| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem DesktopWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
31.01.2014, 19:23
| #1 |
| |  Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Hallo vor 1-2 Tage habe ich durch Zufall gesehen das mein Task Manager weg ist, nichts böses bei gedacht, eher eine Laune der Natur vielleicht. Heute sollte ich eines besseren belehrt werden - auf einmal war eine Verknüpfung mit dem mcafee auf meinem Desktop was ich definitiv nicht runtergeladen habe. Also schnell unter Systemsteuerung - Programme entfernen das Ding weg gemacht. Alles gut, dachte ich. Taskmanager lässt sich über STRG+ALT+ENTF immer noch nicht aufrufen (der Eintrag ist einfach nicht vorhanden). Im Internet gesucht, man sollte in der Registry einen Schlüssel prüfen = Registry lässt sich nicht öffnen (wurde durch den Administrator gesperrt). Schlussendlich auf diese Seite gestoßen: hxxp://www.wintotal.de/tipparchiv/?TID=177 Script ausgeführt, ich komme wieder in die Systemregistry und mein Taskmanager ist auch wieder da. AABBEERRR! Da muss doch noch mehr sein, das ist doch nicht normal - oder? Im Anhang einige Ergebnisse meiner Scans. Mein riesen Dank vorab! lg |
|
31.01.2014, 22:15
| #2 |
| /// the machine /// TB-Ausbilder    | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
01.02.2014, 07:59
| #3 |
| | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Danke für den Hinweis.
__________________Addition.txtFRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014 01
Ran by ferropolis at 2014-01-31 18:49:14
Running from D:\Eigene Datein\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.0 - Adobe Systems)
Adobe AIR (x32 Version: 3.8.0.870 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.8.0.870 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 5 Master Collection (x32 Version: 5.0 - Adobe Systems Incorporated)
Adobe Flash Media Live Encoder 3.2 (x32 Version: 3.2.0 - Adobe Systems Incorporated)
Adobe Flash Media Server 4 (Version: - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 4.2 64-bit (Version: 4.2.1 - Adobe)
Adobe Reader 9.4.5 - Deutsch (x32 Version: 9.4.5 - Adobe Systems Incorporated)
AMD USB Filter Driver (x32 Version: 1.0.14.91 - Advanced Micro Devices, Inc.) Hidden
ANNO 1503 (x32 Version: - )
ANNO 1602 Königs-Edition (x32 Version: - )
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
ASUS nVidia Driver (x32 Version: 1.00.0000 - ASUSTek) Hidden
ATI Catalyst Install Manager (Version: 3.0.762.0 - ATI Technologies, Inc.)
AudibleManager (x32 Version: 1997749486.48.56.38604146 - Audible, Inc.)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Battlefield 1942 Server (x32 Version: - )
Battlefield 1942™ (x32 Version: 1.6.20.0 - Electronic Arts)
Battlefield 2(TM) (x32 Version: - )
Battlefield 3™ (x32 Version: 1.4.0.0 - Electronic Arts)
Battlefield 4™ (x32 Version: 1.0.0.1 - Electronic Arts)
Battlefield: Bad Company™ 2 (x32 Version: 1.0.0.0 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.3.2 - EA Digital Illusions CE AB)
Bitcoin (HKCU Version: 0.8.6 - Bitcoin project)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Call of Duty: Modern Warfare 2 - Multiplayer (x32 Version: - Infinity Ward)
Call of Duty: Modern Warfare 2 (x32 Version: - Infinity Ward)
Canon RAW Codec (x32 Version: 1.8.0.68 - Canon Inc.)
CINEMA 4D Release 11 (x32 Version: - )
Color Efex Pro 3.0 Complete (x32 Version: 3.1.1.0 - Nik Software, Inc.)
Combined Community Codec Pack 2011-11-11 (x32 Version: 2011.11.11.0 - CCCP Project)
Cool & Quiet (x32 Version: - )
Counter-Strike (x32 Version: - Valve)
Counter-Strike: Global Offensive (x32 Version: - Valve)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DCXtended .9 (x32 Version: - )
DDBAC (x32 Version: 4.3.71 - DataDesign)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (Version: - Microsoft)
DesertCombat 0.7 (x32 Version: - )
devolo dLAN Cockpit (x32 Version: 3.2.0.0 - devolo AG)
Dfine 2.0 (x32 Version: 2.1.0.7 - Nik Software, Inc.)
dLAN Cockpit (x32 Version: 3.2.28 - devolo AG) Hidden
DRI Tool 2.0 (x32 Version: 2.0 - Traumflieger)
Emergency 2012 (x32 Version: - Quadriga Games GmbH)
EPSON Scan (x32 Version: - Seiko Epson Corporation)
EPSON SX420W Series Netzwerk-Handbuch (x32 Version: - )
EPSON SX420W Series Printer Uninstall (Version: - SEIKO EPSON Corporation)
EpsonNet Print (x32 Version: 2.4j - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.2 (x32 Version: 3.2a - SEIKO EPSON CORPORATION)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
erLT (x32 Version: 1.20.0137 - Logitech, Inc.) Hidden
FileZilla Client 3.2.7.1 (HKCU Version: 3.2.7.1 - )
FlashFXP v4.0 (x32 Version: 4.0.0.1488 - OpenSight Software, LLC)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Foto-Mosaik-Edda Standard V6.6.12119.1 (x32 Version: - Steffen Schirmer)
Friendly Pinger (x32 Version: 5.0.1 - A.Kilievich & Co.)
G19 BF2 Mod 1.0.1 (x32 Version: - )
GameSpy Arcade (x32 Version: - )
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKCU Version: 32.0.1700.102 - Google Inc.)
Google Drive (x32 Version: 1.13.5782.599 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Half-Life Dedicated Server Update Tool (x32 Version: - )
High-Definition Video Playback 10 (x32 Version: 7.0.11400.29.0 - Nero AG) Hidden
iCloud (Version: 3.1.0.40 - Apple Inc.)
IrfanView (remove only) (x32 Version: 4.32 - Irfan Skiljan)
iTunes (Version: 11.1.3.8 - Apple Inc.)
JavaFX 2.1.1 (x32 Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Kolor Autopano Giga 3.0 (Version: V3.0.2 - Kolor)
Lexware faktura+auftrag 2012 (x32 Version: 16.03.00.0140 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (x32 Version: 2.80.00.0007 - Haufe-Lexware GmbH & Co.KG)
Lexware online banking (x32 Version: 14.00.00.0076 - Haufe-Lexware GmbH & Co.KG)
Logitech Gaming Software (Version: 8.35.18 - Logitech Inc.) Hidden
Logitech Gaming Software 5.10 (Version: 5.10.127 - Logitech)
Logitech Gaming Software 8.35 (Version: 8.35.18 - Logitech Inc.)
Logitech SetPoint 6.20 (Version: 6.20.64 - Logitech)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Max Local Application (x32 Version: 1.3.7 - ELV Elektronik AG) Hidden
Media Player Classic - Home Cinema v1.5.2.3456 x64 (Version: 1.5.2.3456 - MPC-HC Team)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Flight Simulator X (x32 Version: 10.0.60905 - Microsoft Game Studios)
Microsoft Flight Simulator X (x32 Version: 10.0.60905 - Microsoft Game Studios) Hidden
Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Visio 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Visio MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Outlook Hotmail Connector 64-Bit (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (x32 Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visio Premium 2010 (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Miranda IM 0.10.8 (x32 Version: 0.10.8 - Miranda IM Project)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox (3.6.27) (x32 Version: 3.6.27 (de) - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (x32 Version: 4.20.9818.0 - Microsoft Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.19.0 - NEC Electronics Corporation) Hidden
Nero 10 Menu TemplatePack Basic (x32 Version: 10.0.10600.6.0 - Nero AG) Hidden
Nero 10 Movie ThemePack Basic (x32 Version: 10.0.10600.6.0 - Nero AG) Hidden
Nero BackItUp 10 (x32 Version: 5.4.11800.21.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Burning ROM 10 (x32 Version: 10.0.11100.10.100 - Nero AG)
Nero BurningROM 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero BurnRights 10 (x32 Version: 4.0.11000.12.100 - Nero AG)
Nero BurnRights 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.0.12000.1.4 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.13700.0.1 - Nero AG) Hidden
Nero CoverDesigner 10 (x32 Version: 5.0.10900.11.100 - Nero AG)
Nero CoverDesigner 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero DiscSpeed 10 (x32 Version: 6.0.10800.7.100 - Nero AG)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero Dolby Files 10 (x32 Version: 2.0.11000.0.10 - Nero AG) Hidden
Nero Express 10 (x32 Version: 10.0.11000.10.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero InfoTool 10 (x32 Version: 7.0.10800.8.100 - Nero AG)
Nero InfoTool 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero MediaHub 10 (x32 Version: 1.0.13400.11.100 - Nero AG)
Nero MediaHub 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Multimedia Suite 10 (x32 Version: 10.0.13200 - Nero AG)
Nero Recode 10 (x32 Version: 4.6.10900.4.100 - Nero AG)
Nero Recode 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero RescueAgent 10 (x32 Version: 3.0.10900.9.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero SoundTrax 10 (x32 Version: 4.6.10600.2.100 - Nero AG)
Nero SoundTrax 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero StartSmart 10 (x32 Version: 10.0.11200.12.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 1.0.10700 - Nero AG) Hidden
Nero Update (x32 Version: 1.0.0017 - Nero AG)
Nero Vision 10 (x32 Version: 7.0.11100.8.100 - Nero AG)
Nero Vision 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
Nero WaveEditor 10 (x32 Version: 5.6.10600.2.100 - Nero AG)
Nero WaveEditor 10 Help (CHM) (x32 Version: 1.0.10600 - Nero AG) Hidden
NVIDIA 3D Vision Controller-Treiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA Display Control Panel (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (Version: 331.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3182 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)
Ontrack EasyRecovery Professional (x32 Version: 6.21.03 - Kroll Ontrack Inc.)
