![]() |
|
Log-Analyse und Auswertung: Windows 7: Norton meldet Fake App Attack Absturz Mozilla FirefoxWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
![]() | ![]() Windows 7: Norton meldet Fake App Attack Absturz Mozilla Firefox Seit heute Morgen tritt diese Meldung bei mir auf. Ich ließ Malwarebytes prüfen mit folgenden Ergebnis: Code:
ATTFilter Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2014.01.28.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.11.9600.16428 Tobias :: ADMIN-NOTE [limitiert] 04.02.2014 11:29:12 mbam-log-2014-02-04 (11-29-12).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 169080 Laufzeit: 5 Minute(n), 43 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 3 HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Löschen bei Neustart. HKCU\Software\AppDataLow\SProtector (PUP.Optional.SProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 4 C:\ProgramData\BrowserDefender\2.6.1519.190 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. Infizierte Dateien: 16 C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.settings (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\dm (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23 (PUP.Optional.BrowserDefender.A) -> Löschen bei Neustart. (Ende) Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 23:05 on 04/02/2014 (Admin) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014 Ran by Tobias (ATTENTION: The logged in user is not administrator) on ADMIN-NOTE on 04-02-2014 23:08:13 Running from C:\Users\Tobias\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH) C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Nero AG) C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\NDSTray.exe (APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\ConfigFree\CFSwMgr.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.) HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] () HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation) HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation) HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [913720 2010-03-03] (TOSHIBA Corporation) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated) HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation) HKLM\...\Run: [TosNC] - C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-03-19] (TOSHIBA Corporation) HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-02-11] (Toshiba Europe GmbH) HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation) HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-02-12] (Toshiba Europe GmbH) HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2327952 2010-07-21] (Microsoft Corporation) HKLM-x32\...\Run: [NBAgent] - c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe [1086760 2010-03-09] (Nero AG) HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] () HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2013-12-31] (APN) HKLM-x32\...\Run: [Malwarebytes' Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [462408 2012-04-04] (Malwarebytes Corporation) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000} HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196} HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196} HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install HKLM\...\RunOnce: [*Restore] - C:\Windows\System32\rstrui.exe /runonce [296960 2010-11-20] (Microsoft Corporation) HKLM-x32\...\RunOnce: [SymInstallStub] - C:\Windows\SysWOW64\Macromed\Shockwave 10\syminstallstub.exe /partnerid=adobe /productlist=nss /staging=false /debug /delay=5 /tasktries=3 [292216 2011-01-08] (Symantec Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1082440 2012-04-04] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\.DEFAULT\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA) HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-20] (Microsoft Corporation) HKU\S-1-5-21-176169321-845563713-2792472606-1003\...\Run: [UpgradeHelper] - C:\Users\Tobias\AppData\Roaming\Google Inc.\{470311D2-9BBF-4E5C-890D-0841527B651F}\UpgradeHelper.exe HKU\S-1-5-21-176169321-845563713-2792472606-1003\...\MountPoints2: {d132b0e8-6262-11e3-a7a0-00266c74b65e} - F:\LGAutoRun.exe HKU\S-1-5-21-176169321-845563713-2792472606-1003\...