![]() |
|
Log-Analyse und Auswertung: Win 8.1: Internetzugriff "umgeleitet" oder langsam, Google will Captcha, statt FritzBox russische SeiteWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() Win 8.1: Internetzugriff "umgeleitet" oder langsam, Google will Captcha, statt FritzBox russische Seite Ich hoffe auf Hilfe, denn seit gestern hat das Notebook meiner Frau unter Windows 8.1 ein seltsames Verhalten:
Zur Infrastruktur: im Heimnetz sind neben dem Notebook noch zwei PCs (Win 7 und Win 8.1) unterwegs, die beide keines dieser Probleme zeigen. Auch die Android-Devices sind nicht betroffen. Ein Restart des Routers hat keine Veränderung der Symptomatik gebracht. Auf dem Notebook ist neben den Windows-Hausmitteln kein separater Virenscanner installiert. ![]() Was ich bisher gemacht habe: desinfec't 2013 komplett durchlaufen lassen, mit aktuellsten Signaturen und alle vier mitgelieferten Scanner - bis auf einige suspekte E-Mails in IMAP Ablageordnern (sicherheitshalber sind die gelöscht, waren eh nicht wichtig) haben diese Scanner aber nichts gefunden. Anschließend strikt nach der "Basisanweisung" hier, bei vom Netz getrennten Laptop: defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 17:27 on 08/01/2014 (steff_000) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-01-2014 Ran by steff_000 (administrator) on VITAMEDNOTEBOOK on 08-01-2014 17:29:51 Running from E:\ Windows 8.1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (Hewlett-Packard Company) C:\Windows\System32\hpservice.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Dropbox, Inc.) C:\Users\Anna-Lena\AppData\Roaming\Dropbox\bin\Dropbox.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\livecomm.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-08-20] (IDT, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3030256 2013-10-29] (Synaptics Incorporated) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-04-10] (CyberLink Corp.) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2013-12-12] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1823656 2013-12-11] (Valve Corporation) Startup: C:\Users\Anna-Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\steff_000\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4 HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPNOT13/4 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT13/4 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT13/4 SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKLM - {CF486D8D-CCBC-44EF-B2F7-0CF1AC4DC152} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKLM-x32 - {CF486D8D-CCBC-44EF-B2F7-0CF1AC4DC152} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKCU - {CF486D8D-CCBC-44EF-B2F7-0CF1AC4DC152} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Tcpip\Parameters: [DhcpNameServer] 10.70.32.1 FireFox: ======== FF ProfilePath: C:\Users\steff_000\AppData\Roaming\Mozilla\Firefox\Profiles\kw1iscne.default FF Homepage: hxxp://www.spiegel.de/ FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Adblock Plus - C:\Users\steff_000\AppData\Roaming\Mozilla\Firefox\Profiles\kw1iscne.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi ==================== Services (Whitelisted) ================= S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131032 2013-10-29] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165336 2013-10-29] (Intel Corporation) S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-10-17] (Microsoft Corporation) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) R0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) S3 NdisImPlatformMp; C:\Windows\system32\DRIVERS\NdisImPlatform.sys [124928 2013-08-22] (Microsoft Corporation) R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation) S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-25] (Synaptics Incorporated) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [33008 2013-10-29] (Synaptics Incorporated) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation) S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation) R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-08 17:29 - 2014-01-08 17:29 - 00000000 ____D C:\FRST 2014-01-08 17:27 - 2014-01-08 17:27 - 00000000 _____ C:\Users\steff_000\defogger_reenable 2014-01-03 15:24 - 2014-01-03 15:24 - 00000000 ____D C:\Users\Anna-Lena\Documents\Youcam 2014-01-03 15:24 - 2014-01-03 15:24 - 00000000 ____D C:\Users\Anna-Lena\AppData\Roaming\CyberLink 2014-01-03 15:24 - 2014-01-03 15:24 - 00000000 ____D C:\Users\Anna-Lena\AppData\Local\CyberLink 2013-12-15 19:02 - 2013-12-15 19:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-12-15 19:01 - 2013-12-15 19:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-15 18:38 - 2013-11-12 00:27 - 