Ontrack EasyRecovery Professional (x32 Version: 6.21.03 - Kroll Ontrack Inc.) Hidden
Origin (x32 Version: 9.3.6.4639 - Electronic Arts, Inc.)
PanoramaStudio 1.5 (deinstallieren) (x32 Version: - )
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Portrait Professional 11.3 (x32 Version: 11.3 - Anthropics Technology Ltd.)
PunkBuster für Battlefield 1942 (x32 Version: - )
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
PxMergeModule (x32 Version: 1.00.0000 - Your Company Name) Hidden
QuickTime (x32 Version: 7.74.80.86 - Apple Inc.)
Reader for PC (x32 Version: 2.1.00.06250 - Sony Corporation)
Reader Library by Sony (x32 Version: 3.3.00.07130 - Sony)
RollerCoaster Tycoon 2 (x32 Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version: - Microsoft) Hidden
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Silver Efex Pro 2 (x32 Version: 2.0.0.0 - Nik Software, Inc.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Sound Blaster X-Fi MB (x32 Version: 1.0 - Creative Technology Limited)
StarCraft II (x32 Version: - Blizzard Entertainment)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
streamWriter (x32 Version: - )
Synology Assistant (remove only) (x32 Version: - )
TeamSpeak 3 Client (x32 Version: - TeamSpeak Systems GmbH)
The Panorama Factory V5 x64 Edition (Version: 5.0.2667 - Smoky City Design)
TomTom HOME (x32 Version: 2.9.6 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2 - TomTom International B.V.)
Topaz DeNoise 5 (64-bit) (Version: 5.0.1 - Topaz Labs) Hidden
Topaz DeNoise 5 (x32 Version: 5.0.1 - Topaz Labs) Hidden
Topaz Simplify 3 (64-bit) (Version: 3.0.2 - Topaz Labs) Hidden
Topaz Simplify 3 (x32 Version: 3.0.2 - Topaz Labs) Hidden
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 64-Bit Edition (Version: - Microsoft)
VIA Plattform-Geräte-Manager (x32 Version: 1.34 - VIA Technologies, Inc.)
VirtualCloneDrive (x32 Version: - Elaborate Bytes)
VirtualRig Studio 2.2 Pro (Version: 2.2.211 - mr.pixel Ltd.)
VLC media player 2.1.0 (x32 Version: 2.1.0 - VideoLAN)
Winamp (x32 Version: 5.61 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1 - Nullsoft, Inc)
Winamp Pro (x32 Version: 5.5.8.2975 - Nullsoft Inc.)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Family Safety (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
WinRAR Archivierer (x32 Version: - )
==================== Restore Points =========================
==================== Hosts content: ==========================
2009-07-14 03:34 - 2010-11-07 14:15 - 00002393 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 hl2rcv.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 3dns.adobe.com
127.0.0.1 3dns-1.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-4.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-1.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 adobe-dns-4.adobe.com
127.0.0.1 adobe-dns-5.adobe.com
127.0.0.1 activate.adobe.de
127.0.0.1 practivate.adobe.de
127.0.0.1 ereg.adobe.de
127.0.0.1 activate.wip3.adobe.de
127.0.0.1 wip3.adobe.de
127.0.0.1 3dns-3.adobe.de
127.0.0.1 3dns-2.adobe.de
127.0.0.1 adobe-dns.adobe.de
127.0.0.1 adobe-dns-2.adobe.de
127.0.0.1 adobe-dns-3.adobe.de
127.0.0.1 ereg.wip3.adobe.de
127.0.0.1 activate-sea.adobe.de
127.0.0.1 wwis-dubc1-vip60.adobe.de
127.0.0.1 activate-sjc0.adobe.de
127.0.0.1 hl2rcv.adobe.de
127.0.0.1 flashfxp.com
127.0.0.1 flashfxp.org
127.0.0.1 flashfxp.ws
127.0.0.1 www.flashfxp.com
127.0.0.1 www.flashfxp.org
127.0.0.1 www.flashfxp.ws
127.0.0.1 liveupdate.inicom.net/verify.php
127.0.0.1 liveupdate.inicom.net
127.0.0.1 liveupdate.flashfxp.com
127.0.0.1 update.inicom.net
127.0.0.1 update.flashfxp.com
==================== Scheduled Tasks (whitelisted) =============
Task: {23950175-DB75-4E69-ABF9-D471440C8B56} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10] (Google Inc.)
Task: {52540A4D-308E-4697-B12E-20571932CFC1} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {620F7AAD-1762-4821-B12B-C4897EC9F6B9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10] (Google Inc.)
Task: {8905D28C-B81B-40EA-BD3B-15890ACC071A} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
Task: {9DB5AB3A-C941-4646-ADA7-200406BEEA6D} - System32\Tasks\AdobeAAMUpdater-1.0-ferropolis-PC-ferropolis => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-03-21] (Adobe Systems Incorporated)
Task: {A51B63C6-E985-4261-A728-88352A6C1038} - System32\Tasks\Google Updater and Installer => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30] (Google Inc.)
Task: {B4D69961-BB4B-4E65-B737-1FF3AE13E8BC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30] (Google Inc.)
