| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: doppelte conhost und csrss.exe ohne DateipfadWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.02.2014, 15:32
| #1 |
 |  doppelte conhost und csrss.exe ohne Dateipfad Hallo zusammen, mir ist gestern Abend aufgefallen, dass die conhost.exe und die csrss.exe im taskmanager (Prozesse aller Benutzer werden angezeigt) doppelt aufgeführt wird. Hab das mal beobachtet und musste dann feststellen, dass manchmal bei beiden (aber auch bei einigen Nvidia-Anwendungen) die Beschreibung verschwindet und sich der Dateipfad nicht öffnen lässt. Es scheint allerdings so zu sein, dass in diesen Momenten diese Prozesse jedoch nur einmal aufgelistet/ ausgeführt werden. Muss ich mir Sorgen machen oder ist das normal? Desweiteren sind auf dem C:-Laufwerk in letzter Zeit Schwankungen beim freien Speicher (ca. 2GB) festzustellen. Könnten zwar nur temporäre Dateien sein, aber zur Sicherheit frage ich doch lieber mal nach. PC läuft ansonsten völlig normal. Auch wurde mir mitgeteilt, dass sich auf dem ebenfalls gemeinsam genutzten Laptop mal ein Fenster in Google Chrome geöffnet hatte und den Nutzer darüber informierte, dass Einstellungen sich von selbst geändert hätten. Seitdem könnte sich auch bei der Toolbar beim Internet Explorer was eingenistet haben. Weiss ich allerdings nicht mit Sicherheit, da ich den Laptop und den Internet Explorer selber zu selten brauche. Beide Rechner nutzen Windows 7 64-Bit Home Premium SP1 und F-Secure Internet Security. Hier die Logs, gemäss Anleitung: Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:43 on 21/02/2014 (admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST: FRST wurde vom F-Secure Deep Guard als schädliche Anwendung eingestuft und blockiert, allerdings nicht von Beginn an, daher trotzdem mal das was gescannt wurde: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-02-2014
Ran by admin (administrator) on ADMIN-PC on 21-02-2014 13:47:52
Running from C:\Users\admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\fshoster32.exe
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\apps\CCF_Reputation\fsorsp.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\FSGK32.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSMA32.EXE
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
() C:\Program Files\Corsair USB Headset\customapp\program\CAHS.EXE
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\fssm32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Program Files\Corsair USB Headset\customapp\program\CAHS.EXE
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSHDLL64.EXE
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\fshoster32.exe
(F-Secure Corporation) C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSM32.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6470760 2012-05-15] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1175656 2012-05-11] (Realtek Semiconductor)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe [7144960 2013-01-16] (Broadcom Corporation)
HKLM\...\Run: [CAHS1Sound] - C:\Windows\Syswow64\CAHS1.dll [8724480 2011-07-08] (C-Media Corporation)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-18] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1063200 2013-10-18] (NVIDIA Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-26] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [F-Secure Hoster (45119)] - C:\Program Files (x86)\Internet Security\fshoster32.exe [183864 2012-11-26] (F-Secure Corporation)
HKLM-x32\...\Run: [F-Secure Manager] - C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSM32.EXE [310992 2012-10-18] (F-Secure Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-2586655326-3906653631-2063846596-1000\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-2586655326-3906653631-2063846596-1000\...\Run: [Steam] - E:\Steam\steam.exe [1824000 2014-02-11] (Valve Corporation)
HKU\S-1-5-21-2586655326-3906653631-2063846596-1000\...\Run: [Overwolf] - C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
HKU\S-1-5-21-2586655326-3906653631-2063846596-1000\...\MountPoints2: {8cf626a8-6012-11e2-ba8e-806e6f6e6963} - D:\.\Bin\ASSETUP.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xB39ED265A72DCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Extension: (Google Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30]
==================== Services (Whitelisted) =================
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [233328 2012-01-23] (DTS, Inc)
R2 fshoster; C:\Program Files (x86)\Internet Security\fshoster32.exe [183864 2012-11-26] (F-Secure Corporation)
R3 FSMA; C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Common\FSMA32.EXE [208592 2012-10-18] (F-Secure Corporation)
R2 FSORSPClient; C:\Program Files (x86)\Internet Security\apps\CCF_Reputation\fsorsp.exe [60352 2013-06-25] (F-Secure Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-29] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe [5834752 2013-01-16] (Broadcom Corporation)
==================== Drivers (Whitelisted) ====================
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [49760 2012-01-06] (Asmedia Technology)
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2011-11-03] (Broadcom Corporation.)
