209.34.83.73:443
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default
FF user.js: detected! => C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\user.js
FF Homepage: hxxp://www.zeit.de/foto/index
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.15.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\searchplugins\webde-suche.xml
FF Extension: hdvc - C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\Extensions\hdvc@hdvc.com.xpi
FF Extension: Adblock Plus - C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: defaults - C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\68j6b5yd.default\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\IPSFF
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-02-17] (Adobe Systems)
R2 Adobe Version Cue CS2; c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe [163840 2005-04-06] (Adobe Systems Incorporated)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
S2 Yontoo Desktop Updater; "C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe" "C:\Users\USERNAME\AppData\Roaming\Yontoo\YontooDesktop.exe"
==================== Drivers (Whitelisted) ====================
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-23] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-28] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-10-01] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\IPSDefs\20131115.001\IDSvia64.sys [521816 2013-10-28] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20131116.006\ENG64.SYS [126040 2013-10-01] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.4.0.40\Definitions\VirusDefs\20131116.006\EX64.SYS [2099288 2013-10-01] (Symantec Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800576 2010-03-15] (Sonix Technology Co., Ltd.)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1404000.028\SYMEFA64.SYS [1139800 2013-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-07-18] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-17 12:50 - 2013-11-17 12:51 - 00018365 _____ C:\Users\USERNAME\Downloads\FRST.txt
2013-11-17 12:50 - 2013-11-17 12:50 - 00000000 ____D C:\FRST
2013-11-17 12:49 - 2013-11-17 12:49 - 00000000 _____ C:\Users\USERNAME\defogger_reenable
2013-11-17 12:48 - 2013-11-17 12:49 - 00000490 _____ C:\Users\USERNAME\Downloads\defogger_disable.log
2013-11-17 12:48 - 2013-11-17 12:48 - 00000262 _____ C:\Users\USERNAME\Downloads\defogger_enable.log
2013-11-17 12:47 - 2013-11-17 12:47 - 01958236 _____ (Farbar) C:\Users\USERNAME\Downloads\FRST64.exe
2013-11-17 12:46 - 2013-11-17 12:46 - 00050477 _____ C:\Users\USERNAME\Downloads\Defogger.exe
2013-11-17 12:27 - 2013-11-17 12:27 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-17 12:27 - 2013-11-17 12:27 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Malwarebytes
2013-11-17 12:27 - 2013-11-17 12:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-17 12:27 - 2013-11-17 12:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-17 12:27 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-17 12:26 - 2013-11-17 12:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\USERNAME\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-15 22:59 - 2013-11-15 22:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 23:40 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 23:40 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 23:40 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 23:40 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 23:40 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 23:40 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 23:40 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 23:40 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 23:40 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 23:40 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-14 23:40 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 23:40 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 23:39 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 23:39 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 23:39 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 22:29 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 22:29 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 22:29 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 22:29 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 22:29 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 22:29 