| |
| |||||||
Log-Analyse und Auswertung: Win32/Small.ca auf dem Computer und BluescreensWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
07.01.2014, 11:18
| #1 |
| |  Win32/Small.ca auf dem Computer und Bluescreens Schönen guten Morgen, gestern habe ich von Windows Defender den Hinweis bekommen, das sich auf meinem Computer der Win32/Small.ca befindet. Mein Virenscanner schlug bisher nicht an, aber kurz nach dem Hinweis stürzte der PC mit einem Bluescreen ab. Ich hoffe, das Ihr mir weiterhelfen könnt. PS. gerade meldet sich Gdata: APSDaemon.exe möchte nach hause telefonieren  Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.06.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Andreas2013 :: ANDREAS2013-PC [Administrator] Schutz: Aktiviert 06.01.2014 10:37:16 mbam-log-2014-01-06 (10-37-16).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 211845 Laufzeit: 4 Minute(n), 40 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.06.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Andreas2013 :: ANDREAS2013-PC [Administrator] Schutz: Aktiviert 06.01.2014 10:44:01 mbam-log-2014-01-06 (10-44-01).txt Art des Suchlaufs: Flash-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P Durchsuchte Objekte: 181724 Laufzeit: 20 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:18 on 07/01/2014 (Andreas2013)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-01-2014
Ran by Andreas2013 (administrator) on ANDREAS2013-PC on 07-01-2014 10:21:27
Running from C:\Users\Andreas2013\Desktop\Hilfe
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Andreas Sammann) D:\Program Files (x86)\C2DtoG15\SystoG15Svc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Valve Corporation) D:\Program Files (x86)\Steam\Steam.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(Andreas Sammann) D:\Program Files (x86)\C2DtoG15\C2DtoG15.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Apple Inc.) D:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [7477016 2013-04-24] (Logitech Inc.)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM-x32\...\Run: [G Data AntiVirus Tray] - C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe [1444304 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [GDFirewallTray] - C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1854928 2013-03-22] (G Data Software AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe
HKCU\...\Run: [Steam] - D:\Program Files (x86)\Steam\Steam.exe [1823656 2013-12-11] (Valve Corporation)
Startup: C:\Users\Andreas2013\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C2DtoG15.lnk
ShortcutTarget: C2DtoG15.lnk -> D:\Program Files (x86)\C2DtoG15\C2DtoG15.exe (Andreas Sammann)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x55BD23AC3059CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Andreas2013\AppData\Roaming\Mozilla\Firefox\Profiles\gluaim3z.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\Andreas2013\AppData\Roaming\Mozilla\Firefox\Profiles\gluaim3z.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
==================== Services (Whitelisted) =================
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [1957840 2013-03-22] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [635344 2013-02-25] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2555360 2013-06-21] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2926672 2013-03-22] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [696808 2013-02-25] (G Data Software AG)
R2 MBAMScheduler; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SystoG15Svc; D:\Program Files (x86)\C2DtoG15\SystoG15Svc.exe [59392 2011-01-26] (Andreas Sammann)
==================== Drivers (Whitelisted) ====================
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [60248 2013-06-26] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [130392 2013-06-26] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [62808 2013-06-25] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64856 2013-06-26] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [107128 2013-05-26] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65368 2013-06-26] (G Data Software AG)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 WinRing0_1_2_0; D:\Program Files (x86)\C2DtoG15\WinRing0x64.sys [14544 2008-07-26] (OpenLibSys.org)
S3 SANDRA; \??\D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP3a\WNt500x64\Sandra.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-07 10:20 - 2014-01-07 10:20 - 00000000 ____D C:\FRST
2014-01-07 10:18 - 2014-01-07 10:18 - 00000000 _____ C:\Users\Andreas2013\defogger_reenable
2014-01-07 10:12 - 2014-01-07 10:21 - 00000000 ____D C:\Users\Andreas2013\Desktop\Hilfe