00701440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2013-12-15 18:38 - 2013-11-12 00:24 - 00840704 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2013-12-15 18:38 - 2013-11-08 11:26 - 00358896 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll 2013-12-15 18:38 - 2013-11-08 05:43 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll 2013-12-15 18:38 - 2013-11-08 05:28 - 13177344 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2013-12-15 18:38 - 2013-11-08 05:26 - 11674624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2013-12-15 18:38 - 2013-11-05 15:03 - 00637952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2013-12-15 18:38 - 2013-11-05 14:57 - 00479744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2013-12-15 18:38 - 2013-11-04 18:13 - 01530200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2013-12-15 18:38 - 2013-11-04 11:32 - 02570240 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll 2013-12-15 18:38 - 2013-11-01 07:08 - 00747008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidcli.dll 2013-12-15 18:38 - 2013-10-31 01:58 - 00372568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys 2013-12-15 18:38 - 2013-10-31 01:42 - 07399256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2013-12-15 18:38 - 2013-10-17 12:21 - 02896896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll 2013-12-15 18:37 - 2013-11-12 00:41 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2013-12-15 18:37 - 2013-11-12 00:40 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2013-12-15 18:37 - 2013-11-11 03:48 - 00039768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\intelpep.sys 2013-12-15 18:37 - 2013-11-09 12:55 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS 2013-12-15 18:37 - 2013-11-09 07:37 - 01756160 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe 2013-12-15 18:37 - 2013-11-09 06:56 - 01391104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe 2013-12-15 18:37 - 2013-11-08 05:16 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll 2013-12-15 18:37 - 2013-11-08 05:15 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll 2013-12-15 18:37 - 2013-11-08 05:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll 2013-12-15 18:37 - 2013-11-08 04:41 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2013-12-15 18:37 - 2013-11-08 04:14 - 00922624 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll 2013-12-15 18:37 - 2013-11-05 15:19 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll 2013-12-15 18:37 - 2013-11-05 14:33 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2013-12-15 18:37 - 2013-11-05 14:32 - 00744448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2013-12-15 18:37 - 2013-11-04 18:13 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2013-12-15 18:37 - 2013-11-04 14:07 - 01843712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll 2013-12-15 18:37 - 2013-11-04 12:50 - 02143744 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2013-12-15 18:37 - 2013-11-04 03:28 - 01816576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll 2013-12-15 18:37 - 2013-11-04 02:30 - 01765376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2013-12-15 18:37 - 2013-11-01 12:39 - 00086872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys 2013-12-15 18:37 - 2013-11-01 06:57 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidcli.dll 2013-12-15 18:37 - 2013-10-31 01:33 - 01642016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2013-12-15 18:37 - 2013-10-31 01:33 - 01506680 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2013-12-15 18:37 - 2013-10-31 01:33 - 01476184 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi 2013-12-15 18:37 - 2013-10-31 01:33 - 01345536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2013-12-15 18:37 - 2013-10-26 02:54 - 00146776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\SerCx2.sys 2013-12-15 18:37 - 2013-10-24 10:31 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredentialMigrationHandler.dll 2013-12-15 18:37 - 2013-10-24 10:12 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredentialMigrationHandler.dll 2013-12-15 18:37 - 2013-10-17 11:36 - 02266624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll 2013-12-15 18:37 - 2013-10-05 15:21 - 02140888 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll 2013-12-15 18:37 - 2013-10-05 15:21 - 00516496 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll 2013-12-15 18:37 - 2013-10-05 13:05 - 01765384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll 2013-12-15 18:37 - 2013-10-05 13:05 - 00406400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll 2013-12-12 20:43 - 2013-12-12 20:43 - 09272200 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe 2013-12-12 20:39 