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 22:29 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 22:29 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 22:29 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 22:29 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 22:29 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 22:29 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 22:29 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 22:29 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 22:29 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 22:29 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 22:29 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 22:29 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 22:29 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 22:29 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 22:29 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 22:29 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 22:29 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 22:29 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 22:29 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 22:29 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 22:29 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 22:29 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 22:29 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 22:29 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 22:37 - 2013-11-13 22:37 - 32206488 _____ (DVDVideoSoft Ltd. ) C:\Users\USERNAME\Downloads\FreeYouTubeToMP3Converter.exe
2013-11-10 18:37 - 2013-11-10 18:37 - 00001070 _____ C:\Users\Public\Desktop\PixelNet Software.lnk
2013-11-10 18:35 - 2013-11-10 18:37 - 00000000 ____D C:\Program Files (x86)\PixelNet Software
2013-11-03 17:37 - 2013-11-03 17:37 - 00262144 _____ C:\Windows\Minidump\110313-45645-01.dmp
==================== One Month Modified Files and Folders =======
2013-11-17 12:51 - 2013-11-17 12:50 - 00018365 _____ C:\Users\USERNAME\Downloads\FRST.txt
2013-11-17 12:50 - 2013-11-17 12:50 - 00000000 ____D C:\FRST
2013-11-17 12:49 - 2013-11-17 12:49 - 00000000 _____ C:\Users\USERNAME\defogger_reenable
2013-11-17 12:49 - 2013-11-17 12:48 - 00000490 _____ C:\Users\USERNAME\Downloads\defogger_disable.log
2013-11-17 12:49 - 2011-12-29 14:52 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Dropbox
2013-11-17 12:49 - 2011-11-21 16:34 - 00000000 ____D C:\Users\USERNAME
2013-11-17 12:48 - 2013-11-17 12:48 - 00000262 _____ C:\Users\USERNAME\Downloads\defogger_enable.log
2013-11-17 12:48 - 2013-06-29 00:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-17 12:47 - 2013-11-17 12:47 - 01958236 _____ (Farbar) C:\Users\USERNAME\Downloads\FRST64.exe
2013-11-17 12:46 - 2013-11-17 12:46 - 00050477 _____ C:\Users\USERNAME\Downloads\Defogger.exe
2013-11-17 12:46 - 2011-11-21 16:28 - 01778698 _____ C:\Windows\WindowsUpdate.log
2013-11-17 12:46 - 2011-04-12 08:43 - 00654166 _____ C:\Windows\system32\perfh007.dat
2013-11-17 12:46 - 2011-04-12 08:43 - 00130006 _____ C:\Windows\system32\perfc007.dat
2013-11-17 12:46 - 2009-07-14 06:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-17 12:44 - 2012-11-18 22:58 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Spotify
2013-11-17 12:43 - 2013-03-31 12:52 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Yontoo
2013-11-17 12:43 - 2011-12-29 15:03 - 00000000 ___RD C:\Users\USERNAME\Dropbox
2013-11-17 12:42 - 2011-12-26 18:42 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Skype
2013-11-17 12:42 - 2011-12-26 16:28 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-17 12:41 - 2010-11-21 04:47 - 00179480 _____ C:\Windows\PFRO.log
2013-11-17 12:41 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-17 12:41 - 2009-07-14 05:51 - 00087151 _____ C:\Windows\setupact.log
2013-11-17 12:30 - 2009-07-14 05:45 - 00022064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-17 12:30 - 2009-07-14 05:45 - 00022064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-17 12:27 - 2013-11-17 12:27 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-17 12:27 - 2013-11-17 12:27 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Malwarebytes
2013-11-17 12:27 - 2013-11-17 12:27 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-17 12:27 - 2013-11-17 12:27 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-17 12:26 - 2013-11-17 12:26 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\USERNAME\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-17 12:25 - 2011-12-26 16:28 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-17 12:25 - 2011-11-21 16:41 - 00003986 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4FEC0ECE-49D0-4DF9-B9A0-B690DB4F4965}