Task: {B88550CB-8908-4763-87EF-9A0E4297CE6D} - System32\Tasks\ASUS\RunDAOD => C:\Windows\DAODx.exe [2009-03-30] ()
Task: {BE006C00-6AF3-4326-A5E0-DE69BAA3FA22} - System32\Tasks\{AC6919F2-D121-4A67-801F-00AF05628091} => D:\Spiele\reflex\Simulator\REFLEX.exe
Task: {DCF3CC75-050C-479B-832F-66647AC45206} - System32\Tasks\elbyExecuteWithUAC => D:\Programme\VirtualClonedrive\ExecuteWithUAC.exe [2008-06-27] ()
Task: {F1A17B6C-7B7E-4BA8-B7A0-E9D5AA47F196} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {FD228054-F5B4-4850-9CFA-8787262C606F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-31] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1ce0f818ac57e9.job => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1cef8d292a9344c.job => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job => C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2009-08-23 18:24 - 2009-08-23 18:24 - 00098304 _____ () D:\Programme\fileziller\FileZilla FTP Client\fzshellext_64.dll
2014-01-25 18:55 - 2005-06-07 12:26 - 00043008 _____ () D:\Programme\winrar\rarext64.dll
2013-07-07 16:52 - 2013-07-07 16:52 - 00012520 _____ () C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.gadget\CoreTempReader.dll
2013-07-07 16:52 - 2013-07-07 16:52 - 00015080 _____ () C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.gadget\GetCoreTempInfoNET.dll
2013-07-07 16:52 - 2013-07-07 16:52 - 00014056 _____ () C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.gadget\SystemInfo.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-15 03:36 - 2013-02-15 03:36 - 01554496 _____ () D:\Programme\Office2010\Office14\ADDINS\UmOutlookAddin.dll
2013-08-08 20:49 - 2013-08-05 18:10 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-04-21 20:44 - 2013-04-21 20:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 20:44 - 2013-04-21 20:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-01-31 17:47 - 2014-01-31 17:47 - 00098816 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32api.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00110080 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\PyWinTypes27.dll
2014-01-31 17:47 - 2014-01-31 17:47 - 00364544 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\pythoncom27.dll
2014-01-31 17:47 - 2014-01-31 17:47 - 00044032 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_socket.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 01153024 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_ssl.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00320512 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32com.shell.shell.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00711680 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_hashlib.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 01175040 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._core_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00805888 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._gdi_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00811008 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._windows_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 01062400 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._controls_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00735232 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._misc_.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00128512 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_elementtree.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00127488 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\pyexpat.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00557056 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\pysqlite2._sqlite.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00087040 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_ctypes.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00119808 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32file.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00108544 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32security.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00018432 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32event.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00038912 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32inet.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00122368 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._wizard.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00026624 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\_multiprocessing.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00070656 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\wx._html2.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00010240 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\select.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00686080 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\unicodedata.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00025600 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32pdh.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00521680 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\windows._lib_cacheinvalidation.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00011264 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32crypt.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00024064 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32pipe.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00035840 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32process.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00017408 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32profile.pyd
2014-01-31 17:47 - 2014-01-31 17:47 - 00022528 _____ () C:\Users\ferropolis\AppData\Local\Temp\_MEI31642\win32ts.pyd
2013-06-25 17:23 - 2013-06-25 17:23 - 00880640 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\fsk.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00040264 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMediaPlayers.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00239944 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\Fskin.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00026952 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskinLocalize.dll
2013-05-23 18:54 - 2013-05-23 18:54 - 00798720 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskSecurity.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00125256 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskDocumentViewer.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00016200 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskPower.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00024904 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskNetInterface.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00017224 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskMobileMediaDevice.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00015176 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\FskTimeHardware.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00034632 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ticket.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00018760 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookDeviceNotifier.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00092488 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ebookUsb.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00149832 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\readerAppHelper.dll
2013-06-25 17:24 - 2013-06-25 17:24 - 00178504 _____ () D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\USBDetector.dll
2014-01-29 14:54 - 2014-01-23 06:56 - 00715544 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\libglesv2.dll
2014-01-29 14:54 - 2014-01-23 06:56 - 00100120 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\libegl.dll
2014-01-29 14:54 - 2014-01-23 06:56 - 04055320 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll
2014-01-29 14:54 - 2014-01-23 06:57 - 00399640 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll
2014-01-29 14:54 - 2014-01-23 06:55 - 01634584 _____ () C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\ProgramData\Microsoft:DlaFF2w9cy9j0sEdecCZ
AlternateDataStreams: C:\ProgramData\Microsoft:nC4LtXh4vLrMBKg6hBwmtf
AlternateDataStreams: C:\Users\ferropolis\Cookies:Ue6u5ikaLCkUCnDOl5RBa0An
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/31/2014 06:49:15 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
] ist ein Fehler aufgetreten.
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator
Error: (01/31/2014 06:49:15 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator
Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (01/31/2014 05:52:34 PM) (Source: System Restore) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80042302).
Error: (01/31/2014 05:52:34 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "GetProviderMgmtInterface" ist ein unerwarteter Fehler aufgetreten. hr = 0x8004230f, Unerwarteter Fehler beim Schattenkopieanbieter bei dem Versuch, den angegebenen Vorgang zu verarbeiten.
.
Error: (01/31/2014 05:52:34 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Erstellen der Schattenkopieanbieter-COM-Klasse mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
] ist ein Fehler aufgetreten.
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Anbieterverwaltungsschnittstelle wird abgerufen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {00000000-0000-0000-0000-000000000000}
Snapshotkontext: -1
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Error: (01/31/2014 05:52:34 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a} und dem Namen "SW_PROV" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Anbieterverwaltungsschnittstelle wird abgerufen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {00000000-0000-0000-0000-000000000000}
Snapshotkontext: -1
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Error: (01/29/2014 09:16:27 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
System errors:
=============
Error: (01/31/2014 05:48:55 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/31/2014 05:48:16 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PxHelp20
sptd
Error: (01/31/2014 05:47:31 PM) (Source: sptd) (User: )
Description: Der Treiber hat einen internen Fehler in seinen Datenstrukturen für festgestellt.
Error: (01/29/2014 10:31:16 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (01/29/2014 09:11:33 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/29/2014 09:10:53 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PxHelp20
sptd
Error: (01/29/2014 09:10:16 PM) (Source: sptd) (User: )
Description: Der Treiber hat einen internen Fehler in seinen Datenstrukturen für festgestellt.
Error: (01/29/2014 05:23:51 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/29/2014 05:23:10 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PxHelp20
sptd
Error: (01/29/2014 05:22:34 PM) (Source: sptd) (User: )
Description: Der Treiber hat einen internen Fehler in seinen Datenstrukturen für festgestellt.
Microsoft Office Sessions:
=========================
Error: (01/31/2014 06:49:15 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator
Error: (01/31/2014 06:49:15 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Schnittstellen für alle Anbieter auflisten, die diesen Kontext unterstützen
Schattenkopien abfragen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}
Snapshotkontext: 13
Snapshotkontext: 13
Ausführungskontext: Coordinator
Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (01/31/2014 05:53:49 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000
Error: (01/31/2014 05:52:34 PM) (Source: System Restore)(User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80042302
Error: (01/31/2014 05:52:34 PM) (Source: VSS)(User: )
Description: GetProviderMgmtInterface0x8004230f, Unerwarteter Fehler beim Schattenkopieanbieter bei dem Versuch, den angegebenen Vorgang zu verarbeiten.
Error: (01/31/2014 05:52:34 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Anbieterverwaltungsschnittstelle wird abgerufen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {00000000-0000-0000-0000-000000000000}
Snapshotkontext: -1
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Error: (01/31/2014 05:52:34 PM) (Source: VSS)(User: )
Description: {65ee1dba-8ff4-4a58-ac1c-3470ee2f376a}SW_PROV0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Vorgang:
Für diesen Anbieter eine aufrufbare Schnittstelle abrufen
Anbieterverwaltungsschnittstelle wird abgerufen
Kontext:
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Klassen-ID: {00000000-0000-0000-0000-000000000000}
Snapshotkontext: -1
Anbieter-ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
Error: (01/29/2014 09:16:27 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000
==================== Memory info ===========================
Percentage of memory in use: 26%
Total physical RAM: 16382.18 MB
Available physical RAM: 12108.8 MB
Total Pagefile: 32762.53 MB
Available Pagefile: 28187.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:59.62 GB) (Free:6.2 GB) NTFS
Drive d: (Volume) (Fixed) (Total:1397.26 GB) (Free:1169.79 GB) NTFS
Drive e: (Volume) (Fixed) (Total:1397.16 GB) (Free:1213.54 GB) NTFS
Drive m: (music) (Network) (Total:912.45 GB) (Free:279.6 GB) NTFS
Drive p: (photo) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS
Drive r: (ebooks) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS
Drive v: (video) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS
Drive z: (_unsortiert) (Network) (Total:1829.34 GB) (Free:606.4 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: 0DC92061)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-698829766656) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1397 GB) (Disk ID: 8E80E98C)
Partition 1: (Active) - (Size=-698723860480) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 60 GB) (Disk ID: 0DC92079)