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2013-12-12 20:39 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2013-12-12 20:39 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2013-12-12 20:39 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2013-12-12 20:39 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2013-12-12 20:39 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2013-12-12 20:39 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2013-12-12 20:39 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2013-12-12 20:39 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2013-12-12 20:39 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2013-12-12 20:39 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2013-12-12 20:39 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2013-12-12 20:39 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2013-12-12 20:39 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2013-12-12 20:39 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2013-12-12 20:39 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2013-12-12 20:39 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2013-12-12 20:39 - 2013-11-23 05:34 - 00393216 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll 2013-12-12 20:39 - 2013-11-23 05:13 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll 2013-12-12 20:39 - 2013-11-23 04:32 - 04105728 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll 2013-12-12 20:39 - 2013-11-23 04:10 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe 2013-12-12 20:39 - 2013-11-09 07:34 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAgent.exe 2013-12-12 20:39 - 2013-11-09 07:34 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll 2013-12-12 20:39 - 2013-11-09 06:52 - 00240128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll 2013-12-12 20:39 - 2013-11-08 08:21 - 04191744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2013-12-12 20:39 - 2013-10-19 09:53 - 00075360 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll 2013-12-12 20:39 - 2013-10-19 08:14 - 00070680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll 2013-12-12 20:39 - 2013-10-15 09:54 - 00197120 _____ (Microsoft Corporation) C:\WINDOWS\system32\scrrun.dll 2013-12-12 20:39 - 2013-10-15 09:03 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scrrun.dll 2013-12-09 22:37 - 2013-12-09 22:37 - 00000000 ____D C:\Users\steff_000\Downloads\pickhack 2013-12-09 22:37 - 2013-12-09 22:37 - 00000000 ____D C:\Program Files\7-Zip 2013-12-09 22:33 - 2013-12-09 22:37 - 01376768 _____ C:\Users\steff_000\Downloads\7z920-x64.msi 2013-12-09 22:31 - 2013-12-09 22:37 - 00098985 _____ C:\Users\steff_000\Downloads\pickhack.rar 2013-12-09 22:22 - 2013-12-09 22:24 - 00103850 _____ C:\Users\steff_000\Downloads\HexEditor_0_9_4_UNI_dll.zip 2013-12-09 22:12 - 2013-12-09 22:12 - 00002030 _____ C:\Users\Public\Desktop\Master of Orion 2.lnk 2013-12-09 22:11 - 2013-12-09 22:11 - 00000000 ____D C:\Games 2013-12-09 22:07 - 2013-12-09 22:08 - 01372957 _____ C:\Users\steff_000\Downloads\CheatCommands_LE_v1.26.zip 2013-12-09 21:59 - 2013-12-09 21:59 - 00000222 _____ C:\Users\steff_000\Desktop\Company of Heroes 2.url 2013-12-09 21:57 - 2013-12-09 22:05 - 168800072 _____ (GOG.com ) C:\Users\steff_000\Downloads\setup_master_of_orion12_2.0.0.16.exe ==================== One Month Modified Files and Folders ======= 2014-01-08 17:29 - 2014-01-08 17:29 - 00000000 ____D C:\FRST 2014-01-08 17:28 - 2013-09-30 05:14 - 01984420 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2014-01-08 17:28 - 2013-09-30 04:56 - 00843606 _____ C:\WINDOWS\system32\perfh007.dat 2014-01-08 17:28 - 2013-09-30 04:56 - 00192300 _____ C:\WINDOWS\system32\perfc007.dat 2014-01-08 17:27 - 2014-01-08 17:27 - 00000000 _____ C:\Users\steff_000\defogger_reenable 2014-01-08 17:27 - 2013-10-17 18:29 - 01088456 _____ C:\WINDOWS\WindowsUpdate.log 2014-01-08 17:27 - 2013-10-17 17:30 - 00000000 ____D C:\Users\steff_000 2014-01-08 17:26 - 2013-08-22 15:46 - 00333481 _____ C:\WINDOWS\setupact.log 2014-01-08 17:16 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness 2014-01-08 17:14 - 2013-10-11 14:38 - 00000000 ___RD C:\Users\Anna-Lena\Dropbox 2014-01-08 17:14 - 2013-10-11 14:35 - 00000000 ____D C:\Users\Anna-Lena\AppData\Roaming\Dropbox 2014-01-08 17:13 - 2013-10-18 17:14 - 00000000 __RDO C:\Users\Anna-Lena\SkyDrive 2014-01-08 17:12 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2014-01-07 21:04 - 2013-08-22 14:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI 2014-01-07 21:02 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru 2014-01-04 14:31 - 2013-10-11 13:58 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3898176212-2684441953-2709491735-1001 