\MountPoints2: {e8bca121-17e0-11e0-902c-00266c74b65e} - F:\USBAutoRun.exe AppInit_DLLs-x32: c:\progra~2\browse~1\sprote~1.dll => C:\Program Files (x86)\BrowseToSave\sprotector.dll [1050112 2013-01-24] () Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\Toshiba\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - DefaultScope {61293CF1-723B-4B6B-9C42-8245644A46CB} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2 SearchScopes: HKCU - {496450EA-59A2-4DCE-9D2A-50503357039B} URL = SearchScopes: HKCU - {61293CF1-723B-4B6B-9C42-8245644A46CB} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2 SearchScopes: HKCU - {D1D6F39C-487B-4E03-A4D4-5E969109FB1D} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Tobias\AppData\Roaming\Mozilla\Firefox\C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-176169321-845563713-2792472606-1003\FireFox FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.) FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Computer, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Computer, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Computer, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Computer, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Computer, Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2 [2012-05-14] FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2012-05-14] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-07-26] FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [] FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ [] FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFF [2013-10-09] FF HKLM-x32\...\Firefox\Extensions: [jid0-1wPBLrijxGVkIUhu0kFYq6ZaWzA@jetpack] - C:\Program Files (x86)\AntiBrowserSpy\Addons\Firefox FF Extension: AntiBrowserSpy - SocialBlocker - C:\Program Files (x86)\AntiBrowserSpy\Addons\Firefox [2013-11-17] FF HKCU\...\Firefox\Extensions: [{CCD0EDBB-30D0-4730-B073-7ECC4AC82C6F}] - C:\Users\Tobias\AppData\Local\{CCD0EDBB-30D0-4730-B073-7ECC4AC82C6F} FF Extension: No Name - C:\Users\Tobias\AppData\Local\{CCD0EDBB-30D0-4730-B073-7ECC4AC82C6F} [2011-05-20] ==================== Services (Whitelisted) ================= R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-12-31] (APN LLC.) R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [654408 2012-04-04] (Malwarebytes Corporation) R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation) R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-02-11] (Toshiba Europe GmbH) ==================== Drivers (Whitelisted) ==================== S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.) S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.) S3 andnetndis; C:\Windows\System32\DRIVERS\lgandnetndis64.sys [93184 2012-07-04] (LG Electronics Inc.) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [1526488 2013-12-18] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-21] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20140203.001_5f\IDSvia64.sys [521944 2014-02-03] (Symantec Corporation) R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.) R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.) R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24904 2012-04-04] (Malwarebytes Corporation) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20140204.001\ENG64.SYS [126040 2014-02-03] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20140204.001\EX64.SYS [2099288 2014-02-03] (Symantec Corporation) R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-08-31] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 usbbus; system32\DRIVERS\lgx64bus.sys [X] S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X] S3 USBModem; system32\DRIVERS\lgx64modem.sys [X] S3 X6va002; \??\C:\Users\Admin\AppData\Local\Temp\002ABBB.tmp [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-04 23:08 - 2014-02-04 23:08 - 00022588 _____ () C:\Users\Tobias\Desktop\FRST.txt 2014-02-04 23:08 - 2014-02-04 23:08 - 00000000 ____D () C:\FRST 2014-02-04 23:07 - 2014-02-04 23:07 - 02080256 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe 2014-02-04 23:05 - 2014-02-04 23:05 - 00000472 _____ () C:\Users\Tobias\Desktop\defogger_disable.log 2014-02-04 23:05 - 2014-02-04 23:05 - 00000000 _____ () C:\Users\Admin\defogger_reenable 2014-02-04 23:04 - 2014-02-04 23:04 - 00380416 _____ () C:\Users\Tobias\Desktop\Gmer-19357.exe 2014-02-04 23:03 - 2014-02-04 23:03 - 00050477 _____ () C:\Users\Tobias\Desktop\Defogger.exe 2014-02-04 09:51 - 2014-02-04 09:51 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-02-04 09:51 - 2014-02-04 09:51 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-02-04 09:51 - 2014-02-04 09:51 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-02-04 09:51 - 2014-02-04 09:51 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-02-04 09:48 - 2014-02-04 09:48 - 00022736 _____ () C:\Users\Tobias\Documents\cc_20140204_094800.reg 2014-02-04 09:05 - 2014-02-04 09:51 - 00000000 ____D () C:\ProgramData\Oracle 2014-01-15 06:04 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 06:04 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 06:04 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 06:04 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 06:04 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 06:04 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 06:04 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 06:04 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 06:04 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys ==================== One Month Modified Files and Folders ======= 2014-02-04 23:08 - 2014-02-04 23:08 - 00022588 _____ () C:\Users\Tobias\Desktop\FRST.txt 2014-02-04 23:08 - 2014-02-04 23:08 - 00000000 ____D () C:\FRST 2014-02-04 23:07 - 2014-02-04 23:07 - 02080256 _____ (Farbar) C:\Users\Tobias\Desktop\FRST64.exe 2014-02-04 23:06 - 2013-09-01 12:46 - 00000000 ____D () C:\Users\Tobias\AppData\Local\CrashDumps 2014-02-04 23:05 - 2014-02-04 23:05 - 00000472 _____ () C:\Users\Tobias\Desktop\defogger_disable.log 2014-02-04 23:05 - 2014-02-04 23:05 - 00000000 _____ () C:\Users\Admin\defogger_reenable 2014-02-04 23:05 - 2010-08-25 17:06 - 00000000 ____D () C:\Users\Admin 2014-02-04 23:04 - 2014-02-04 23:04 - 00380416 _____ () C:\Users\Tobias\Desktop\Gmer-19357.exe 2014-02-04 23:03 - 2014-02-04 23:03 - 00050477 _____ () C:\Users\Tobias\Desktop\Defogger.exe 2014-02-04 22:54 - 2012-08-27 20:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-04 22:49 - 2012-05-21 20:06 - 00000000 ____D () C:\Users\Tobias\AppData\Roaming\vlc 2014-02-04 22:40 - 2010-07-19 20:47 - 01362317 _____ () C:\Windows\WindowsUpdate.log 2014-02-04 21:16 - 2009-07-14 18:58 - 00697098 _____ () C:\Windows\system32\perfh007.dat 2014-02-04 21:16 - 2009-07-14 18:58 - 00148362 _____ () C:\Windows\system32\perfc007.dat 2014-02-04 21:16 - 2009-07-14 06:13 - 01613412 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-04 21:01 - 2013-10-13 13:36 - 00000000 ____D () C:\Users\Tobias\Desktop\oo 2014-02-04 20:22 - 2009-07-14 05:45 - 00016304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-04 20:22 - 2009-07-14 05:45 - 00016304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-04 20:17 - 2011-04-25 13:02 - 00000000 ____D () C:\Users\Tobias\Documents\Outlook-Dateien 2014-02-04 20:13 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-04 20:13 - 2009-07-14 05:51 - 00174643 _____ () C:\Windows\setupact.log 2014-02-04 20:12 - 2010-07-19 20:42 - 00093168 _____ () C:\Windows\PFRO.log 2014-02-04 15:01 - 2010-07-19 20:52 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-04 15:01 - 2009-07-14 03:34 - 00000478 _____ () C:\Windows\win.ini 2014-02-04 11:33 - 2010-08-29 12:05 - 00000000 ____D () C:\Users\Tobias\Desktop\Multimedia 2014-02-04 09:54 - 2012-06-03 09:31 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-02-04 09:54 - 2011-12-02 19:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-02-04 09:51 - 2014-02-04 09:51 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-02-04 09:51 - 2014-02-04 09:51 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-02-04 09:51 - 2014-02-04 09:51 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-02-04 09:51 - 2014-02-04 09:51 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-02-04 09:51 - 2014-02-04 09:05 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-04 09:48 - 2014-02-04 09:48 - 00022736 _____ () C:\Users\Tobias\Documents\cc_20140204_094800.reg 2014-02-04 09:39 - 2013-08-31 21:43 - 00000000 ____D () C:\Users\Tobias\Documents\StreamTransport 2014-02-04 09:39 - 2010-08-28 18:14 - 00000000 ____D () C:\Users\Tobias 2014-02-04 09:38 - 2013-08-30 10:59 - 00000000 ____D () C:\ProgramData\Norton 2014-02-04 09:38 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2014-02-04 09:36 - 2012-07-10 11:31 - 00000000 ____D () C:\Program Files (x86)\Java 2014-02-03 12:02 - 2013-10-18 14:47 - 00000000 ____D () C:\Users\Tobias\AppData\Roaming\avidemux 2014-01-31 16:35 - 2013-10-14 17:19 - 00000000 ____D () C:\Users\Tobias\Desktop\Zu Dr 2014-01-15 13:53 - 2009-07-14 05:45 - 00539712 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-01-09 12:01 - 2013-11-01 18:11 - 00000584 _____ () C:\Users\Tobias\Documents\grstyles.stl Some content of TEMP: ==================== C:\Users\Tobias\AppData\Local\Temp\i4jdel0.exe C:\Users\Tobias\AppData\Local\Temp\install_flashplayer12x32_mssd_aaa_aih_1.