Partition 1: (Active) - (Size=60 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST.TXT FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01 Ran by ferropolis (administrator) on FERROPOLIS on 31-01-2014 18:48:58 Running from D:\Eigene Datein\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe () C:\Windows\DAODx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE (Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\SysWOW64\PnkBstrA.exe (TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe () D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe (Apple Inc.) D:\Programme\itunes\iTunesHelper.exe (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corporation) D:\Programme\Office2010\Office14\OUTLOOK.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\audiodg.exe (Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.) HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.) HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated) HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKCU\...\Run: [Google Update] - C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2010-09-30] (Google Inc.) HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google) HKCU\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom) HKCU\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.) HKCU\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.) HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.) HKCU\...\Policies\system: [EnableLUA] 0 MountPoints2: {d809e191-efd9-11df-9a0f-20cf30214935} - G:\SETUP.EXE ==================== Internet (Whitelisted) ==================== ProxyServer: 183.111.12.21:8080 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935 SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935 BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default FF DefaultSearchEngine: Search the web (Babylon) FF SearchEngineOrder.1: Search the web (Babylon) FF SelectedSearchEngine: Google FF Homepage: www.google.de FF Keyword.URL: hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation) FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12] FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18] FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25] Chrome: ======= CHR HomePage: hxxp://www.aldi.com/ CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.) CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation) CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30] CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15] CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23] CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02] CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30] CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14] CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG) R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG) S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.) S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.) S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation) S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] () S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies) R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom) R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] () ==================== Drivers (Whitelisted) ==================== R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG) S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech) S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech) R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] () R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation) S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.) S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project) R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-31 18:48 - 2014-01-31 18:48 - 00000000 ___DC C:\FRST 2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-31 18:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D C:\Users\ferropolis\AppData\Local\Blizzard Entertainment 2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ C:\Windows\Minidump\010414-32105-01.dmp ==================== One Month Modified Files and Folders ======= 2014-01-31 18:48 - 2014-01-31 18:48 - 00000000 ___DC C:\FRST 2014-01-31 18:48 - 2011-10-18 19:18 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\Skype 2014-01-31 18:43 - 2010-09-30 20:33 - 00001138 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job 2014-01-31 18:28 - 2013-12-25 11:30 - 00000000 ____D C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod 2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D C:\Users\ferropolis 2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-31 18:04 - 2011-06-10 15:52 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-01-31 17:58 - 2010-10-01 19:35 - 00000000 ____D C:\Users\ferropolis\AppData\Local\Adobe 2014-01-31 17:55 - 2009-07-14 05:45 - 00023040 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-31 17:55 - 2009-07-14 05:45 - 00023040 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-31 17:53 - 2010-09-30 21:01 - 01430368 _____ C:\Windows\WindowsUpdate.log 2014-01-31 17:53 - 2009-07-14 18:58 - 05921298 _____ C:\Windows\system32\perfh007.dat 2014-01-31 17:53 - 2009-07-14 18:58 - 01777050 _____ C:\Windows\system32\perfc007.dat 2014-01-31 17:53 - 2009-07-14 06:13 - 00006508 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-31 17:52 - 2012-12-08 16:33 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-31 17:48 - 2013-05-14 19:58 - 00000000 ___RD C:\Users\ferropolis\Google Drive 2014-01-31 17:47 - 2013-09-06 17:32 - 00027663 _____ C:\Windows\setupact.log 2014-01-31 17:47 - 2011-06-10 15:52 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-01-31 17:47 - 2010-10-05 13:03 - 00000000 ____D C:\ProgramData\NVIDIA 2014-01-31 17:47 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system 2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D C:\Users\ferropolis\scans 2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D C:\Program Files (x86)\Java 2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins 2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D C:\Program Files (x86)\Google 2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D C:\Program Files (x86)\Adobe 2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D C:\Program Files\WinRAR 2014-01-25 16:48 - 2011-08-09 18:23 - 00000000 ____D C:\ProgramData\Lexware 2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D C:\Users\ferropolis\AppData\Local\Blizzard Entertainment 2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D C:\Users\ferropolis\webseiten 2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs 2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ C:\Windows\system32\FNTCACHE.DAT 2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D C:\Windows\system32\MRT 2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe 2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0 2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ C:\Windows\Minidump\010414-32105-01.dmp 2014-01-04 13:25 - 2010-12-16 17:55 - 00000000 ____D C:\Windows\Minidump 2014-01-02 19:31 - 2013-11-10 12:21 - 00000000 ____D C:\Users\ferropolis\AppData\Roaming\vlc 2014-01-01 12:28 - 2012-04-22 17:23 - 00043520 ___SH C:\Users\ferropolis\Thumbs.db Some content of TEMP: ==================== C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe C:\Users\ferropolis\AppData\Local\Temp\nvStInst.exe C:\Users\ferropolis\AppData\Local\Temp\sonarinst.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-29 15:09 ==================== End Of Log ============================ --- --- --- GMER.TXT Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-01-31 19:15:34
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP3T1L0-7 OCZ-VERTEX rev.1.6 59,63GB
Running: ycptywh9.exe; Driver: C:\Users\FERROP~1\AppData\Local\Temp\uxtiyfob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80003a04000 45 bytes [00, 00, 16, 02, 4E, 74, 66, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff80003a0402f 29 bytes [00, 01, 00, 06, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2160] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2160] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 00000000723a1a22 2 bytes [3A, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 00000000723a1ad0 2 bytes [3A, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 00000000723a1b08 2 bytes [3A, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 00000000723a1bba 2 bytes [3A, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 00000000723a1bda 2 bytes [3A, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[3276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[3276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Program Files (x86)\Google\Drive\googledrivesync.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe[3664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[3824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075581465 2 bytes [58, 75]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000755814bb 2 bytes [58, 75]
.text ... * 2
---- Processes - GMER 2.1 ----
Library C:\Users\ferropolis\AppData\Local\Microsoft\Windows Sidebar\Gadgets\networktraffic.gadget\netlib.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [3136] (NIC Information .NET Wrapper/Jonathan Abbott)(2012-11-25 12:05:57) 0000000073240000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\python27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (Python Core/Python Software Foundation)(2014-01-31 16:47:59) 000000001e000000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32api.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001e8c0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pywintypes27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 000000001e7a0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pythoncom27.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 00000000002f0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_socket.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 0000000000240000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_ssl.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 0000000010000000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32com.shell.shell.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001e800000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_hashlib.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 0000000002ec0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._core_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 0000000002f80000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxbase294u_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59) 00000000030b0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxbase294u_net_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59) 0000000000290000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_core_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59) 00000000032a0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_adv_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59) 0000000003740000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._gdi_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 0000000003980000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._windows_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 00000000042f0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_html_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59) 00000000043c0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._controls_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 00000000045f0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._misc_.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 0000000004700000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_elementtree.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001d100000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pyexpat.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 0000000002650000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\pysqlite2._sqlite.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 0000000003a50000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_ctypes.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 000000001d1a0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32file.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001ea10000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32security.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001ec80000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32event.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001e9b0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32inet.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 000000001eaa0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._wizard.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 0000000002680000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\_multiprocessing.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 0000000001f40000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wx._html2.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 00000000026b0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\wxmsw294u_webview_vc90.dll (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448] (wxWidgets for MSW/wxWidgets development team)(2014-01-31 16:47:59) 0000000005790000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\select.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 00000000057b0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\unicodedata.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 0000000005830000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32pdh.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 000000001eb60000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32crypt.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001e980000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32pipe.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 000000001eb90000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32process.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:59) 000000001ebf0000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32profile.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001ec20000
Library C:\Users\FERROP~1\AppData\Local\Temp\_MEI31642\win32ts.pyd (*** suspicious ***) @ C:\Program Files (x86)\Google\Drive\googledrivesync.exe [3448](2014-01-31 16:47:58) 000000001ed40000
Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{29ED0093-F58D-4D5C-A212-B0D7A91E95F9}\offreg.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [6372](2014-01-31 17:10:19) 000007feee4e0000
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.31.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 ferropolis :: FERROPOLIS [Administrator] 31.01.2014 18:08:30 MBAM-log-2014-01-31 (19-09-05).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 737086 Laufzeit: 1 Stunde(n), 19 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 1 HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0C1P1I1C1H1J1UtFzytH0A -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 1 HKCU\SOFTWARE\Policies\Microsoft\Windows\System|DisableCMD (PUM.Hijack.CMDPrompt) -> Bösartig: (2) Gut: (0) -> Keine Aktion durchgeführt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt. (Ende) |
|
01.02.2014, 15:52
| #4 |
| | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Sry, musste meine FRST.TXT noch mal anpassen. FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 03
Ran by ferropolis (administrator) on FERROPOLIS on 01-02-2014 15:50:47
Running from D:\Eigene Datein\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Windows\DAODx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Apple Inc.) D:\Programme\itunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.)
HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Google Update] - C:\Users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2010-09-30] (Google Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Policies\system: [EnableLUA] 0
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\MountPoints2: {d809e191-efd9-11df-9a0f-20cf30214935} - G:\SETUP.EXE
==================== Internet (Whitelisted) ====================
ProxyServer: 183.111.12.21:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&AF=100476&babsrc=SP_ss&mntrId=40ea805a00000000000020cf30214935
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default
FF DefaultSearchEngine: Search the web (Babylon)
FF SearchEngineOrder.1: Search the web (Babylon)
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25]
Chrome:
=======
CHR HomePage: hxxp://www.aldi.com/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30]
CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]
CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23]
CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02]
CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14]
CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] ()
S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies)
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom)
R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] ()
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech)
S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-31 18:48 - 2014-02-01 15:50 - 00000000 ___DC () C:\FRST
2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-31 18:08 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp
==================== One Month Modified Files and Folders =======
2014-02-01 15:50 - 2014-01-31 18:48 - 00000000 ___DC () C:\FRST
2014-02-01 15:45 - 2011-10-18 19:18 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Skype
2014-02-01 15:43 - 2010-09-30 20:33 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
2014-02-01 15:10 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-01 15:10 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-01 15:08 - 2009-07-14 18:58 - 05950382 _____ () C:\Windows\system32\perfh007.dat
2014-02-01 15:08 - 2009-07-14 18:58 - 01786086 _____ () C:\Windows\system32\perfc007.dat
2014-02-01 15:08 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-01 15:06 - 2010-09-30 21:01 - 01459750 _____ () C:\Windows\WindowsUpdate.log
2014-02-01 15:04 - 2011-06-10 15:52 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-01 15:03 - 2013-05-14 19:58 - 00000000 ___RD () C:\Users\ferropolis\Google Drive
2014-02-01 15:03 - 2011-06-10 15:52 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-01 15:02 - 2013-09-06 17:32 - 00028111 _____ () C:\Windows\setupact.log
2014-02-01 15:02 - 2010-10-05 13:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-01 15:02 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-01 08:03 - 2010-10-01 19:35 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Adobe
2014-01-31 19:52 - 2012-12-08 16:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-31 18:28 - 2013-12-25 11:30 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod
2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D () C:\Users\ferropolis
2014-01-31 18:08 - 2014-01-31 18:08 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-31 18:08 - 2014-01-31 18:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D () C:\Users\ferropolis\scans
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D () C:\Program Files\WinRAR
2014-01-25 16:48 - 2011-08-09 18:23 - 00000000 ____D () C:\ProgramData\Lexware
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D () C:\Users\ferropolis\webseiten
2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ () C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp
2014-01-04 13:25 - 2010-12-16 17:55 - 00000000 ____D () C:\Windows\Minidump
2014-01-02 19:31 - 2013-11-10 12:21 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\vlc
Some content of TEMP:
====================
C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe
C:\Users\ferropolis\AppData\Local\Temp\nvStInst.exe
C:\Users\ferropolis\AppData\Local\Temp\sonarinst.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 15:09
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- |
|
02.02.2014, 07:04
| #5 | |
| /// the machine /// TB-Ausbilder | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Suchlauf mit rKill Bitte lade dir rKill von Grinler auf deinen Desktop von einem der folgenden Links: RKill oder http://www.trojaner-board.de/85629-rkill-download.html
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.02.2014, 14:13
| #6 |
| | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem DesktopCode:
ATTFilter Rkill 2.6.5 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
hxxp://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 02/02/2014 01:51:01 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* C:\Windows\DAODx.exe (PID: 1984) [WD-HEUR]
* C:\Windows\SysWOW64\nlssrv32.exe (PID: 2216) [WD-HEUR]
2 proccesses terminated!
Checking Registry for malware related settings:
* System Policy Removed: DisableCMD [HKCU]
Backup Registry file created at:
D:\Eigene Datein\Desktop\rkill\rkill-02-02-2014-01-51-05.reg
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
* HKLM\Software\Classes\exefile\shell\open\command\\IsolatedCommand was changed. It was reset to "%1" %*!
* HKLM\Software\Classes\exefile\shell\runas\command\\IsolatedCommand was changed. It was reset to "%1" %*!
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* Cannot edit the HOSTS file.
* Permissions could not be fixed. Use Hosts-perm.bat to fix permissions: hxxp://www.bleepingcomputer.com/download/hosts-permbat/
Program finished at: 02/02/2014 01:51:15 PM
Execution time: 0 hours(s), 0 minute(s), and 14 seconds(s)
Code:
ATTFilter ComboFix 14-02-01.01 - ferropolis 02.02.2014 14:04:42.2.6 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16382.13206 [GMT 1:00]
ausgeführt von:: d:\eigene datein\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - Windows: deleted 0 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_ctypes.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_elementtree.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_hashlib.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_multiprocessing.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_socket.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_ssl.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pyexpat.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pysqlite2._sqlite.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\python27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pythoncom27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\PyWinTypes27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\select.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\unicodedata.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32api.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32com.shell.shell.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32crypt.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32event.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32file.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32inet.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32pdh.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32pipe.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32process.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32profile.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32security.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32ts.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\windows._lib_cacheinvalidation.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._controls_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._core_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._gdi_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._html2.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._misc_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._windows_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._wizard.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxbase294u_net_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxbase294u_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_adv_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_core_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_html_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_webview_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_ctypes.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_elementtree.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_hashlib.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_multiprocessing.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_socket.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_ssl.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pyexpat.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pysqlite2._sqlite.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\python27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pythoncom27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\PyWinTypes27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\select.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\unicodedata.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32api.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32com.shell.shell.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32crypt.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32event.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32file.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32inet.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32pdh.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32pipe.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32process.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32profile.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32security.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32ts.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\windows._lib_cacheinvalidation.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._controls_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._core_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._gdi_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._html2.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._misc_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._windows_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._wizard.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxbase294u_net_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxbase294u_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_adv_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_core_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_html_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_webview_vc90.dll
.
---- Vorheriger Suchlauf -------
.
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_ctypes.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_elementtree.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_hashlib.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_multiprocessing.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_socket.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_ssl.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pyexpat.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pysqlite2._sqlite.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\python27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pythoncom27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\PyWinTypes27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\select.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\unicodedata.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32api.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32com.shell.shell.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32crypt.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32event.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32file.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32inet.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32pdh.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32pipe.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32process.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32profile.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32security.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32ts.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\windows._lib_cacheinvalidation.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._controls_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._core_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._gdi_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._html2.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._misc_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._windows_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._wizard.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxbase294u_net_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxbase294u_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_adv_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_core_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_html_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_webview_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_ctypes.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_elementtree.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_hashlib.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_multiprocessing.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_socket.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_ssl.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pyexpat.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pysqlite2._sqlite.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\python27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pythoncom27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\PyWinTypes27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\select.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\unicodedata.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32api.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32com.shell.shell.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32crypt.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32event.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32file.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32inet.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32pdh.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32pipe.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32process.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32profile.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32security.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32ts.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\windows._lib_cacheinvalidation.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._controls_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._core_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._gdi_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._html2.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._misc_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._windows_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._wizard.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxbase294u_net_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxbase294u_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_adv_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_core_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_html_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_webview_vc90.dll