2014-01-04 13:36 - 2013-10-13 13:45 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-01-03 22:00 - 2013-10-17 17:30 - 00000000 ____D C:\Users\Anna-Lena 2014-01-03 20:51 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache 2014-01-03 15:24 - 2014-01-03 15:24 - 00000000 ____D C:\Users\Anna-Lena\Documents\Youcam 2014-01-03 15:24 - 2014-01-03 15:24 - 00000000 ____D C:\Users\Anna-Lena\AppData\Roaming\CyberLink 2014-01-03 15:24 - 2014-01-03 15:24 - 00000000 ____D C:\Users\Anna-Lena\AppData\Local\CyberLink 2014-01-03 15:24 - 2013-10-25 14:55 - 00000000 ____D C:\ProgramData\CyberLink 2013-12-22 20:43 - 2013-10-20 17:56 - 00000000 ____D C:\Program Files (x86)\Steam 2013-12-22 20:41 - 2013-10-11 15:16 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3898176212-2684441953-2709491735-1005 2013-12-22 20:25 - 2013-10-20 17:42 - 00000000 __RDO C:\Users\steff_000\SkyDrive 2013-12-22 19:46 - 2013-10-11 18:54 - 00000000 ____D C:\WINDOWS\system32\MRT 2013-12-22 19:45 - 2013-10-11 18:54 - 90708896 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2013-12-22 19:19 - 2013-10-20 20:17 - 00000052 _____ C:\WINDOWS\SysWOW64\DOErrors.log 2013-12-22 19:19 - 2013-10-20 20:17 - 00000000 _____ C:\WINDOWS\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-12-20 16:55 - 2013-10-11 14:36 - 00000000 ____D C:\Users\Anna-Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2013-12-20 16:55 - 2013-10-11 13:51 - 00000000 ___RD C:\Users\Anna-Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-12-19 19:19 - 2013-10-11 14:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-12-19 19:19 - 2013-09-29 20:04 - 00416622 _____ C:\WINDOWS\PFRO.log 2013-12-15 19:10 - 2013-12-15 19:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-12-15 19:02 - 2013-12-15 19:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-12-15 18:57 - 2013-08-22 15:44 - 00488224 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2013-12-15 18:56 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData 2013-12-15 18:56 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\WinStore 2013-12-15 18:56 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\MediaViewer 2013-12-15 18:56 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\FileManager 2013-12-15 18:56 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Camera 2013-12-15 18:34 - 2013-11-05 10:25 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-12-12 20:43 - 2013-12-12 20:43 - 09272200 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe 2013-12-12 20:43 - 2013-10-13 13:45 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2013-12-09 23:56 - 2013-10-27 14:44 - 00000000 ____D C:\Users\steff_000\Documents\My Games 2013-12-09 22:37 - 2013-12-09 22:37 - 00000000 ____D C:\Users\steff_000\Downloads\pickhack 2013-12-09 22:37 - 2013-12-09 22:37 - 00000000 ____D C:\Program Files\7-Zip 2013-12-09 22:37 - 2013-12-09 22:33 - 01376768 _____ C:\Users\steff_000\Downloads\7z920-x64.msi 2013-12-09 22:37 - 2013-12-09 22:31 - 00098985 _____ C:\Users\steff_000\Downloads\pickhack.rar 2013-12-09 22:24 - 2013-12-09 22:22 - 00103850 _____ C:\Users\steff_000\Downloads\HexEditor_0_9_4_UNI_dll.zip 2013-12-09 22:19 - 2013-10-25 08:39 - 00000000 ____D C:\Users\steff_000\AppData\Roaming\Notepad++ 2013-12-09 22:12 - 2013-12-09 22:12 - 00002030 _____ C:\Users\Public\Desktop\Master of Orion 2.lnk 2013-12-09 22:11 - 2013-12-09 22:11 - 00000000 ____D C:\Games 2013-12-09 22:08 - 2013-12-09 22:07 - 01372957 _____ C:\Users\steff_000\Downloads\CheatCommands_LE_v1.26.zip 2013-12-09 22:05 - 2013-12-09 21:57 - 168800072 _____ (GOG.com ) C:\Users\steff_000\Downloads\setup_master_of_orion12_2.0.0.16.exe 2013-12-09 21:59 - 2013-12-09 21:59 - 00000222 _____ C:\Users\steff_000\Desktop\Company of Heroes 2.url Some content of TEMP: ==================== C:\Users\steff_000\AppData\Local\Temp\Extract.exe C:\Users\steff_000\AppData\Local\Temp\npp.6.5.1.Installer.exe C:\Users\steff_000\AppData\Local\Temp\ose00000.exe C:\Users\steff_000\AppData\Local\Temp\ose00001.exe C:\Users\steff_000\AppData\Local\Temp\SP58448.exe C:\Users\steff_000\AppData\Local\Temp\SP61023.exe C:\Users\steff_000\AppData\Local\Temp\SP62072.exe C:\Users\steff_000\AppData\Local\Temp\SP62765.exe C:\Users\steff_000\AppData\Local\Temp\SP63340.exe C:\Users\steff_000\AppData\Local\Temp\SP63425.exe C:\Users\steff_000\AppData\Local\Temp\SP63752.exe C:\Users\steff_000\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-03 20:27 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-01-2014 Ran by steff_000 at 2014-01-08 17:30:25 Running from E:\ Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (x32 Version: 11.6.6.636 - Adobe Systems, Inc.) ArtMoney SE v7.41 (x32 Version: 7.41 - System SoftLab) Bonjour (Version: 3.0.0.10 - Apple Inc.) Company of Heroes 2 (x32 Version: - Relic Entertainment) Connected Music powered by Universal Music Group version 1.0 (x32 Version: 1.0 - Snowite) CyberLink PhotoDirector (x32 Version: 2.0.2.3317 - CyberLink Corp.) CyberLink PhotoDirector (x32 Version: 2.0.2.3317 - CyberLink Corp.) Hidden CyberLink PowerDirector 10 (x32 Version: 10.0.4.3122 - CyberLink Corp.) CyberLink PowerDirector 10 (x32 Version: 10.0.4.3122 - CyberLink Corp.) Hidden CyberLink PowerDVD (x32 Version: 10.0.8.5511 - CyberLink Corp.) CyberLink PowerDVD (x32 Version: 10.0.8.5511 - CyberLink Corp.) Hidden CyberLink YouCam (x32 Version: 3.5.5.5811 - CyberLink Corp.) CyberLink YouCam (x32 Version: 3.5.5.5811 - CyberLink Corp.