2014-01-07 09:58 - 2014-01-07 09:58 - 00112820 _____ C:\Windows\PFRO.log
2014-01-07 09:58 - 2014-01-07 09:58 - 00000056 _____ C:\Windows\setupact.log
2014-01-07 09:58 - 2014-01-07 09:58 - 00000000 _____ C:\Windows\setuperr.log
2014-01-06 10:35 - 2014-01-06 10:35 - 00000000 ____D C:\Users\Andreas2013\AppData\Roaming\Malwarebytes
2014-01-06 10:35 - 2014-01-06 10:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-06 10:35 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-06 10:34 - 2014-01-06 10:34 - 01586344 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-06 10:30 - 2014-01-06 10:30 - 00000000 ____D C:\ProgramData\Package Cache
2014-01-06 10:17 - 2014-01-06 10:54 - 00000000 ____D C:\Windows\Minidump
2013-12-23 10:04 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2013-12-23 10:04 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2013-12-23 09:39 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-23 09:39 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-23 09:39 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-23 09:39 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-23 09:37 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-23 09:37 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-23 09:37 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-23 09:37 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-23 09:37 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-23 09:37 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-23 09:37 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-23 09:37 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-23 09:37 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-23 09:37 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-23 09:37 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-23 09:37 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-23 09:37 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-23 09:37 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-23 09:37 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-23 09:37 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-23 09:37 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-23 09:37 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-23 09:37 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-23 09:37 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-23 09:37 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-23 09:37 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-23 09:37 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-23 09:37 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-23 09:37 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-23 09:37 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-23 09:37 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-23 09:37 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-23 09:37 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-23 09:37 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-23 09:37 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-17 18:15 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-17 18:15 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-17 18:15 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-17 18:15 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-17 18:15 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-17 18:15 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-17 18:15 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-17 18:15 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-17 18:15 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-17 18:15 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-17 18:15 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-17 18:15 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-17 18:15 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-17 18:15 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-17 18:15 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-17 18:15 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-17 18:15 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-17 18:15 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-17 18:15 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 09:20 - 2013-12-09 09:20 - 00000000 ____D C:\Users\Andreas2013\AppData\Local\FalloutNV
==================== One Month Modified Files and Folders =======
2014-01-07 10:21 - 2014-01-07 10:12 - 00000000 ____D C:\Users\Andreas2013\Desktop\Hilfe
2014-01-07 10:20 - 2014-01-07 10:20 - 00000000 ____D C:\FRST
2014-01-07 10:18 - 2014-01-07 10:18 - 00000000 _____ C:\Users\Andreas2013\defogger_reenable