c:\windows\AutoRun.ini
c:\windows\IsUn0407.exe
c:\windows\iun6002.exe
c:\windows\SysWow64\tmp2240.tmp
c:\windows\SysWow64\tmp2260.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-02 bis 2014-02-02 ))))))))))))))))))))))))))))))
.
.
2014-02-02 13:08 . 2014-02-02 13:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-31 17:48 . 2014-02-01 14:51 -------- dc----w- C:\FRST
2014-01-31 16:52 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{29ED0093-F58D-4D5C-A212-B0D7A91E95F9}\mpengine.dll
2014-01-22 19:02 . 2014-01-22 19:02 -------- d-----w- c:\users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 17:41 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 17:41 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 17:41 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 17:41 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 17:41 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 17:41 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 17:41 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 17:41 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-15 17:41 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-31 16:49 . 2012-05-20 17:02 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-31 16:49 . 2012-03-11 08:38 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-15 19:29 . 2010-10-17 08:59 86054176 ----a-w- c:\windows\system32\MRT.exe
2014-01-12 13:42 . 2010-10-05 17:24 214392 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-01-06 19:04 . 2010-10-05 17:24 214392 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-12-21 15:20 . 2010-10-05 17:24 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-12-19 17:01 . 2013-08-08 19:50 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-19 17:01 . 2013-08-08 19:49 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-19 17:01 . 2013-08-08 19:49 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-18 05:13 . 2010-09-30 19:33 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-10 02:13 . 2013-12-22 13:52 982232 ----a-w- c:\windows\SysWow64\nvspcap.dll
2013-12-10 02:13 . 2013-12-22 13:52 1100248 ----a-w- c:\windows\system32\nvspcap64.dll
2013-12-05 08:42 . 2013-12-22 13:53 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2013-12-05 08:42 . 2013-12-22 13:53 32544 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2013-12-05 08:42 . 2013-12-22 13:50 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-12-04 09:43 . 2013-12-04 09:43 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-04 09:43 . 2013-12-04 09:43 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-04 09:43 . 2013-12-04 09:43 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-04 09:43 . 2013-12-04 09:43 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-04 09:43 . 2013-12-04 09:43 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-04 09:43 . 2013-12-04 09:43 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-12-04 09:43 . 2013-12-04 09:43 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-04 09:43 . 2013-12-04 09:43 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-04 09:43 . 2013-12-04 09:43 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-04 09:43 . 2013-12-04 09:43 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-04 09:43 . 2013-12-04 09:43 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-04 09:43 . 2013-12-04 09:43 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-04 09:43 . 2013-12-04 09:43 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-04 09:43 . 2013-12-04 09:43 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-04 09:43 . 2013-12-04 09:43 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-04 09:43 . 2013-12-04 09:43 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-04 09:43 . 2013-12-04 09:43 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-04 09:43 . 2013-12-04 09:43 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-04 09:43 . 2013-12-04 09:43 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-04 09:43 . 2013-12-04 09:43 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-04 09:43 . 2013-12-04 09:43 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-04 09:43 . 2013-12-04 09:43 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-12-04 09:43 . 2013-12-04 09:43 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-04 09:43 . 2013-12-04 09:43 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-04 09:43 . 2013-12-04 09:43 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-12-04 09:43 . 2013-12-04 09:43 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-04 09:43 . 2013-12-04 09:43 413696 ----a-w- c:\windows\system32\html.iec
2013-12-04 09:43 . 2013-12-04 09:43 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-04 09:43 . 2013-12-04 09:43 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-04 09:43 . 2013-12-04 09:43 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-04 09:43 . 2013-12-04 09:43 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-04 09:43 . 2013-12-04 09:43 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-04 09:43 . 2013-12-04 09:43 235520 ----a-w- c:\windows\system32\url.dll
2013-12-04 09:43 . 2013-12-04 09:43 195584 ----a-w- c:\windows\system32\msrating.dll
2013-12-04 09:43 . 2013-12-04 09:43 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-04 09:43 . 2013-12-04 09:43 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-04 09:43 . 2013-12-04 09:43 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-04 09:43 . 2013-12-04 09:43 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-04 09:43 . 2013-12-04 09:43 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-04 09:43 . 2013-12-04 09:43 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-04 09:43 . 2013-12-04 09:43 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-12-04 09:43 . 2013-12-04 09:43 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-04 09:43 . 2013-12-04 09:43 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-04 09:43 . 2013-12-04 09:43 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-04 09:43 . 2013-12-04 09:43 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-04 09:43 . 2013-12-04 09:43 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-04 09:43 . 2013-12-04 09:43 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-04 09:43 . 2013-12-04 09:43 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-12-04 09:43 . 2013-12-04 09:43 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-04 09:43 . 2013-12-04 09:43 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-12-04 09:43 . 2013-12-04 09:43 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-04 09:43 . 2013-12-04 09:43 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-04 09:43 . 2013-12-04 09:43 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-04 09:43 . 2013-12-04 09:43 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-04 09:43 . 2013-12-04 09:43 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-04 09:43 . 2013-12-04 09:43 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-04 09:43 . 2013-12-04 09:43 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-04 09:43 . 2013-12-04 09:43 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-12-04 09:43 . 2013-12-04 09:43 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-26 18:15 . 2013-08-08 19:49 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-11-26 11:54 . 2013-12-12 16:33 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 16:33 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 16:33 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 16:33 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 16:33 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 16:33 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 16:33 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 16:33 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 16:33 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 16:33 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 16:33 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 16:33 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 16:33 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 16:33 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 16:33 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 16:33 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 16:33 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 16:33 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 16:33 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 16:33 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 16:33 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-12 16:33 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-12 16:33 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-12 16:33 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-12 15:44 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-12-11 16:41 220632 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-12-11 16:41 220632 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-12-11 16:41 220632 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-12-06 20203904]
"TomTomHOME.exe"="d:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2013-07-02 248208]
"Skype"="d:\programme\skype\Phone\Skype.exe" [2013-11-14 20584608]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-19 684600]
"Reader Application Helper"="d:\program files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2013-06-25 899400]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="d:\programme\itunes\iTunesHelper.exe" [2013-11-01 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
"EnableLUA"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 FMS;Flash Media Server (FMS);d:\programme\adobe flash media server4\FMSMaster.exe;d:\programme\adobe flash media server4\FMSMaster.exe [x]
R3 FMSAdmin;Flash Media Administration Server;d:\programme\adobe flash media server4\FMSAdmin.exe;d:\programme\adobe flash media server4\FMSAdmin.exe [x]
R3 FMSHttpd;FMSHttpd;d:\programme\adobe flash media server4\Apache2.2\bin\httpd.exe;d:\programme\adobe flash media server4\Apache2.2\bin\httpd.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LADF_BakerCOnly;BakerC Filter Driver;c:\windows\system32\DRIVERS\ladfBakerCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfBakerCamd64.sys [x]
R3 LADF_BakerROnly;BakerR Filter Driver;c:\windows\system32\DRIVERS\ladfBakerRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfBakerRamd64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys;c:\windows\SYSNATIVE\DRIVERS\tapoas.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 DevoloNetworkService;devolo Network Service;d:\programme\devolo\dlan\devolonetsvc.exe;d:\programme\devolo\dlan\devolonetsvc.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\sysWOW64\drivers\npf_devolo.sys;c:\windows\sysWOW64\drivers\npf_devolo.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 SkypeUpdate;Skype Updater;d:\programme\skype\Updater\Updater.exe;d:\programme\skype\Updater\Updater.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;d:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;d:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 UsbClientService;UsbClientService;d:\program files (x86)\Synology\Assistant\UsbClientService.exe;d:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 LADF_CaptureOnly;LADF Capture Filter Driver;c:\windows\system32\DRIVERS\ladfGSCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSCamd64.sys [x]
S3 LADF_RenderOnly;LADF Render Filter Driver;c:\windows\system32\DRIVERS\ladfGSRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSRamd64.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\Drivers\LGPBTDD.sys;c:\windows\SYSNATIVE\Drivers\LGPBTDD.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
S3 VMfilt;VMfilt;c:\windows\system32\drivers\VMfilt64.sys;c:\windows\SYSNATIVE\drivers\VMfilt64.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 16:49]
.
2014-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10 14:52]
.
2014-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10 14:52]
.
2013-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1ce0f818ac57e9.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
2013-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1cef8d292a9344c.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
2014-02-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-12-11 16:41 244696 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-12-11 16:41 244696 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-12-11 16:41 244696 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="d:\programme\SetPoint_6.20\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2012-07-24 6900024]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-03-21 472992]
"BCSSync"="d:\programme\Office2010\Office14\BCSSync.exe" [2012-11-05 108144]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-14 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 183.111.12.21:8080
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: NameServer = 192.168.2.1
FF - ProfilePath - c:\users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
FF - Ext: Adobe Contribute Toolbar: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9} - d:\programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF - Ext: Adobe Acrobat - Create PDF: web2pdfextension@web2pdf.adobedotcom - d:\programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-ANNO 1602 Königs-Edition - c:\windows\IsUn0407.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-DesertCombat - c:\windows\iun6002.exe
AddRemove-{8A1EBF29-7CF8-471E-B90B-95FF36AC8248} - c:\programdata\{89E2929F-C967-49CB-9FE3-FD86B97312FE}\simplify3_setup.exe
AddRemove-{8A551628-20DB-4A9C-A172-572689456C44} - c:\programdata\{5D041186-ED95-4AA8-B0C6-2378CD198955}\MAX!_Setup.exe
AddRemove-{9E82D1DB-3AFB-4D18-A221-081F1B4B4789} - c:\programdata\{54AE07EB-BBE5-4429-9DF3-C156DB112B54}\denoise5_setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{517BDDE4-E3A7-4570-B21E-2B52B6139FC7}"=hex:51,66,7a,6c,4c,1d,38,12,8a,de,68,
55,95,ad,1e,00,cd,08,68,12,b3,4d,db,d3
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90,
43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87
"{074C1DC5-9320-4A9A-947D-C042949C6216}"=hex:51,66,7a,6c,4c,1d,38,12,ab,1e,5f,
03,12,dd,f4,0f,eb,6b,83,02,91,c2,26,02
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f,
aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{F4971EE7-DAA0-4053-9964-665D8EE6A077}"=hex:51,66,7a,6c,4c,1d,38,12,89,1d,84,
f0,92,94,3d,05,e6,72,25,1d,8b,b8,e4,63
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:ef,d3,d8,ba,fc,cb,ce,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7d,ef,43,95,70,72,a7,4e,ae,86,a2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7d,ef,43,95,70,72,a7,4e,ae,86,a2,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:06,8f,a0,81,4f,8b,e0,7c,e8,d4,d1,6c,df,3f,fb,d9,df,cc,87,2b,13,
59,b2,ff,4f,df,79,6d,c0,84,8e,58,84,ef,2d,fd,1b,d3,3d,40,c4,76,0e,ca,1c,3a,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:06,8f,a0,81,4f,8b,e0,7c,e8,d4,d1,6c,df,3f,fb,d9,df,cc,87,2b,13,
59,b2,ff,4f,df,79,6d,c0,84,8e,58,3d,91,0b,90,2c,a3,e6,b5,c4,76,0e,ca,1c,3a,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\DAODx.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files\Logitech Gaming Software\Applets\LCDMedia.exe
c:\program files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
c:\program files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-02-02 14:11:49 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-02-02 13:11
.
Vor Suchlauf: 8.394.231.808 Bytes frei
Nach Suchlauf: 8.384.692.224 Bytes frei
.