2013-11-16 21:34 - 2012-11-18 22:59 - 00000000 ____D C:\Users\USERNAME\AppData\Local\Spotify
2013-11-16 21:24 - 2012-11-03 21:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-16 11:45 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-15 22:59 - 2013-11-15 22:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 22:51 - 2011-12-26 18:42 - 00000000 ____D C:\ProgramData\Skype
2013-11-14 23:39 - 2013-08-16 07:31 - 00000000 ____D C:\Windows\system32\MRT
2013-11-14 23:37 - 2011-11-21 17:01 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-14 23:35 - 2013-06-26 23:03 - 00032768 _____ C:\Users\USERNAME\Desktop\Kostenkontrolle.xls
2013-11-13 22:37 - 2013-11-13 22:37 - 32206488 _____ (DVDVideoSoft Ltd. ) C:\Users\USERNAME\Downloads\FreeYouTubeToMP3Converter.exe
2013-11-10 21:01 - 2012-01-19 16:38 - 00000000 ____D C:\Users\USERNAME\AppData\Local\CrashDumps
2013-11-10 18:37 - 2013-11-10 18:37 - 00001070 _____ C:\Users\Public\Desktop\PixelNet Software.lnk
2013-11-10 18:37 - 2013-11-10 18:35 - 00000000 ____D C:\Program Files (x86)\PixelNet Software
2013-11-03 20:50 - 2011-12-29 14:53 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-03 20:50 - 2011-11-21 16:34 - 00000000 ___RD C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-03 17:37 - 2013-11-03 17:37 - 00262144 _____ C:\Windows\Minidump\110313-45645-01.dmp
2013-11-03 17:37 - 2012-01-07 17:42 - 671031350 _____ C:\Windows\MEMORY.DMP
2013-11-03 17:37 - 2012-01-07 17:42 - 00000000 ____D C:\Windows\Minidump
2013-10-28 08:28 - 2012-05-28 17:00 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\Winamp
2013-10-27 15:27 - 2012-11-03 20:48 - 00000000 ____D C:\Users\USERNAME\Desktop\Adobe Photoshop CS6 Extended Portable
2013-10-23 22:39 - 2013-03-14 13:18 - 00000000 ____D C:\Users\USERNAME\AppData\Roaming\.oit
Some content of TEMP:
====================
C:\Users\USERNAME\AppData\Local\Temp\SkypeSetup.exe
C:\Users\USERNAME\AppData\Local\Temp\uninstall.exe
C:\Users\USERNAME\AppData\Local\Temp\_is61BE.exe
C:\Users\USERNAME\AppData\Local\Temp\_isBF96.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-10 13:26
==================== End Of Log ============================
Additions.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2013
Ran by USERNAME at 2013-11-17 12:51:49
Running from C:\Users\USERNAME\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Norton 360 (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton 360 (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
==================== Installed Programs ======================
7-Zip 9.22beta (x32)
Adobe AIR (x32 Version: 3.1.0.4880)
Adobe Bridge 1.0 (x32 Version: 001.000.001)
Adobe Common File Installer (x32 Version: 1.00.001)
Adobe Community Help (x32 Version: 3.4.980)
Adobe Content Viewer (x32 Version: 1.4.0)
Adobe Creative Suite 2 (x32)
Adobe Creative Suite 5 Master Collection (x32 Version: 5.0)
Adobe Download Assistant (x32 Version: 1.0.6)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Help Center 1.0 (x32 Version: 1.0.1)
Adobe Illustrator CS2 (x32 Version: 12.000.000)
Adobe InDesign CS2 (x32 Version: 004.000.000)
Adobe Media Player (x32 Version: 1.8)
Adobe Photoshop CS2 (x32 Version: 9.0)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Adobe Stock Photos 1.0 (x32 Version: 1.0.1)
Adobe SVG Viewer 3.0 (x32 Version: 3.0)
Adobe Version Cue CS2 (x32 Version: 2.0)
Apple Application Support (x32 Version: 2.3)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36)
Benutzerhandbuch (x32 Version: 1.0.0.6)
Canon Easy-PhotoPrint EX (x32)
Canon Easy-WebPrint EX (x32)
Canon IJ Network Scanner Selector EX (x32)
Canon IJ Network Tool (x32)
Canon MG3100 series Benutzerregistrierung (x32)
Canon MG3100 series MP Drivers
Canon MG3100 series On-screen Manual (x32)
Canon MP Navigator EX 5.0 (x32)
Canon My Printer (x32)
Canon Solution Menu EX (x32)
Conexant HD Audio (Version: 8.54.1.0)
Dropbox (HKCU Version: 2.4.6)
ElsterFormular (x32 Version: 14.1.20130301)
Energy Management (x32 Version: 6.0.2.0)
ffdshow v1.2.4422 [2012-04-09] (x32 Version: 1.2.4422.0)
Free YouTube to MP3 Converter version 3.12.0.128 (x32 Version: 3.12.0.128)
Google Update Helper (x32 Version: 1.3.21.165)
High-Definition Video Playback (x32 Version: 11.1.10500.2.65)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)