2014-01-07 10:18 - 2013-05-25 11:59 - 00000000 ____D C:\Users\Andreas2013
2014-01-07 10:05 - 2013-06-02 12:10 - 01563145 _____ C:\Windows\WindowsUpdate.log
2014-01-07 10:05 - 2009-07-14 05:45 - 00029056 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-07 10:05 - 2009-07-14 05:45 - 00029056 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-07 09:58 - 2014-01-07 09:58 - 00112820 _____ C:\Windows\PFRO.log
2014-01-07 09:58 - 2014-01-07 09:58 - 00000056 _____ C:\Windows\setupact.log
2014-01-07 09:58 - 2014-01-07 09:58 - 00000000 _____ C:\Windows\setuperr.log
2014-01-07 09:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-06 10:54 - 2014-01-06 10:17 - 00000000 ____D C:\Windows\Minidump
2014-01-06 10:54 - 2013-05-25 12:50 - 00000000 ____D C:\Windows\Panther
2014-01-06 10:35 - 2014-01-06 10:35 - 00000000 ____D C:\Users\Andreas2013\AppData\Roaming\Malwarebytes
2014-01-06 10:35 - 2014-01-06 10:35 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-06 10:34 - 2014-01-06 10:34 - 01586344 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-06 10:34 - 2009-07-14 18:58 - 00699408 _____ C:\Windows\system32\perfh007.dat
2014-01-06 10:34 - 2009-07-14 18:58 - 00149548 _____ C:\Windows\system32\perfc007.dat
2014-01-06 10:34 - 2009-07-14 06:13 - 01641466 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-06 10:30 - 2014-01-06 10:30 - 00000000 ____D C:\ProgramData\Package Cache
2013-12-27 10:49 - 2013-06-01 19:38 - 00000000 ____D C:\Users\Andreas2013\AppData\Local\Windows Live
2013-12-27 10:47 - 2013-05-25 23:23 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-27 10:47 - 2013-05-25 23:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-25 16:55 - 2013-05-25 20:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-23 14:53 - 2013-08-17 15:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-23 11:44 - 2013-06-01 21:01 - 00000000 ____D C:\Users\Andreas2013\Documents\my games
2013-12-23 10:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-23 09:44 - 2009-07-14 05:45 - 00275856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-23 09:37 - 2013-08-17 23:27 - 00000000 ____D C:\Windows\system32\MRT
2013-12-23 09:35 - 2013-05-25 19:39 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-23 09:30 - 2009-07-14 06:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-09 09:20 - 2013-12-09 09:20 - 00000000 ____D C:\Users\Andreas2013\AppData\Local\FalloutNV
Files to move or delete:
====================
C:\Users\Andreas2013\AppData\Roaming\Network Meter_Usage.ini
C:\Users\Andreas2013\Network_Meter_Data.js
Some content of TEMP:
====================
C:\Users\Andreas2013\AppData\Local\Temp\ubi3295.tmp.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-12-23 10:51
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-01-2014
Ran by Andreas2013 at 2014-01-07 10:21:52
Running from C:\Users\Andreas2013\Desktop\Hilfe
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: G Data InternetSecurity 2014 (Enabled - Up to date) {39B780B4-63C2-05B0-3B40-8F7A21E4F496}
AS: G Data InternetSecurity 2014 (Enabled - Up to date) {82D66150-45F8-0A3E-01F0-B4085A63BE2B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {018C0191-29AD-04E8-101F-264FDF37B3ED}
==================== Installed Programs ======================
Acer System Information (x32 Version: 1.0.0 - Acer)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.10.100.30328 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.80328.2204 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (x32 Version: 2.3.3 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
Application Profiles (x32 Version: 2.0.4888.34279 - Advanced Micro Devices, Inc.)
ArtMoney SE v7.41 (x32 Version: 7.41 - System SoftLab)
BioShock Infinite (x32 Version: - Irrational Games)
C2DtoG15 2.0.2.1 (x32 Version: - )
Canon Easy-PhotoPrint EX (x32 Version: 4.1.6 - Canon Inc.)
Canon iP4300 (Version: - )
Canon My Printer (x32 Version: 3.1.0 - Canon Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2013.0328.2218.38225 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
CCleaner (Version: 4.02 - Piriform)
CDBurnerXP (x32 Version: 4.5.2.4291 - CDBurnerXP)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dungeon Siege III (x32 Version: - Obsidian Entertainment)
Fallout: New Vegas (x32 Version: - Obsidian Entertainment)
Far Cry 3 Blood Dragon (x32 Version: 1.00 - Ubisoft)
Free YouTube to MP3 Converter version 3.12.5.628 (x32 Version: 3.12.5.628 - DVDVideoSoft Ltd.)
G Data InternetSecurity 2014 (x32 Version: 24.0.2.4 - G Data Software AG)
HD Tune 2.55 (x32 Version: - EFD Software)
iCloud (Version: 2.1.2.8 - Apple Inc.)