- - End Of File - - 5BBBEC82AFDA9C70969C80E63ACDB7C5
A36C5E4F47E84449FF07ED3517B43A31
|
|
03.02.2014, 13:17
| #7 |
| /// the machine /// TB-Ausbilder | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.02.2014, 17:39
| #8 |
| | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem DesktopCode:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.03.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 ferropolis :: FERROPOLIS [Administrator] 03.02.2014 17:14:27 mbam-log-2014-02-03 (17-14-27).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 244375 Laufzeit: 3 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 1 HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0C1P1I1C1H1J1UtFzytH0A -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Windows\KMService.exe (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 03/02/2014 um 17:26:46
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : ferropolis - FERROPOLIS
# Gestartet von : D:\Eigene Datein\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\ferropolis\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\ferropolis\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\ferropolis\AppData\Roaming\Babylon
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\.autoreg
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Babylon
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v3.6.27 (de)
[ Datei : C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\prefs.js ]
Zeile gelöscht : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Zeile gelöscht : user_pref("browser.search.order.1", "Search the web (Babylon)");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=100476");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", 4);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltSrch", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.hmpg", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.id", "40ea805a00000000000020cf30214935");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15298");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.keyWordUrl", "hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 4);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.4.35.1017:09:20");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "3.6");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.newTab", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.propectorlck", 77384646);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkDS", 1);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.srchPrvdr", "Search the web (Babylon)");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "tb9");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.4.35.10");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.4.35.1017:09:20");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=");
-\\ Google Chrome v
[ Datei : C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [5437 octets] - [03/02/2014 17:23:48]
AdwCleaner[S0].txt - [5178 octets] - [03/02/2014 17:26:46]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5238 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by ferropolis on 03.02.2014 at 17:34:35,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\caphyon
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.02.2014 at 17:36:26,85
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 04
Ran by ferropolis (administrator) on FERROPOLIS on 03-02-2014 17:37:16
Running from D:\Eigene Datein\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\DAODx.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Apple Inc.) D:\Programme\itunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Farbar) D:\Eigene Datein\Downloads\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.)
HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Policies\system: [EnableLUA] 0
==================== Internet (Whitelisted) ====================
ProxyServer: 183.111.12.21:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25]
Chrome:
=======
CHR HomePage: hxxp://www.aldi.com/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30]
CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]
CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23]
CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02]
CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14]
CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] ()
S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies)
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom)
R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] ()
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech)
S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:23 - 2014-02-03 17:26 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:07 - 2014-02-03 17:07 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-03 17:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 13:53 - 2014-02-02 14:11 - 00000000 ___DC () C:\Qoobox
2014-02-02 13:53 - 2014-02-02 14:00 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 13:53 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-02 13:53 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-02 13:53 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-01-31 18:48 - 2014-02-03 17:37 - 00000000 ___DC () C:\FRST
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp
==================== One Month Modified Files and Folders =======
2014-02-03 17:37 - 2014-01-31 18:48 - 00000000 ___DC () C:\FRST
2014-02-03 17:35 - 2011-10-18 19:18 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Skype
2014-02-03 17:34 - 2013-09-06 17:32 - 00030071 _____ () C:\Windows\setupact.log
2014-02-03 17:34 - 2013-05-14 19:58 - 00000000 ___RD () C:\Users\ferropolis\Google Drive
2014-02-03 17:34 - 2011-06-10 15:52 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-03 17:34 - 2010-10-05 13:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-03 17:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-03 17:33 - 2010-09-30 21:01 - 01564785 _____ () C:\Windows\WindowsUpdate.log
2014-02-03 17:33 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-03 17:33 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:26 - 2014-02-03 17:23 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:26 - 2011-02-03 21:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-03 17:21 - 2013-03-31 16:29 - 00072912 _____ () C:\Windows\PFRO.log
2014-02-03 17:15 - 2011-08-09 18:23 - 00000000 ____D () C:\ProgramData\Lexware
2014-02-03 17:11 - 2010-10-01 19:35 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Adobe
2014-02-03 17:07 - 2014-02-03 17:07 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-03 17:07 - 2009-07-14 18:58 - 06008550 _____ () C:\Windows\system32\perfh007.dat
2014-02-03 17:07 - 2009-07-14 18:58 - 01804158 _____ () C:\Windows\system32\perfc007.dat
2014-02-03 17:07 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-03 17:04 - 2011-06-10 15:52 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-02 16:43 - 2010-09-30 20:33 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
2014-02-02 15:52 - 2012-12-08 16:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 14:11 - 2014-02-02 13:53 - 00000000 ___DC () C:\Qoobox
2014-02-02 14:10 - 2009-07-14 03:34 - 00000215 ____C () C:\Windows\system.ini
2014-02-02 14:00 - 2014-02-02 13:53 - 00000000 ____D () C:\Windows\erdnt
2014-01-31 18:28 - 2013-12-25 11:30 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod
2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D () C:\Users\ferropolis
2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D () C:\Users\ferropolis\scans
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D () C:\Program Files\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D () C:\Users\ferropolis\webseiten
2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ () C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-04 13:25 - 2014-01-04 13:25 - 00292504 _____ () C:\Windows\Minidump\010414-32105-01.dmp
2014-01-04 13:25 - 2010-12-16 17:55 - 00000000 ____D () C:\Windows\Minidump
Some content of TEMP:
====================
C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe
C:\Users\ferropolis\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 15:09
==================== End Of Log ============================
|
|
04.02.2014, 11:58
| #9 |
| /// the machine /// TB-Ausbilder | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem DesktopESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.02.2014, 19:28
| #10 |
| | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Nein, Problem habe ich schon lange nicht...  Kann man denn irgend wodran fest machen was ich falsch gemacht habe oder woher das gekommen ist? Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b374ab42d71808498f0b5f52e3f5c661
# engine=16937
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-04 09:17:49
# local_time=2014-02-04 10:17:49 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 15770 162219974 8550 0
# compatibility_mode=5893 16776573 100 94 12080 143178519 0 0
# scanned=602493
# found=0
# cleaned=0
# scan_time=9912
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 JavaFX 2.1.1 Java version out of Date! Adobe Flash Player 12.0.0.43 Flash Player out of Date! Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (3.6.27) Firefox out of Date! Google Chrome 32.0.1700.102 Google Chrome 32.0.1700.107 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2014
Ran by ferropolis (administrator) on FERROPOLIS on 05-02-2014 19:26:40
Running from D:\Eigene Datein\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(devolo AG) D:\Programme\devolo\dlan\devolonetsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\MDM.EXE
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
() C:\Windows\DAODx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(TomTom) D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) D:\Programme\skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Sony Corporation) D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Apple Inc.) D:\Programme\itunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech, Inc.) D:\Programme\SetPoint_6.20\SetPointG\SetPointII.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Google Inc.) C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
() D:\Eigene Datein\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Farbar) D:\Eigene Datein\Downloads\FRST64 (2).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [EvtMgr6] - D:\Programme\SetPoint_6.20\SetPointP\SetPoint.exe [1680976 2010-10-29] (Logitech, Inc.)
HKLM\...\Run: [Launch LCore] - C:\Program Files\Logitech Gaming Software\LCore.exe [6900024 2012-07-24] (Logitech Inc.)
HKLM\...\Run: [Start WingMan Profiler] - C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BCSSync] - D:\Programme\Office2010\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Reader Application Helper] - D:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-06-25] (Sony Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\Programme\itunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20203904 2013-12-06] (Google)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [TomTomHOME.exe] - D:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-07-02] (TomTom)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [Skype] - D:\Programme\skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-398553616-2761322092-620628992-1000\...\Policies\system: [EnableLUA] 0
==================== Internet (Whitelisted) ====================
ProxyServer: 183.111.12.21:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x50F06B3E11DCCB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programme\Office2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programme\Office2010\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: [NameServer]192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - D:\PROGRA~1\OFFICE~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\Programme\itunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/esnlaunch,version=1.102.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.11.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @sony.com/eBookLibrary - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
FF Plugin-x32: @sony.com/ReaderDesktop - D:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.3 - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
FF Plugin-x32: Adobe Acrobat - D:\Programme\adobe acrobat X Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - D:\Programme\Adobe\reader\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\ferropolis\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firebug - C:\Users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\Extensions\firebug@software.joehewitt.com [2012-02-19]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-05-12]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-12]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - D:\Programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010-10-18]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - D:\Programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn [2011-06-25]
Chrome:
=======
CHR HomePage: hxxp://www.aldi.com/
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (WacomTabletPlugin) - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Plugin: ( Wacom Dynamic Link Library) - C:\Program Files (x86)\TabletPlugins\npwacom.dll No File
CHR Plugin: (Reader Library) - D:\Programme\ereader\Data\bin\npebldetectmoz.dll (Sony Corporation)
CHR Extension: (Angry Birds) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2011-10-30]
CHR Extension: (Google Drive) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-15]
CHR Extension: (Stealthy) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ieaebnkibonmpbhdaanjkmedikadnoje [2013-06-23]
CHR Extension: (Yulia Brodskaya) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2013-06-02]
CHR Extension: (Google Wallet) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Google Reader) - C:\Users\ferropolis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjhlfkghdhmijklfnahfkpgmhcmfgcm [2012-10-30]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\FERROP~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-14]
CHR StartMenuInternet: Google Chrome - C:\Users\ferropolis\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-26] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-19] (Avira Operations GmbH & Co. KG)
R2 DevoloNetworkService; D:\Programme\devolo\dlan\devolonetsvc.exe [3128856 2012-02-28] (devolo AG)
S3 FMS; D:\Programme\adobe flash media server4\FMSMaster.exe [4693504 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSAdmin; D:\Programme\adobe flash media server4\FMSAdmin.exe [5706240 2010-08-20] (Adobe Systems Incorporated.)