IrfanView (remove only) (x32 Version: 4.32)
Java 7 Update 17 (64-bit) (Version: 7.0.170)
Lenovo EasyCamera (x32 Version: 5.8.56000.8)
Lenovo OneKey Recovery (Version: 7.0.1628)
Lenovo OneKey Recovery (x32 Version: 7.0.1628)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office Standard Edition 2003 (x32 Version: 11.0.5614.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000)
Mozilla Firefox 25.0.1 (x86 en-US) (x32 Version: 25.0.1)
Mozilla Firefox Packages (HKCU)
Mozilla Maintenance Service (x32 Version: 25.0.1)
Nero 11 (x32 Version: 11.0.11200)
Nero 11 Disc Menus Basic (x32 Version: 11.0.11200.12.0)
Nero 11 Effects Basic (x32 Version: 11.0.11400.14.0)
Nero 11 Image Samples (x32 Version: 11.0.11200.12.0)
Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0)
Nero 11 PiP Effects Basic (x32 Version: 11.0.11400.14.0)
Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0)
Nero BackItUp 11 (x32 Version: 6.0.18000.19.100)
Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200)
Nero Backup Drivers (Version: 1.0.11100.8.0)
Nero Burning ROM 11 (x32 Version: 11.0.12500.24.100)
Nero Burning ROM 11 Help (CHM) (x32 Version: 11.0.10300)
Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27)
Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300)
Nero Core Components 11 (x32 Version: 11.0.15600.1.17)
Nero CoverDesigner 11 (x32 Version: 6.0.10800.11.100)
Nero CoverDesigner 11 Help (CHM) (x32 Version: 11.0.10300)
Nero Express 11 (x32 Version: 11.0.11900.24.100)
Nero Express 11 Help (CHM) (x32 Version: 11.0.10300)
Nero Kwik Media (x32 Version: 1.10.24000.138.100)
Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200)
Nero Recode 11 (x32 Version: 5.0.13600.34.100)
Nero Recode 11 Help (CHM) (x32 Version: 11.0.10300)
Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100)
Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400)
Nero SoundTrax 11 (x32 Version: 5.0.10700.6.100)
Nero SoundTrax 11 Help (CHM) (x32 Version: 11.0.10400)
Nero Update (x32 Version: 11.0.11500.28.0)
Nero Video 11 (x32 Version: 8.0.14600.27.100)
Nero Video 11 Help (CHM) (x32 Version: 11.0.10300)
Nero WaveEditor 11 (x32 Version: 6.0.11100.7.100)
Nero WaveEditor 11 Help (CHM) (x32 Version: 11.0.10400)
nero.prerequisites.msi (x32 Version: 11.0.20008)
Norton 360 (x32 Version: 20.4.0.40)
PDF Settings CS5 (x32 Version: 10.0)
PDF24 Creator 5.7.0 (x32)
PixelNet Software 4.12.2 (x32 Version: 4.12.2)
PxMergeModule (x32 Version: 1.00.0000)
Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7600.10003)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
Skype™ 6.10 (x32 Version: 6.10.104)
Spotify (HKCU Version: 0.9.6.72.ge389c074)
Suite Specific (x32 Version: 2.0.0)
Synaptics Pointing Device Driver (Version: 15.2.6.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
UserGuide (x32 Version: 1.0.0.6)
VLC media player 1.1.11 (x32 Version: 1.1.11)
welcome (x32 Version: 11.0.21500.0.4)
Winamp (x32 Version: 5.623 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (Version: 12/02/2010 6.1.0.1)
WxDFast (Version: 1.0)
wxDownload (x32 Version: )
wxDownload Fast 0.6.0 (x32)
XlsX Viewer 2.0 (x32)
Yontoo 2.051 (Version: 2.051)
==================== Restore Points =========================
08-11-2013 16:54:44 Geplanter Prüfpunkt
14-11-2013 22:36:26 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2012-10-11 12:31 - 00002605 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 3dns.adobe.com 127.0.0.1 3dns-1.adobe.com 127.0.0.1 3dns-2.adobe.com 127.0.0.1 3dns-3.adobe.com 127.0.0.1 3dns-4.adobe.com 127.0.0.1 activate.adobe.com 127.0.0.1 activate-sea.adobe.com 127.0.0.1 activate-sea.adobe.com 127.0.0.1 activate-sjc0.adobe.com 127.0.0.1 activate.wip.adobe.com 127.0.0.1 activate.wip1.adobe.com 127.0.0.1 activate.wip2.adobe.com 127.0.0.1 activate.wip3.adobe.com 127.0.0.1 activate.wip4.adobe.com 127.0.0.1 adobe-dns.adobe.com 127.0.0.1 adobe-dns-1.adobe.com 127.0.0.1 adobe-dns-2.adobe.com 127.0.0.1 adobe-dns-3.adobe.com 127.0.0.1 adobe-dns-4.adobe.com 127.0.0.1 crl.verisign.net 127.0.0.1 CRL.VERISIGN.NET 127.0.0.1 ood.opsource.net 127.0.0.1 209-34-83-73.ood.opsource.net 127.0.0.1 practivate.adobe 127.0.0.1 practivate.adobe 127.0.0.1 practivate.adobe.com 127.0.0.1 practivate.adobe.newoa 127.0.0.1 practivate.adobe.ntp 127.0.0.1 practivate.adobe.ipp 127.0.0.1 ereg.adobe.com 127.0.0.1 ereg.wip.adobe.com 127.0.0.1 ereg.wip1.adobe.com 127.0.0.1 ereg.wip2.adobe.com 127.0.0.1 ereg.wip3.adobe.com 