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version: - Microsoft) Deinst. f. Druckertreiber UFR II (Version: 5, 4, 0, 0 - Canon Inc.) Energy Star (x32 Version: 1.0.9 - Hewlett-Packard Company) Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden HP 3D DriveGuard (Version: 4.2.8.1 - Hewlett-Packard Company) HP Connected Music (Meridian - installer) (x32 Version: v1.0 - Meridian Audio Ltd) HP CoolSense (x32 Version: 2.10.62 - Hewlett-Packard Company) HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden HP Documentation (x32 Version: 1.2.1.0 - Hewlett-Packard) HP Postscript Converter (Version: 3.1.3591 - Hewlett-Packard) Hidden HP Quick Launch (x32 Version: 3.0.6 - Hewlett-Packard Company) HP Recovery Manager (x32 Version: 8.00 - Hewlett-Packard) Hidden HP Registration Service (Version: 1.1.6232.4245 - Hewlett-Packard) HP Support Assistant (x32 Version: 7.0.39.15 - Hewlett-Packard Company) HP Utility Center (x32 Version: 1.0.8 - Hewlett-Packard) HP Wireless Button Driver (x32 Version: 1.1.2.1 - Hewlett-Packard Company) IDT Audio (x32 Version: 1.0.6425.0 - IDT) Intel(R) Control Center (x32 Version: 1.2.1.1008 - Intel Corporation) Intel(R) Management Engine Components (x32 Version: 8.1.30.1349 - Intel Corporation) Intel(R) Processor Graphics (x32 Version: 10.18.10.3316 - Intel Corporation) Intel(R) Rapid Storage Technology (x32 Version: 11.5.9.1002 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation) Intel® Trusted Connect Service Client (Version: 1.27.757.1 - Intel Corporation) Hidden Master of Orion 1 and 2 (x32 Version: 2.0.0.16 - GOG.com) Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Office (x32 Version: 14.0.6120.5004 - Microsoft Corporation) Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation) Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla) Mozilla Maintenance Service (x32 Version: 24.2.0 - Mozilla) Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden Notepad++ (x32 Version: 6.5.1 - Notepad++ Team) NVIDIA PhysX (x32 Version: 9.12.1031 - NVIDIA Corporation) Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Qualcomm Atheros Driver Installation Program (x32 Version: 10.0 - Qualcomm Atheros) Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek) Realtek PCIE Card Reader (x32 Version: 6.2.8400.29029 - Realtek Semiconductor Corp.) Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden Steam (x32 Version: 1.0.0.0 - Valve Corporation) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics Pointing Device Driver (Version: 16.6.1.3 - Synaptics Incorporated) Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (Version: - Microsoft) Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (Version: - Microsoft) VLC media player 2.1.0 (x32 Version: 2.1.0 - VideoLAN) Windows Live Communications Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live Essentials (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Windows Live Essentials (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden ==================== Restore Points ========================= 22-12-2013 18:44:42 Windows Update 03-01-2014 19:47:53 Geplanter Prüfpunkt ==================== Hosts content: ========================== 2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList Task: {0BE7195C-1C2E-4E5C-97E0-E27461266B45} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-10-12] (CyberLink) Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation) Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\System32\tzsync.exe [2013-08-22] (Microsoft Corporation) Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance Task: {4F5BB02A-C332-4BAB-BA3F-4A593514B678} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {59D864E0-F060-4E91-8FAE-FCB710EAFC8C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {663632D0-E105-421F-A679-C748A9030BC2} - System32\Tasks\HPGenoobeReminder => C:\Program Files (x86)\Hewlett-Packard\HP Registration Service\HP GenOOBE\HPGenOOBE.exe [2012-09-17] () Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup Task: {6C65C899-1C9E-4C90-96F6-B3DFA606A3FC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work Task: {AEEA0C68-6E4E-4115-8484-87DB9C30A2CE} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-06-07] (Hewlett-Packard Development Company, L.P.) Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization Task: {E3826C05-61AE-466D-BFAD-244FADD9AC61} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-12] (Adobe Systems Incorporated) Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE Task: {EDE839C2-A6C1-4470-ADA2-221DB66427DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-11-22] (Hewlett-Packard) Task: {F2C9972E-34A4-49FC-A489-8262F55E4CF3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\System32\MRT.exe [2013-12-22] (Microsoft Corporation) Task: {FA213F58-8BC7-4FDA-88F4-C6AE0DC130A5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-11-22] (Hewlett-Packard) Task: {FBD3C035-1EE4-4942-AD44-3A16FFD8DAD7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ==================== Loaded Modules (whitelisted) ============= 2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2012-06-18 16:24 - 2012-06-18 16:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll 2013-10-03 22:42 - 2013-10-03 22:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2013-12-15 19:01 - 2013-12-15 19:02 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2013-12-15 19:02 - 2013-12-15 19:02 - 03017840 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll 2013-12-15 19:02 - 2013-12-15 19:02 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll 2013-12-15 19:02 - 2013-12-15 19:02 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll 2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Anna-Lena\AppData\Roaming\Dropbox\bin\libcef.dll 2013-01-18 15:48 - 2013-10-29 14:23 - 01200088 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Users\Anna-Lena\SkyDrive:ms-properties AlternateDataStreams: C:\Users\steff_000\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (01/08/2014 05:14:40 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IAStorDataMgrSvc.exe, Version: 11.5.9.1002, Zeitstempel: 0x5065e128 Name des fehlerhaften Moduls: IAStorUtil.ni.dll, Version: 11.5.9.1002, Zeitstempel: 0x5065e124 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002f3fd ID des fehlerhaften Prozesses: 0x1370 Startzeit der fehlerhaften Anwendung: 0xIAStorDataMgrSvc.exe0 Pfad der fehlerhaften Anwendung: IAStorDataMgrSvc.exe1 Pfad des fehlerhaften Moduls: IAStorDataMgrSvc.exe2 Berichtskennung: IAStorDataMgrSvc.exe3 Vollständiger Name des fehlerhaften Pakets: IAStorDataMgrSvc.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IAStorDataMgrSvc.exe5 Error: (01/08/2014 05:14:39 PM) (Source: .NET Runtime) (User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/07/2014 09:01:45 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IAStorDataMgrSvc.exe, Version: 11.5.9.1002, Zeitstempel: 0x5065e128 Name des fehlerhaften Moduls: IAStorUtil.ni.dll, Version: 11.5.9.1002, Zeitstempel: 0x5065e124 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002f3fd ID des fehlerhaften Prozesses: 0xb88 Startzeit der fehlerhaften Anwendung: 0xIAStorDataMgrSvc.exe0 Pfad der fehlerhaften Anwendung: IAStorDataMgrSvc.exe1 Pfad des fehlerhaften Moduls: IAStorDataMgrSvc.exe2 Berichtskennung: IAStorDataMgrSvc.exe3 Vollständiger Name des fehlerhaften Pakets: IAStorDataMgrSvc.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IAStorDataMgrSvc.exe5 Error: (01/07/2014 09:01:45 PM) (Source: .NET Runtime) (User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/04/2014 01:38:21 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IAStorDataMgrSvc.exe, Version: 11.5.9.1002, Zeitstempel: 0x5065e128 Name des fehlerhaften Moduls: IAStorUtil.ni.dll, Version: 11.5.9.1002, Zeitstempel: 0x5065e124 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002f3fd ID des fehlerhaften Prozesses: 0x8b8 Startzeit der fehlerhaften Anwendung: 0xIAStorDataMgrSvc.exe0 Pfad der fehlerhaften Anwendung: IAStorDataMgrSvc.exe1 Pfad des fehlerhaften Moduls: IAStorDataMgrSvc.exe2 Berichtskennung: IAStorDataMgrSvc.exe3 Vollständiger Name des fehlerhaften Pakets: IAStorDataMgrSvc.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IAStorDataMgrSvc.exe5 Error: (01/04/2014 01:38:20 PM) (Source: .NET Runtime) (User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/03/2014 09:56:53 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IAStorDataMgrSvc.exe, Version: 11.5.9.1002, Zeitstempel: 0x5065e128 Name des fehlerhaften Moduls: IAStorUtil.ni.dll, Version: 11.5.9.1002, Zeitstempel: 0x5065e124 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002f3fd ID des fehlerhaften Prozesses: 0xe6c Startzeit der fehlerhaften Anwendung: 0xIAStorDataMgrSvc.exe0 Pfad der fehlerhaften Anwendung: IAStorDataMgrSvc.exe1 Pfad des fehlerhaften Moduls: IAStorDataMgrSvc.exe2 Berichtskennung: IAStorDataMgrSvc.exe3 Vollständiger Name des fehlerhaften Pakets: IAStorDataMgrSvc.