Intel(R) Network Connections 18.3.72.0 (Version: 18.3.72.0 - Intel)
Intel(R) Network Connections 18.3.72.0 (Version: 18.3.72.0 - Intel) Hidden
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Logitech Gaming Software (Version: 8.45.88 - Logitech Inc.) Hidden
Logitech Gaming Software 8.46 (Version: 8.46.27 - Logitech Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
NetSpeedMonitor 2.5.4.0 x64 (Version: 2.5.4.0 - Florian Gilles)
Nexus Mod Manager (Version: 0.45.5 - Black Tree Gaming)
Origin (x32 Version: 9.3.1.4482 - Electronic Arts, Inc.)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6873 - Realtek Semiconductor Corp.)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
The Elder Scrolls V: Skyrim (x32 Version: - Bethesda Game Studios)
Tomb Raider (x32 Version: - Crystal Dynamics)
Uplay (x32 Version: 3.0 - Ubisoft)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinRAR 4.20 (64-Bit) (Version: 4.20.0 - win.rar GmbH)
==================== Restore Points =========================
25-11-2013 10:08:18 Windows Update
26-11-2013 10:01:33 Installiert Far Cry 3 Blood Dragon
09-12-2013 07:50:54 Windows Update
09-12-2013 08:19:02 DirectX wurde installiert
17-12-2013 17:13:30 Windows Update
23-12-2013 08:34:28 Windows Update
23-12-2013 08:59:18 DirectX wurde installiert
23-12-2013 09:13:28 DirectX wurde installiert
27-12-2013 09:49:04 Windows Update
06-01-2014 08:36:13 Windows Update
06-01-2014 09:30:21 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {3B75BDD9-A552-458B-B76F-1669E128B1AA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {F32990D2-756F-4111-8ADA-7EF4A852D040} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
==================== Loaded Modules (whitelisted) =============
2013-04-05 11:58 - 2013-04-05 11:58 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
2013-04-05 11:58 - 2013-04-05 11:58 - 00021320 _____ () C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreamsPS64.dll
2013-04-23 17:30 - 2013-11-06 22:48 - 00691200 ____C () D:\Program Files (x86)\Steam\SDL2.dll
2013-05-03 14:35 - 2013-12-11 20:40 - 01135016 ____C () D:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-03-26 15:16 - 2013-11-06 22:48 - 20625832 ____C () D:\Program Files (x86)\Steam\bin\libcef.dll
2012-12-11 08:51 - 2013-06-15 00:49 - 01100800 ____C () D:\Program Files (x86)\Steam\bin\avcodec-53.dll
2012-12-11 08:51 - 2013-06-15 00:49 - 00124416 ____C () D:\Program Files (x86)\Steam\bin\avutil-51.dll
2012-12-11 08:51 - 2013-06-15 00:49 - 00192000 ____C () D:\Program Files (x86)\Steam\bin\avformat-53.dll
2013-06-01 20:45 - 2010-06-11 20:14 - 00004608 ____C () D:\Program Files (x86)\C2DtoG15\LgLcdLibWrapper.dll
2013-01-28 12:08 - 2013-01-28 12:08 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-01-28 12:08 - 2013-01-28 12:08 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-08-17 15:34 - 2013-12-23 14:53 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Standardtastatur (PS/2)
Description: Standardtastatur (PS/2)
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.
Details:
0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800))
Error: (01/07/2014 09:58:58 AM) (Source: ESENT) (User: )
Description: Windows (3440) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0077A.log.
System errors:
=============
Error: (01/07/2014 09:59:34 AM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (01/07/2014 09:59:02 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (01/07/2014 09:59:02 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.
Error: (01/06/2014 10:18:05 AM) (Source: BugCheck) (User: )
Description: 0x000000f4 (0x0000000000000003, 0xfffffa80077dcb30, 0xfffffa80077dce10, 0xfffff800033de7b0)C:\Windows\MEMORY.DMP010614-18205-01
Error: (01/06/2014 10:17:56 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 06.01.2014 um 10:15:48 unerwartet heruntergefahren.
Error: (01/06/2014 09:56:50 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 06.01.2014 um 09:52:53 unerwartet heruntergefahren.
Error: (12/25/2013 04:57:55 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (12/25/2013 04:57:55 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Error: (12/23/2013 10:03:54 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (12/23/2013 10:03:54 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Microsoft Office Sessions:
=========================
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/07/2014 09:59:02 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
4700
Error: (01/07/2014 09:58:58 AM) (Source: Windows Search Service)(User: )
Description:
Details:
0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800))
Error: (01/07/2014 09:58:58 AM) (Source: ESENT)(User: )
Description: Windows3440Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0077A.log-1811
==================== Memory info ===========================
Percentage of memory in use: 32%
Total physical RAM: 6135.11 MB
Available physical RAM: 4168.73 MB
Total Pagefile: 12268.4 MB
Available Pagefile: 9316.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:589.23 GB) (Free:538.24 GB) NTFS
Drive d: (Volume) (Fixed) (Total:341.8 GB) (Free:275.28 GB) NTFS
Drive e: () (Fixed) (Total:221.62 GB) (Free:90.87 GB) NTFS
Drive n: (Volume) (Fixed) (Total:0.49 GB) (Free:0.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F3DC59A4)
Partition 1: (Active) - (Size=244 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=222 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 096EA7B0)
Partition 1: (Not Active) - (Size=499 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=589 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=342 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-07 10:35:34
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-3 WDC_WD10EADS-22M2B0 rev.01.00A01 931,51GB
Running: vft1k4un.exe; Driver: C:\Users\ANDREA~1\AppData\Local\Temp\kwtyrpob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800031fd000 40 bytes [3B, 61, 20, 00, 01, F0, 48, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 569 fffff800031fd029 11 bytes [83, E0, FC, 48, 3B, C1, 72, ...]