127.0.0.1 ereg.wip4.adobe.com 127.0.0.1 wip.adobe.com 127.0.0.1 wip1.adobe.com 127.0.0.1 wip2.adobe.com 127.0.0.1 wip3.adobe.com 127.0.0.1 wip4.adobe.com 127.0.0.1 hxxp://www.wip.adobe.com 127.0.0.1 hxxp://www.wip1.adobe.com 127.0.0.1 hxxp://www.wip2.adobe.com 127.0.0.1 Adobe 127.0.0.1 Adobe 127.0.0.1 wwis-dubc1-vip60.adobe.com 127.0.0.1 installer.nemetschek.net 127.0.0.1 piracy.nemetschek.net 127.0.0.1 secure.nemetschek.net 127.0.0.1 obdev.at 127.0.0.1 192.150.18.108 127.0.0.1 192.150.22.40 127.0.0.1 192.150.14.69 127.0.0.1 192.150.8.118 127.0.0.1 192.150.8.100 127.0.0.1 192.150.18.101 127.0.0.1 192.168.112.207 127.0.0.1 194.224.66.48 127.0.0.1 199.7.52.190 127.0.0.1 199.7.52.190:80 127.0.0.1 209.34.83.73:43 127.0.0.1 209.34.83.73:443
==================== Scheduled Tasks (whitelisted) =============
Task: {04E99D25-920A-4855-8CD9-6E7F612F842C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {2D9B277D-5EE5-4199-A127-B0148201BD79} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-26] (Google Inc.)
Task: {6539BC0B-8077-4BB9-A0CD-19FA3CFB9988} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
Task: {7E2C60F7-F794-4B45-B646-DE86FDCFFEDB} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
Task: {93743708-377C-457E-AEED-B6AD1996F958} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9D58A317-5E79-4394-A91F-8977CACA6A28} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-12-26] (Google Inc.)
Task: {D0C3B998-1921-4887-9C44-95EF7560F1AA} - System32\Tasks\{7FDA72D7-8EBE-4D2F-96BE-2A52144679CD} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/abandoninstall?page=tsPlugin
Task: {E0BAB984-CD56-40EC-9F78-CAC489B78BC4} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\WSCStub.exe [2013-06-03] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-08-31 19:13 - 2011-08-31 19:13 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2008-12-20 03:20 - 2011-11-21 17:05 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2008-12-20 03:20 - 2011-11-21 17:05 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2005-04-06 16:52 - 2005-04-06 16:52 - 00028791 _____ () c:\Users\USERNAME\Adobe Version Cue CS2\jre\bin\hpi.dll
2005-04-06 16:53 - 2005-04-06 16:53 - 00057453 _____ () c:\Users\USERNAME\Adobe Version Cue CS2\jre\bin\verify.dll
2005-04-06 16:53 - 2005-04-06 16:53 - 00102515 _____ () c:\Users\USERNAME\Adobe Version Cue CS2\jre\bin\java.dll
2005-04-06 16:53 - 2005-04-06 16:53 - 00053364 _____ () c:\Users\USERNAME\Adobe Version Cue CS2\jre\bin\zip.dll
2005-04-06 16:53 - 2005-04-06 16:53 - 00057455 _____ () C:\Users\USERNAME\Adobe Version Cue CS2\jre\bin\net.dll
2005-04-06 16:53 - 2005-04-06 16:53 - 00032880 _____ () C:\Users\USERNAME\Adobe Version Cue CS2\jre\bin\nio.dll
2005-04-06 16:53 - 2005-04-06 16:53 - 00434255 _____ () c:\Users\USERNAME\Adobe Version Cue CS2\bin\ps-rw-vc-v8_58.dll
2005-04-06 16:53 - 2005-04-06 16:53 - 01019904 _____ () c:\Users\USERNAME\Adobe Version Cue CS2\bin\ps-vc-v8_58.dll
2013-07-18 13:08 - 2012-05-30 07:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON 360\ENGINE\20.4.0.40\wincfi39.dll
2013-06-14 17:43 - 2013-11-17 12:43 - 00013600 _____ () C:\Users\USERNAME\AppData\Roaming\Yontoo\dat\Desktop.OS.Plugin.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\USERNAME\AppData\Roaming\Dropbox\bin\libcef.dll
2013-11-15 22:59 - 2013-11-15 22:59 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-08-16 07:59 - 2013-08-16 07:59 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9ab0e818cb3d1b6930eba54179f89300\IsdiInterop.ni.dll
2011-11-21 16:52 - 2011-01-12 17:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/17/2013 00:45:00 PM) (Source: Application Hang) (User: )
Description: Programm Skype.exe, Version 6.10.0.104 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: f04
Startzeit: 01cee38a235f2e8d
Endzeit: 4
Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe
Berichts-ID:
Error: (11/17/2013 00:43:24 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/17/2013 10:36:59 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/16/2013 09:26:30 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/16/2013 11:46:49 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/15/2013 10:38:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/14/2013 10:17:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/13/2013 09:02:08 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/12/2013 10:22:57 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/11/2013 08:49:05 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (11/17/2013 00:41:57 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Yontoo Desktop Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/17/2013 00:24:52 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst LanmanServer erreicht.