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2014 Ran by Tobias at 2014-02-04 23:08:50 Running from C:\Users\Tobias\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Norton Internet Security CBE (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Norton Internet Security CBE (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Internet Security CBE (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} ==================== Installed Programs ====================== "Minimal SYStem 1.0.11" (x32 Version: 1.0.11 - MinGW) ACD/Labs Software in C:\ACDFREE12\ (x32 Version: v12.00, FREE - ACD/Labs) Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated) Adobe Reader X (10.1.9) - Deutsch (x32 Version: 10.1.9 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (x32 Version: 12.0.0.112 - Adobe Systems, Inc.) Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden AFPL Ghostscript 8.54 (x32 Version: - ) AFPL Ghostscript Fonts (x32 Version: - ) AGEIA PhysX v7.09.13 (x32 Version: 7.09.13 - AGEIA Technologies, Inc.) Amazon.de (x32 Version: - Amazon EU S.a.r.L.) AntiBrowserSpy (x32 Version: 139 - Abelssoft) Ask Toolbar (x32 Version: 12.10.0.3248 - APN, LLC) <==== ATTENTION Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.27 - Atheros Communications Inc.) Atheros Driver Installation Program (x32 Version: 5.0 - Atheros) Audiobook Cutter Free Edition (x32 Version: 1.8.1 - Audiobook Software) Avidemux 2.6 (32-bit) (x32 Version: 2.6.6.8941 - ) Bejeweled 2 Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden BrowserDefender (x32 Version: - Bit89 Inc) <==== ATTENTION BrowseToSave (Version: 1.0 - ) <==== ATTENTION CCleaner (Version: 3.20 - Piriform) Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Conexant HD Audio (Version: 4.111.0.64 - Conexant) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft) Deutsch-Unicode - 0.8.14 (Version: 1.0.3.40 - ShadowTec q-pool) Die große Kartenspiele-Box (x32 Version: Die große Kartenspiele-Box - rondomedia Marketing & Vertriebs GmbH) Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden DivX-Setup (x32 Version: 2.6.1.9 - DivX, LLC) DynaGeo 3.6e (x32 Version: - Roland Mechling) eBay (x32 Version: 1.1.9 - eBay Inc.) FATE (x32 Version: 2.2.0.82 - WildTangent) Hidden FormatFactory 3.1.1 (x32 Version: 3.1.1 - Free Time) Free YouTube Download version 3.2.0.128 (x32 Version: 3.2.0.128 - DVDVideoSoft Ltd.) Free YouTube to MP3 Converter version 3.12.0.128 (x32 Version: 3.12.0.128 - DVDVideoSoft Ltd.) Gehirnjogging - Der Trainer fürs Gedächtnis... (x32 Version: 1.0 - SBT) Gehirnjogging 2 (x32 Version: 2.0 - SBT) Gehirnjogging 3 (x32 Version: 6.1 - SBT) Gehirnjogging 4 (x32 Version: 1.0 - SBT) Gehirnjogging 5 (x32 Version: 1.0 - SBT) GeoGebra (HKCU Version: 4.0.25.0 - International GeoGebra Institute) GTA2 (x32 Version: - ) ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden Inca Ball (x32 Version: 1.0 - MyPlayCity, Inc.) Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2086 - Intel Corporation) Intel® Matrix Storage Manager (Version: - Intel Corporation) Java 7 Update 25 (64-bit) (Version: 7.0.250 - Oracle) Java 7 Update 51 (x32 Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Jewel Quest II (x32 Version: 2.2.0.82 - WildTangent) Hidden Juniper Networks Network Connect 7.1.0 (x32 Version: 7.1.0.18671 - Juniper Networks) Juniper Networks, Inc. Setup Client (HKCU Version: 7.1.3.11013 - Juniper Networks, Inc.) Juniper Networks, Inc. Setup Client Activex Control (x32 Version: 2.1.1.1 - Juniper Networks, Inc.) Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden Kyocera Product Library (Version: 2.0.0713 - Kyocera Mita Corporation) Langenscheidt Vokabeltrainer 5.0 Italienisch (x32 Version: 5.0.0 - Langenscheidt) Langenscheidt Vokabeltrainer 5.0 Spanisch (x32 Version: 5.0.0 - Langenscheidt) LG Bluetooth Drivers (x32 Version: 1.1 - LG Electronics) LG PC Suite III deinstallieren (x32 Version: - LG Electronics) LG United Mobile Drivers (x32 Version: 3.8.1 - LG Electronics) Malwarebytes Anti-Malware Version 1.61.0.1400 (x32 Version: 1.61.0.1400 - Malwarebytes Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft IntelliPoint 8.0 (Version: 8.0.225.0 - Microsoft) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Professional 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Suite Activation Assistant (x32 Version: 2.9 - Microsoft Corporation) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Works (x32 Version: 9.7.0621 - Microsoft Corporation) MinGW 5.1.6 (x32 Version: 5.1.6 - MinGW) Mini Golf (x32 Version: 1.0 - MyPlayCity, Inc.) Mozilla Firefox 13.0.1 (x86 de) (x32 Version: 13.0.1 - Mozilla) Mozilla Maintenance Service (x32 Version: 13.0.1 - Mozilla) MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation) NBA 2K9 (x32 Version: - Visual Concepts) Nero 9 Essentials (x32 Version: - Nero AG) Nero BackItUp (x32 Version: 5.2.21001 - Nero AG) Nero BackItUp and Burn (x32 Version: 1.2.0030 - Nero AG) Nero BurnRights (x32 Version: 3.4.13.100 - Nero AG) Hidden Nero BurnRights (x32 Version: 3.6.26001 - Nero AG) Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden Nero DiscSpeed (x32 Version: 5.4.13.100 - Nero AG) Hidden Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden Nero DriveSpeed (x32 Version: 4.4.12.100 - Nero AG) Hidden Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden Nero Express (x32 Version: 9.6.16000 - Nero AG) Nero Express Help (x32 Version: 9.4.34.100 - Nero AG) Hidden Nero InfoTool (x32 Version: 6.4.12.100 - Nero AG) Hidden Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden Nero RescueAgent (x32 Version: 2.6.25002 - Nero AG) Nero StartSmart (x32 Version: 9.4.37.100 - Nero AG) Hidden Nero StartSmart Help (x32 Version: 9.4.37.100 - Nero AG) Hidden NeroExpress (x32 Version: 9.4.34.100 - Nero AG) Hidden neroxml (x32 Version: 1.0.0 - Nero AG) Hidden Norton Internet Security CBE (x32 Version: 20.4.0.40 - Symantec Corporation) PDF Blender (x32 Version: - ) Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden Photo Service - powered by myphotobook (x32 Version: 1.0.7 - myphotobook GmbH) Hidden Photo Service - powered by myphotobook (x32 Version: 1.0.7-279 - myphotobook GmbH) Plants vs. Zombies (x32 Version: 2.2.0.82 - WildTangent) Hidden PlayReady PC Runtime amd64 (Version: 1.3.0 - Microsoft Corporation) Polar Bowler (x32 Version: 2.2.0.82 - WildTangent) Hidden Prince of Persia (x32 Version: 1.0 - Ubisoft) Prince of Persia T2T (x32 Version: 1.00.999 - Ubisoft) Prince of Persia The Forgotten Sands™ (x32 Version: 1.0 - Ubisoft) Prince of Persia The Two Thrones (x32 Version: 1.00.999 - Ubisoft) Hidden PVR USB Manager (x32 Version: 1.00.000 - ) QuickTime (x32 Version: - ) Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30111 - Realtek Semiconductor Corp.) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden Shooting Balls Gallery (x32 Version: 1.0 - MyPlayCity, Inc.) Skype Toolbars (x32 Version: 1.0.4051 - Skype Technologies S.A.) Skype™ 5.10 (x32 Version: 5.10.116 - Skype Technologies S.A.) Steam (x32 Version: 1.0.0.0 - Valve) StreamTransport version: 1.0.2.2171 (x32 Version: - ) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics Pointing Device Driver (Version: 15.0.8.1 - Synaptics Incorporated) TIPP10 Version 2.1.0 (x32 Version: - (c) 2006-2011, Tom Thielicke IT Solutions) Toshiba Assist (x32 Version: 3.00.11 - TOSHIBA CORPORATION) TOSHIBA Bulletin Board (Version: 1.6.07.64 - TOSHIBA Corporation) Hidden TOSHIBA Bulletin Board (x32 Version: 1.6.07.64 - TOSHIBA Corporation) TOSHIBA ConfigFree (x32 Version: 8.0.28 - TOSHIBA Corporation) TOSHIBA Disc Creator (Version: 2.1.0.2 for x64 - TOSHIBA Corporation) TOSHIBA Hardware Setup (x32 Version: 2.00.06 - TOSHIBA Corporation) TOSHIBA HDD/SSD Alert (Version: 3.1.64.6 - TOSHIBA Corporation) Hidden TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6 - TOSHIBA Corporation) TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6 - TOSHIBA Corporation) Hidden Toshiba Manuals (x32 Version: 10.01 - TOSHIBA) TOSHIBA Media Controller (x32 Version: 1.0.80.3.64 - TOSHIBA CORPORATION) TOSHIBA Media Controller Plug-in (x32 Version: 1.0.4.9 - TOSHIBA CORPORATION) TOSHIBA Online Product Information (x32 Version: 2.09.0001 - TOSHIBA) TOSHIBA Recovery Media Creator (Version: 2.1.0.4 x64 - TOSHIBA Corporation) TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA) TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA) Hidden TOSHIBA ReelTime (Version: 1.6.06.64 - TOSHIBA Corporation) Hidden TOSHIBA ReelTime (x32 Version: 1.6.06.64 - TOSHIBA Corporation) TOSHIBA Service Station (x32 Version: 2.1.40 - TOSHIBA) TOSHIBA Supervisor Password (x32 Version: 2.00.03 - TOSHIBA Corporation) Toshiba TEMPRO (x32 Version: 3.30 - Toshiba Europe GmbH) TOSHIBA Value Added Package (Version: 1.3.3.64 - TOSHIBA Corporation) Hidden TOSHIBA Value Added Package (x32 Version: 1.3.3.64 - TOSHIBA Corporation) TOSHIBA Value Added Package (x32 Version: 1.3.3.64 - TOSHIBA Corporation) Hidden TRORMCLauncher (Version: 1.0.0.9 - TOSHIBA) Hidden TRORMCLauncher (x32 Version: - ) Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT) Unreal Tournament 3 (LG) (x32 Version: 1.00.0000 - Epic