---- User code sections - GMER 2.1 ----
.text D:\Program Files (x86)\Steam\Steam.exe[4056] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000075cd549c 5 bytes JMP 0000000100080800
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a61465 2 bytes [A6, 76]
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a614bb 2 bytes [A6, 76]
.text ... * 2
.text D:\Program Files (x86)\C2DtoG15\C2DtoG15.exe[3180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a61465 2 bytes [A6, 76]
.text D:\Program Files (x86)\C2DtoG15\C2DtoG15.exe[3180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a614bb 2 bytes [A6, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3760] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000075cd549c 5 bytes JMP 0000000100090800
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3760] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076a61465 2 bytes [A6, 76]
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3760] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000076a614bb 2 bytes [A6, 76]
.text ... * 2
.text D:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a61465 2 bytes [A6, 76]
.text D:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a614bb 2 bytes [A6, 76]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a61465 2 bytes [A6, 76]
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a614bb 2 bytes [A6, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3720:2220] 00000000763d7587
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3720:1196] 0000000068dc758a
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3720:1572] 0000000077ec2e65
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3720:2624] 0000000077ec3e85
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3720:5912] 0000000077ec3e85
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3720:6068] 0000000077ec3e85
Thread C:\Windows\System32\svchost.exe [4340:3016] 000007feeafb9688
---- EOF - GMER 2.1 ----
mich wundert nur, das GData jetzt erst was sagt  |
|
07.01.2014, 11:38
| #2 |
| /// the machine /// TB-Ausbilder    | Win32/Small.ca auf dem Computer und Bluescreens Win32 Small ist ein Fehlalarm. Das Andere auch. Such mal bitte in C:\Windows\Minidump das aktuellste Dumpfile, zipp es und hänge es an.
__________________
__________________ |
|
08.01.2014, 11:05
| #3 |
| | Win32/Small.ca auf dem Computer und Bluescreens Mahlzeit!
__________________der Ordner C:\Windows\Minidump ist bei mir leer, ausgeblendete/versteckte Datein sind sichtbar. |
|
09.01.2014, 08:44
| #4 |
| /// the machine /// TB-Ausbilder | Win32/Small.ca auf dem Computer und Bluescreens
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.01.2014, 17:06
| #5 |
| | Win32/Small.ca auf dem Computer und Bluescreens Schönen guten Abend, sorry das ich mich erst so spät melde, Anleitung habe ich befolgt, denn sehen wir mal  Auf diesem Rechner fehlte nur der Haken bei "Anzeigedauer der Wiederherstellungsoptionen", ist das so richtig?? Immo ist auch Ruhe, nix mit blaue Aussichten.  Bis die Tage |
|
16.01.2014, 09:14
| #6 |
| /// the machine /// TB-Ausbilder | Win32/Small.ca auf dem Computer und Bluescreens Jap. Wenn wieder einer kommt brauch ich dann das Dumpfile 
__________________ --> Win32/Small.ca auf dem Computer und Bluescreens |
|
| Themen zu Win32/Small.ca auf dem Computer und Bluescreens |
| .exe, adblock, bluescree, bluescreen, bluescreens, branding, compu, computer, defender, dvdvideosoft ltd., gdata, guten, hinweis, hoffe, launch, melde, meldet, memory.dmp, morgen, plug-in, scan, scanner, schöne, schönen, telefonieren, virenscan, virenscanner, weiterhelfen, win, win32/small.ca, windows |
Linear-Darstellung