Error: (11/17/2013 10:35:39 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Yontoo Desktop Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/16/2013 09:25:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Yontoo Desktop Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/16/2013 11:45:38 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Yontoo Desktop Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/15/2013 10:37:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Yontoo Desktop Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/14/2013 11:36:41 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (11/14/2013 10:16:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Yontoo Desktop Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (11/14/2013 00:13:45 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (11/13/2013 09:00:43 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Yontoo Desktop Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (11/17/2013 00:45:00 PM) (Source: Application Hang)(User: )
Description: Skype.exe6.10.0.104f0401cee38a235f2e8d4C:\Program Files (x86)\Skype\Phone\Skype.exe
Error: (11/17/2013 00:43:24 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/17/2013 10:36:59 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/16/2013 09:26:30 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/16/2013 11:46:49 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/15/2013 10:38:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/14/2013 10:17:31 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/13/2013 09:02:08 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/12/2013 10:22:57 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/11/2013 08:49:05 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 52%
Total physical RAM: 4039.86 MB
Available physical RAM: 1931.48 MB
Total Pagefile: 8077.9 MB
Available Pagefile: 5833.62 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:406.08 GB) (Free:311.77 GB) NTFS
Drive d: () (Fixed) (Total:29.29 GB) (Free:29.29 GB) FAT32
Drive e: (EXIT) (CDROM) (Total:5.09 GB) (Free:0 GB) UDF
Drive f: (INTENSO) (Fixed) (Total:931.28 GB) (Free:324.92 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: C3FFC3FF)
Partition 1: (Active) - (Size=29 GB) - (Type=0C)
Partition 2: (Not Active) - (Size=29 GB) - (Type=0C)
Partition 3: (Not Active) - (Size=406 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
========================================================
Disk: 1 (Size: 932 GB) (Disk ID: 6B564585)
Partition 1: (Not Active) - (Size=932 GB) - (Type=0C)
==================== End Of Log ============================
Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.17.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16736 USERNAME :: COMPUTERNAME [Administrator] 17.11.2013 12:30:23 mbam-log-2013-11-17 (12-30-23).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 202697 Laufzeit: 4 Minute(n), 3 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 13 HKCR\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892} (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Typelib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408} (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8} (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PricePeep (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\AppID\PricePeep.DLL (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\AppDataLow\Software\PricePeep (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 3 HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} (PUP.Optional.Iminent.A) -> Daten: -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{977AE9CC-AF83-45E8-9E03-E2798216E2D5} (PUP.Optional.Iminent.A) -> Daten: Ìéz—ƒ¯èEžây‚âÕ -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0WtGtCtH1K1O1S1W1O1U2W0StF1S -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 6 C:\Program Files (x86)\PricePeep (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\USERNAME\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\USERNAME\AppData\Roaming\OpenCandy\262A519BA04B45D8929447012C8B705B (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\USERNAME\AppData\Roaming\OpenCandy\OpenCandy_262A519BA04B45D8929447012C8B705B (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 15 C:\Windows\Tasks\OptimizerPro1UpdaterTask{213C90E8-08C6-42FA-A35A-C2A45B9FDF3E}.job (PUP.Optional.Optimizerpro) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\PricePeep\installer.ico (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\PricePeep\pricepeep.crx (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\PricePeep\uninstall.exe (PUP.Optional.PricePeep.