S3 FMSHttpd; D:\Programme\adobe flash media server4\Apache2.2\bin\httpd.exe [24645 2010-08-19] (Apache Software Foundation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; D:\Programme\Office2010\Office14\GROOVE.EXE [50921648 2013-03-09] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-21] ()
S2 SkypeUpdate; D:\Programme\skype\Updater\Updater.exe [171680 2013-09-05] (Skype Technologies)
R2 TomTomHOMEService; D:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072 2013-07-02] (TomTom)
R2 UsbClientService; D:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [245760 2011-02-18] ()
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 LADF_BakerCOnly; C:\Windows\System32\DRIVERS\ladfBakerCamd64.sys [363096 2010-07-08] (Logitech)
S3 LADF_BakerROnly; C:\Windows\System32\DRIVERS\ladfBakerRamd64.sys [334552 2010-07-08] (Logitech)
R3 LGPBTDD; C:\Windows\System32\Drivers\LGPBTDD.sys [30728 2009-07-01] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2012-01-31] (CACE Technologies)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHelp20; C:\Windows\SysWOW64\Drivers\PxHelp20.sys [44944 2009-04-28] (Sonic Solutions)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2010-11-14] (Duplex Secure Ltd.)
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
R3 VMfilt; C:\Windows\System32\drivers\VMfilt64.sys [25600 2009-07-31] (Creative Technology Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-04 21:39 - 2014-02-04 21:39 - 00000144 _____ () C:\Windows\Pcfk32.INI
2014-02-04 19:24 - 2014-02-04 19:24 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:23 - 2014-02-03 17:26 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-03 17:07 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 13:53 - 2014-02-02 14:11 - 00000000 ___DC () C:\Qoobox
2014-02-02 13:53 - 2014-02-02 14:00 - 00000000 ____D () C:\Windows\erdnt
2014-02-02 13:53 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-02 13:53 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-02 13:53 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-02 13:53 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-01-31 18:48 - 2014-02-05 19:26 - 00000000 ___DC () C:\FRST
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 18:41 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 18:41 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 18:41 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 18:41 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
2014-02-05 19:26 - 2014-01-31 18:48 - 00000000 ___DC () C:\FRST
2014-02-05 19:23 - 2011-10-18 19:18 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Skype
2014-02-05 19:18 - 2010-10-01 19:35 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Adobe
2014-02-05 19:16 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-05 19:16 - 2009-07-14 05:45 - 00023040 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-05 19:13 - 2009-07-14 18:58 - 06052176 _____ () C:\Windows\system32\perfh007.dat
2014-02-05 19:13 - 2009-07-14 18:58 - 01817712 _____ () C:\Windows\system32\perfc007.dat
2014-02-05 19:13 - 2009-07-14 06:13 - 00006508 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-05 19:11 - 2010-09-30 21:01 - 01625813 _____ () C:\Windows\WindowsUpdate.log
2014-02-05 19:08 - 2013-05-14 19:58 - 00000000 ___RD () C:\Users\ferropolis\Google Drive
2014-02-05 19:07 - 2013-09-06 17:32 - 00030519 _____ () C:\Windows\setupact.log
2014-02-05 19:07 - 2011-06-10 15:52 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-05 19:07 - 2010-10-05 13:03 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-05 19:07 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-04 22:04 - 2011-06-10 15:52 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-04 21:52 - 2012-12-08 16:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-04 21:43 - 2010-09-30 20:33 - 00001138 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
2014-02-04 21:40 - 2011-08-09 18:23 - 00000000 ____D () C:\ProgramData\Lexware
2014-02-04 21:39 - 2014-02-04 21:39 - 00000144 _____ () C:\Windows\Pcfk32.INI
2014-02-04 19:34 - 2013-06-26 19:08 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Audible
2014-02-04 19:24 - 2014-02-04 19:24 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-02-03 18:32 - 2013-12-25 11:30 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\3A8434C7-EF7B-40BD-A0C4-4D41B304A44C.aplzod
2014-02-03 17:49 - 2010-10-18 17:15 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2014-02-03 17:30 - 2014-02-03 17:30 - 00000000 ____D () C:\Windows\ERUNT
2014-02-03 17:26 - 2014-02-03 17:23 - 00000000 ___DC () C:\AdwCleaner
2014-02-03 17:26 - 2011-02-03 21:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-03 17:21 - 2013-03-31 16:29 - 00072912 _____ () C:\Windows\PFRO.log
2014-02-03 17:07 - 2014-02-03 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-02 14:11 - 2014-02-02 14:11 - 00048394 ____C () C:\ComboFix.txt
2014-02-02 14:11 - 2014-02-02 13:53 - 00000000 ___DC () C:\Qoobox
2014-02-02 14:10 - 2009-07-14 03:34 - 00000215 ____C () C:\Windows\system.ini
2014-02-02 14:00 - 2014-02-02 13:53 - 00000000 ____D () C:\Windows\erdnt
2014-01-31 18:11 - 2010-09-30 21:01 - 00000000 ____D () C:\Users\ferropolis
2014-01-31 17:49 - 2012-12-08 16:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-31 17:49 - 2012-05-20 18:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-31 17:49 - 2012-03-11 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 19:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system
2014-01-29 17:05 - 2011-04-30 13:22 - 00000000 ____D () C:\Users\ferropolis\scans
2014-01-25 18:55 - 2014-01-25 18:55 - 00000000 ____D () C:\Users\ferropolis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-25 18:52 - 2010-11-04 18:56 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-25 18:51 - 2011-10-26 17:58 - 00000000 ____D () C:\Program Files (x86)\Battlelog Web Plugins
2014-01-25 18:50 - 2011-06-10 15:52 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-25 18:50 - 2010-10-18 17:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-01-25 18:46 - 2010-10-13 17:50 - 00000000 ____D () C:\Program Files\WinRAR
2014-01-22 20:02 - 2014-01-22 20:02 - 00000000 ____D () C:\Users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-22 17:59 - 2010-10-16 17:53 - 00000000 ____D () C:\Users\ferropolis\webseiten
2014-01-22 17:52 - 2010-11-07 14:43 - 00000132 _____ () C:\Users\ferropolis\AppData\Roaming\Adobe PNG Format CS5 Prefs
2014-01-16 17:26 - 2009-07-14 05:45 - 05289680 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-15 20:30 - 2013-07-30 19:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 20:29 - 2010-10-17 09:59 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-12 14:42 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-06 20:04 - 2010-10-05 18:24 - 00214392 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
Some content of TEMP:
====================
C:\Users\ferropolis\AppData\Local\Temp\avgnt.exe
C:\Users\ferropolis\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 15:09
==================== End Of Log ============================
|
|
06.02.2014, 14:27
| #11 |
| /// the machine /// TB-Ausbilder | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Java, Adobe und Firefox updaten. Nachvollziehen kann man das nicht. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ProxyServer: 183.111.12.21:8080
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.02.2014, 17:47
| #12 |
| | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Hallo vielen Dank für deine wirklich tolle Hilfe - es scheint wieder alles zu funktionieren. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 07-02-2014
Ran by ferropolis at 2014-02-07 17:47:07 Run:1
Running from D:\Eigene Datein\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
ProxyServer: 183.111.12.21:8080
*****************
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
==== End of Fixlog ====
Geändert von ferropolis (07.02.2014 um 18:01 Uhr) |
|
08.02.2014, 13:16
| #13 |
| /// the machine /// TB-Ausbilder | Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Taskmanager verschwunden, Systemregistry durch Admin gesperrt, mcafee Link auf dem Desktop |
| administrator, anhang, bessere, desktop, einfach, entfernen, ergebnisse, gesucht, internet, manager, mcafee, nicht öffnen, programme, prüfen, pum.hijack.cmdprompt, pup.optional.installcore.a, riskware.tool.ck, schnell, seite, systemsteuerung, task manager, taskmanager, verschwunden, öffnen |
Linear-Darstellung