R3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2011-05-20] (Broadcom Corporation.)
R3 CorsairCAHS1; C:\Windows\System32\drivers\CAHS164.sys [1308160 2011-06-16] (C-Media Electronics Inc)
R3 F-Secure Gatekeeper; C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [203304 2013-12-11] (F-Secure Corporation)
R1 F-Secure HIPS; C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\HIPS\drivers\fshs.sys [69296 2013-10-16] (F-Secure Corporation)
R0 fsbts; C:\Windows\System32\Drivers\fsbts.sys [56016 2013-01-26] ()
R0 fsbts; C:\Windows\SysWOW64\Drivers\fsbts.sys [42672 2013-01-26] ()
R3 fsni; C:\Program Files (x86)\Internet Security\apps\CCF_Scanning\fsni64.sys [80832 2013-04-25] (F-Secure Corporation)
R1 fsvista; C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [14032 2012-10-18] ()
R3 Linksys_adapter_H; C:\Windows\System32\DRIVERS\AE1200w764.sys [1254464 2011-03-29] (Broadcom Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-21 13:47 - 2014-02-21 13:47 - 00011836 _____ () C:\Users\admin\Desktop\FRST.txt
2014-02-21 13:47 - 2014-02-21 13:47 - 00000000 ____D () C:\FRST
2014-02-21 13:45 - 2014-02-21 13:46 - 02153984 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2014-02-21 13:43 - 2014-02-21 13:43 - 00000472 _____ () C:\Users\admin\Desktop\defogger_disable.log
2014-02-21 13:43 - 2014-02-21 13:43 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-02-21 13:42 - 2014-02-21 13:42 - 00050477 _____ () C:\Users\admin\Desktop\Defogger.exe
2014-02-21 13:32 - 2014-02-21 13:32 - 00392232 _____ (F-Secure Corporation) C:\Users\admin\Downloads\swisscom-0a9caf4e-9af4-11e3-b453-123143002408.exe
2014-02-21 10:21 - 2014-02-21 10:21 - 00407370 _____ () C:\Users\admin\Downloads\SC_International_Patch_1.2.9_beta.zip
2014-02-20 16:36 - 2014-02-20 16:36 - 00003288 _____ () C:\Windows\System32\Tasks\{6FD1609D-032F-46A5-9C35-B66A7FF59411}
2014-02-20 16:32 - 2014-02-20 16:32 - 00003288 _____ () C:\Windows\System32\Tasks\{B6FD0BC7-4E2A-4743-8CD8-62B7FE1B35EA}
2014-02-20 16:31 - 2014-02-20 16:31 - 00003284 _____ () C:\Windows\System32\Tasks\{4E4FF085-2174-4810-87A1-6F3779F30147}
2014-02-20 16:30 - 2014-02-20 16:30 - 00003288 _____ () C:\Windows\System32\Tasks\{690C34E6-C2A1-416C-B081-1084BF080BC5}
2014-02-20 16:28 - 2014-02-20 18:00 - 737252976 _____ ( ) C:\Users\admin\Downloads\Stalker_Complete_2009_v1.4.4_Setup.exe
2014-02-20 16:12 - 2014-02-20 16:21 - 72943370 _____ () C:\Users\admin\Desktop\stk-soundtrack.zip
2014-02-20 15:54 - 2014-02-20 15:54 - 00000986 _____ () C:\Users\Public\Desktop\S.T.A.L.K.E.R. - Shadow of Chernobyl.lnk
2014-02-20 15:49 - 2014-02-21 10:53 - 00000000 ____D () C:\Users\Public\Documents\STALKER-SHOC
2014-02-19 20:40 - 2014-02-19 20:40 - 04375224 _____ (F-Secure Corporation) C:\Users\admin\Downloads\F-SecureOnlineScanner.exe
2014-02-15 17:22 - 2014-02-15 17:22 - 00046056 _____ () C:\Users\admin\AppData\Local\recently-used.xbel
2014-02-15 14:04 - 2014-02-15 14:04 - 00003174 _____ () C:\Windows\System32\Tasks\{EACE7BC1-CB24-44A2-B937-B703F4FC8F8B}
2014-02-14 14:59 - 2014-02-14 14:59 - 00000000 ____D () C:\Program Files (x86)\Traffic Simulator Configuration Tool
2014-02-14 14:39 - 2014-02-14 14:41 - 17632087 _____ () C:\Users\admin\Downloads\UPDATE_SKU2_TO_P1_B638.zip