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IAStorDataMgrSvc.exe5 Error: (01/03/2014 09:56:52 PM) (Source: .NET Runtime) (User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (12/24/2013 06:06:52 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: IAStorDataMgrSvc.exe, Version: 11.5.9.1002, Zeitstempel: 0x5065e128 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0140af1d ID des fehlerhaften Prozesses: 0x91c Startzeit der fehlerhaften Anwendung: 0xIAStorDataMgrSvc.exe0 Pfad der fehlerhaften Anwendung: IAStorDataMgrSvc.exe1 Pfad des fehlerhaften Moduls: IAStorDataMgrSvc.exe2 Berichtskennung: IAStorDataMgrSvc.exe3 Vollständiger Name des fehlerhaften Pakets: IAStorDataMgrSvc.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: IAStorDataMgrSvc.exe5 Error: (12/24/2013 06:06:51 AM) (Source: .NET Runtime) (User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() System errors: ============= Error: (01/08/2014 05:15:24 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (01/08/2014 05:14:44 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Intel(R) Rapid Storage-Technologie" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (01/08/2014 05:12:04 PM) (Source: Microsoft-Windows-HAL) (User: NT-AUTORITÄT) Description: Der Systemüberwachungszeitgeber wurde ausgelöst. Error: (01/07/2014 09:02:22 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (01/07/2014 09:01:52 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Intel(R) Rapid Storage-Technologie" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (01/07/2014 08:41:17 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (01/04/2014 01:42:55 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (01/04/2014 01:38:25 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Intel(R) Rapid Storage-Technologie" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (01/03/2014 09:57:21 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (01/03/2014 09:56:59 PM) (Source: Service Control Manager) (User: ) Description: Dienst "Intel(R) Rapid Storage-Technologie" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Microsoft Office Sessions: ========================= Error: (01/08/2014 05:14:40 PM) (Source: Application Error)(User: ) Description: IAStorDataMgrSvc.exe11.5.9.10025065e128IAStorUtil.ni.dll11.5.9.10025065e124c00000050002f3fd137001cf0c8cb48fee0dC:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exeC:\WINDOWS\assembly\NativeImages_v4.0.30319_32\IAStorUtil\6067599419f26bca086475e46050d92b\IAStorUtil.ni.dllf959b8bc-787f-11e3-bea7-38eaa7f9af9e Error: (01/08/2014 05:14:39 PM) (Source: .NET Runtime)(User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/07/2014 09:01:45 PM) (Source: Application Error)(User: ) Description: IAStorDataMgrSvc.exe11.5.9.10025065e128IAStorUtil.ni.dll11.5.9.10025065e124c00000050002f3fdb8801cf0be33fe02125C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exeC:\WINDOWS\assembly\NativeImages_v4.0.30319_32\IAStorUtil\6067599419f26bca086475e46050d92b\IAStorUtil.ni.dll887251a2-77d6-11e3-bea4-38eaa7f9af9e Error: (01/07/2014 09:01:45 PM) (Source: .NET Runtime)(User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/04/2014 01:38:21 PM) (Source: Application Error)(User: ) Description: IAStorDataMgrSvc.exe11.5.9.10025065e128IAStorUtil.ni.dll11.5.9.10025065e124c00000050002f3fd8b801cf0949cef4c0eeC:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exeC:\WINDOWS\assembly\NativeImages_v4.0.30319_32\IAStorUtil\6067599419f26bca086475e46050d92b\IAStorUtil.ni.dll17e2a376-753d-11e3-bea3-38eaa7f9af9e Error: (01/04/2014 01:38:20 PM) (Source: .NET Runtime)(User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (01/03/2014 09:56:53 PM) (Source: Application Error)(User: ) Description: IAStorDataMgrSvc.exe11.5.9.10025065e128IAStorUtil.ni.dll11.5.9.10025065e124c00000050002f3fde6c01cf08c648d70bf5C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exeC:\WINDOWS\assembly\NativeImages_v4.0.30319_32\IAStorUtil\6067599419f26bca086475e46050d92b\IAStorUtil.ni.dll924bbe8f-74b9-11e3-bea2-38eaa7f9af9e Error: (01/03/2014 09:56:52 PM) (Source: .NET Runtime)(User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() Error: (12/24/2013 06:06:52 AM) (Source: Application Error)(User: ) Description: IAStorDataMgrSvc.exe11.5.9.10025065e128unknown0.0.0.000000000c00000050140af1d91c01cf0065d7a1f6fbC:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exeunknown3329d37d-6c59-11e3-bea1-38eaa7f9af9e Error: (12/24/2013 06:06:51 AM) (Source: .NET Runtime)(User: ) Description: Anwendung: IAStorDataMgrSvc.