Games) Hidden Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2494150) (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft) Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft) VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0 - Microsoft Corporation) Hidden VLC media player 2.1.1 (x32 Version: 2.1.1 - VideoLAN) Vokabeltrainer-Update 5.0.27 (x32 Version: 5.0.27 - Langenscheidt) WildTangent ORB Game Console (x32 Version: - WildTangent) Hidden WildTangent-Spiele (x32 Version: 1.0.0.80 - WildTangent) WinDjView 1.0.3 (x32 Version: 1.0.3 - Andrew Zhezherun) Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden Windows Live Essentials (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 6.500.3165.0 - Microsoft Corporation) Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden Windows Live Sync (x32 Version: 14.0.8089.726 - Microsoft Corporation) Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live-Uploadtool (x32 Version: 14.0.8014.1029 - Microsoft Corporation) Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp) WinRAR archiver (x32 Version: - ) World's Best Board Games 2010 (x32 Version: - cerasus.media GmbH) yEd Graph Editor 3.11 (x32 Version: 3.11 - yWorks GmbH) Zuma Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden ==================== Restore Points ========================= Could not list Restore Points. Check WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2013-11-17 13:07 - 00000895 ____N C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 www.google-analytics.com 127.0.0.1 google-analytics.com ==================== Scheduled Tasks (whitelisted) ============= Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ? Task: C:\Windows\Tasks\SymInstallStub.job => ? ==================== Loaded Modules (whitelisted) ============= 2010-09-08 12:24 - 2010-03-15 10:28 - 00052224 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll 2010-03-03 13:15 - 2010-03-03 13:15 - 08762680 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll 2009-11-03 12:26 - 2009-11-03 12:26 - 00053560 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll 2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll 2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll 2010-04-08 08:25 - 2009-06-22 13:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll 2009-03-12 18:08 - 2009-03-12 18:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll 2009-07-25 15:38 - 2009-07-25 15:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll 2010-03-19 13:28 - 2010-03-19 13:28 - 03409256 _____ () C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll 2010-02-05 16:44 - 2010-02-05 16:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver" ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (02/04/2014 11:08:50 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x808 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 11:06:38 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x17d8 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 11:04:30 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x378 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 11:00:38 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x7f0 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 10:58:28 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x75c Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 10:56:24 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x12a8 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 10:54:20 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x884 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 10:52:14 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x1134 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 10:49:56 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x7a8 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (02/04/2014 10:44:20 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 13.0.1.4548, Zeitstempel: 0x4fda6075 Name des fehlerhaften Moduls: sprote~1.dll, Version: 0.0.0.0, Zeitstempel: 0x51011825 Ausnahmecode: 0xc0000417 Fehleroffset: 0x000b343f ID des fehlerhaften Prozesses: 0x1114 Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 System errors: ============= Error: (02/04/2014 09:46:53 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows Update" wurde nicht richtig gestartet. Error: (02/04/2014 09:44:30 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst gpsvc erreicht. Error: (02/04/2014 09:43:52 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AudioSrv erreicht. Error: (02/04/2014 09:41:26 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143. Error: (02/04/2014 09:40:45 AM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: SRTSP Error: (02/04/2014 09:40:33 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%5. Error: (02/04/2014 09:40:11 AM) (Source: SRTSP) (User: ) Description: Error loading virus definitions. Error: (02/01/2014 00:40:26 PM) (Source: BROWSER) (User: ) Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{FFF82E59-76FF-4538-A212-281B1006DFB8}" zu oft fehl. Der Sicherungssuchdienst wird beendet. Error: (01/31/2014 11:04:10 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst BITS erreicht. Error: (01/30/2014 01:40:19 PM) (Source: WMPNetworkSvc) (User: ) Description: 0x80004004-1 Microsoft Office Sessions: ========================= Error: (02/04/2014 11:08:50 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f80801cf21f5672789f6C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dllecab036b-8de8-11e3-a17d-00266c74b65e Error: (02/04/2014 11:06:38 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f17d801cf21f517fa7da8C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dll9df9beac-8de8-11e3-a17d-00266c74b65e Error: (02/04/2014 11:04:30 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f37801cf21f4cb27ad80C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dll51ac3b93-8de8-11e3-a17d-00266c74b65e Error: (02/04/2014 11:00:38 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f7f001cf21f4416b06b4C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dllc7632398-8de7-11e3-a17d-00266c74b65e Error: (02/04/2014 10:58:28 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f75c01cf21f3f457f165C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dll79ec147c-8de7-11e3-a17d-00266c74b65e Error: (02/04/2014 10:56:24 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f12a801cf21f3aa39d1acC:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dll2ffff1a9-8de7-11e3-a17d-00266c74b65e Error: (02/04/2014 10:54:20 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f88401cf21f36022d614C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dlle6163037-8de6-11e3-a17d-00266c74b65e Error: (02/04/2014 10:52:14 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f113401cf21f3155b08e5C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dll9afa66c9-8de6-11e3-a17d-00266c74b65e Error: (02/04/2014 10:49:56 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f7a801cf21f2c31843b1C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dll48c3e318-8de6-11e3-a17d-00266c74b65e Error: (02/04/2014 10:44:20 PM) (Source: Application Error)(User: ) Description: firefox.exe13.0.1.45484fda6075sprote~1.dll0.0.0.051011825c0000417000b343f111401cf21f0941341d6C:\Program Files (x86)\Mozilla Firefox\firefox.exec:\progra~2\browse~1\sprote~1.dll80be9d28-8de5-11e3-a17d-00266c74b65e CodeIntegrity Errors: =================================== Date: 2013-07-22 20:55:34.905 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-22 20:55:34.836 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-22 20:55:34.797 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-22 20:55:34.707 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-22 20:55:34.586 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-22 20:55:34.563 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-06-13 21:38:26.273 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-06-13 21:38:26.273 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-06-13 21:38:26.258 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-06-13 21:38:26.211 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 40% Total physical RAM: 3963.97 MB Available physical RAM: 2341.96 MB Total Pagefile: 7926.12 MB Available Pagefile: 6252.54 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (WINDOWS) (Fixed) (Total:232.65 GB) (Free:120.01 GB) NTFS Drive d: (Data) (Fixed) (Total:232.72 GB) (Free:201.85 GB) NTFS ==================== MBR & Partition Table ================== ==================== End Of Log ============================ Kann im abgesicherten Modus arbeiten, falls dies noch nötig sein sollte. Vielen Dank schon im Voraus. |
Themen zu Windows 7: Norton meldet Fake App Attack Absturz Mozilla Firefox |
abelssoft, absturz, appdatalow, converter, device driver, dvdvideosoft ltd., explorer, fake app attack, flash player, home, installation, kaspersky, klelam.sys, mozilla, port, pup.optional.browserdefender.a, pup.optional.delta.a, pup.optional.sprotector.a, security, services.exe, software, svchost.exe, windows |