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\HDVidCodec.lnk (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\USERNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\Uninstall.lnk (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\HDvidCodec10.crx (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\b.bmp (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\finish.bmp (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\FinishHDVID.exe (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\HDVidCodec.exe (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\hdvidextsetup.exe (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\hdvid_temp.bmp (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files (x86)\hdvidcodec.com\uninst.exe (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\USERNAME\AppData\Roaming\OpenCandy\262A519BA04B45D8929447012C8B705B\driverscannerROE.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Running: gmer_2.1.19163.exe; Driver: C:\Users\USER~1\AppData\Local\Temp\fflcquog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002ffd000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80002ffd02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!free 0000000075649894 5 bytes JMP 000000010a90d2d0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!malloc 0000000075649cee 5 bytes JMP 000000010a90d230
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!??3@YAXPAX@Z 000000007564b0b9 5 bytes JMP 000000010a90d2d0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!??2@YAPAXI@Z 000000007564b0c9 5 bytes JMP 000000010a90d480
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!realloc 000000007564b10d 5 bytes JMP 000000010a90d2b0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!calloc 000000007564c456 5 bytes JMP 000000010a90d270
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_msize 000000007564f43b 5 bytes JMP 000000010a90d2e0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_aligned_free 0000000075665942 5 bytes JMP 000000010a90d2d0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_aligned_malloc 000000007567028d 5 bytes JMP 000000010a90d3c0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_aligned_offset_malloc 00000000756702a9 5 bytes JMP 000000010a90d3e0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!?set_new_handler@@YAP6AXXZP6AXXZ@Z 000000007569bfd1 5 bytes JMP 000000010a90d500
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_aligned_offset_realloc 000000007569bfe1 5 bytes JMP 000000010a90d420
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_aligned_realloc 000000007569c16b 5 bytes JMP 000000010a90d400
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_expand 000000007569c18a 5 bytes JMP 000000010a90d3a0
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_heapadd 000000007569dd03 5 bytes JMP 000000010a90d550
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_heapchk 000000007569dd17 5 bytes JMP 000000010a90d560
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_heapset + 1 000000007569de16 4 bytes {JMP 0xffffffff9526f76b}
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_heapmin 000000007569de1f 5 bytes JMP 000000010a90d650
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_heapused 000000007569df05 5 bytes JMP 000000010a90d620
.text c:\Users\USERNAME\Adobe Version Cue CS2\bin\VersionCueCS2.exe[1432] C:\Windows\syswow64\msvcrt.dll!_heapwalk 000000007569df18 5 bytes JMP 000000010a90d590
.text C:\Users\USERNAME\AppData\Roaming\Dropbox\bin\Dropbox.exe[3932] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000076d91465 2 bytes [D9, 76]
.text C:\Users\USERNAME\AppData\Roaming\Dropbox\bin\Dropbox.exe[3932] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 0000000076d914bb 2 bytes [D9, 76]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\3859f9f60914
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\3859f9f60914 (not active ControlSet)
---- EOF - GMER 2.1 ----
|
Baum-Darstellung