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NullReferenceException Stapel: bei IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges() bei IAStorUtil.SystemDataModelListener.LoadSavedSystemState() bei IAStorDataMgr.EventRelay.<Start>b__0(System.Object) bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object) bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() bei System.Threading.ThreadPoolWorkQueue.Dispatch() bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback() ==================== Memory info =========================== Percentage of memory in use: 44% Total physical RAM: 3988.27 MB Available physical RAM: 2223.68 MB Total Pagefile: 5204.27 MB Available Pagefile: 3499.32 MB Total Virtual: 131072 MB Available Virtual: 131071.77 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:448.01 GB) (Free:364.76 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:16.63 GB) (Free:2.1 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive e: (USB DISK) (Removable) (Total:0.93 GB) (Free:0.85 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 02D09D48) Partition: GPT Partition Type ======================================================== Disk: 1 (MBR Code: Windows XP) (Size: 956 MB) (Disk ID: C3072E18) Partition 1: (Active) - (Size=956 MB) - (Type=0B) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2014-01-08 17:39:15 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002c HGST_HTS545050A7E380 rev.GG2OACA0 465,76GB Running: gmer_2.1.19163.exe; Driver: C:\Users\STEFF_~1\AppData\Local\Temp\kfdyrpog.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff960000c7700 15 bytes [00, EA, 0F, 02, 00, 7F, 6F, ...] .text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff960000c7710 11 bytes [00, 1F, FC, FF, 80, 52, DE, ...] ---- User code sections - GMER 2.1 ---- .text C:\Program Files\Windows Defender\MsMpEng.exe[1688] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007ffdc233169a 4 bytes [33, C2, FD, 7F] .text C:\Program Files\Windows Defender\MsMpEng.exe[1688] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007ffdc23316a2 4 bytes [33, C2, FD, 7F] .text C:\Program Files\Windows Defender\MsMpEng.exe[1688] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007ffdc233181a 4 bytes [33, C2, FD, 7F] .text C:\Program Files\Windows Defender\MsMpEng.exe[1688] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007ffdc2331832 4 bytes [33, C2, FD, 7F] .text C:\Windows\System32\igfxpers.exe[4144] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffdc233169a 4 bytes [33, C2, FD, 7F] .text C:\Windows\System32\igfxpers.exe[4144] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffdc23316a2 4 bytes [33, C2, FD, 7F] .text C:\Windows\System32\igfxpers.exe[4144] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffdc233181a 4 bytes [33, C2, FD, 7F] .text C:\Windows\System32\igfxpers.exe[4144] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffdc2331832 4 bytes [33, C2, FD, 7F] .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4252] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffdc233169a 4 bytes [33, C2, FD, 7F] .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4252] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffdc23316a2 4 bytes [33, C2, FD, 7F] .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4252] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffdc233181a 4 bytes [33, C2, FD, 7F] .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4252] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffdc2331832 4 bytes [33, C2, FD, 7F] .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4372] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffdc233169a 4 bytes [33, C2, FD, 7F] .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4372] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffdc23316a2 4 bytes [33, C2, FD, 7F] .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4372] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffdc233181a 4 bytes [33, C2, FD, 7F] .text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4372] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffdc2331832 4 bytes [33, C2, FD, 7F] ---- Threads - GMER 2.1 ---- Thread C:\WINDOWS\system32\csrss.exe [540:564] fffff960008c84d0 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- Ich danke vorab Steffen |
Themen zu Win 8.1: Internetzugriff "umgeleitet" oder langsam, Google will Captcha, statt FritzBox russische Seite |
adblock, bonjour, browser, canon, converter, cpu, desktop, device driver, e-mail, excel, firefox, flash player, google, home, homepage, installation, langsam, launch, mozilla, nicht öffnen, realtek, registry, rundll, russische seite, scan, security, seltsames verhalten, software, super, svchost.exe, system, win 7 u, windows, windows xp, windowsapps |