2014-02-14 13:34 - 2014-02-14 13:34 - 00003172 _____ () C:\Windows\System32\Tasks\{51F7C50E-DB2A-478C-87D0-2DC4A7177004}
2014-02-04 14:34 - 2014-02-07 22:14 - 25059997 _____ () C:\Users\admin\Desktop\Thallarn_1.xcf
2014-02-04 13:39 - 2014-02-04 18:41 - 04199189 _____ () C:\Users\admin\Desktop\SE Map.xcf
2014-02-03 22:17 - 2014-02-13 21:47 - 09779189 _____ () C:\Users\admin\Desktop\Human Colonies_2.xcf
2014-02-03 12:11 - 2014-02-03 14:03 - 02004070 _____ () C:\Users\admin\Desktop\Human Colonies.xcf
2014-02-02 19:08 - 2014-01-29 16:14 - 00000314 _____ () C:\Users\admin\Desktop\avp2cmds.txt
2014-02-02 18:22 - 2014-02-02 18:40 - 176785326 _____ () C:\Users\admin\Downloads\hqp2.zip
2014-01-31 14:18 - 2014-01-31 14:18 - 00000000 ____D () C:\Users\admin\Documents\Electronic Arts
2014-01-31 14:18 - 2014-01-31 14:18 - 00000000 ____D () C:\Users\admin\AppData\Local\Electronic Arts
2014-01-30 16:32 - 2014-01-30 17:06 - 321921474 _____ () C:\Users\admin\Downloads\avp207_v11_by_dex909.rar
2014-01-30 16:29 - 2014-01-30 16:30 - 07297476 _____ (Fox Interactive) C:\Users\admin\Downloads\avp2_en_096.exe
2014-01-29 16:01 - 2014-02-03 14:30 - 00021840 ____T () C:\Windows\SysWOW64\SIntfNT.dll
2014-01-29 16:01 - 2014-02-03 14:30 - 00017212 ____T () C:\Windows\SysWOW64\SIntf32.dll
2014-01-29 16:01 - 2014-02-03 14:30 - 00012067 ____T () C:\Windows\SysWOW64\SIntf16.dll
2014-01-27 13:45 - 2014-01-17 01:16 - 00000000 ____D () C:\Users\admin\Desktop\State_of_Mind_-_Mr_Cover_Up
2014-01-27 13:39 - 2014-01-27 13:44 - 48313789 _____ () C:\Users\admin\Downloads\8169809.SttfMnd-MrCvrp.zip
==================== One Month Modified Files and Folders =======
2014-02-21 13:47 - 2014-02-21 13:47 - 00011836 _____ () C:\Users\admin\Desktop\FRST.txt
2014-02-21 13:47 - 2014-02-21 13:47 - 00000000 ____D () C:\FRST
2014-02-21 13:46 - 2014-02-21 13:45 - 02153984 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2014-02-21 13:43 - 2014-02-21 13:43 - 00000472 _____ () C:\Users\admin\Desktop\defogger_disable.log
2014-02-21 13:43 - 2014-02-21 13:43 - 00000000 _____ () C:\Users\admin\defogger_reenable
2014-02-21 13:43 - 2013-01-16 13:36 - 00000000 ____D () C:\Users\admin
2014-02-21 13:42 - 2014-02-21 13:42 - 00050477 _____ () C:\Users\admin\Desktop\Defogger.exe
2014-02-21 13:32 - 2014-02-21 13:32 - 00392232 _____ (F-Secure Corporation) C:\Users\admin\Downloads\swisscom-0a9caf4e-9af4-11e3-b453-123143002408.exe
2014-02-21 13:19 - 2009-07-14 05:45 - 00022080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-21 13:19 - 2009-07-14 05:45 - 00022080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-21 13:18 - 2011-04-12 08:43 - 00696536 _____ () C:\Windows\system32\perfh007.dat
2014-02-21 13:18 - 2011-04-12 08:43 - 00147832 _____ () C:\Windows\system32\perfc007.dat
2014-02-21 13:18 - 2009-07-14 06:13 - 01612120 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-21 13:16 - 2013-01-16 13:36 - 01515499 _____ () C:\Windows\WindowsUpdate.log
2014-02-21 13:12 - 2013-01-26 16:32 - 00000618 _____ () C:\Windows\Tasks\Scheduled scanning task.job
2014-02-21 13:12 - 2013-01-16 14:20 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-21 13:12 - 2013-01-16 13:40 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-21 13:12 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-21 13:12 - 2009-07-14 05:51 - 00256457 _____ () C:\Windows\setupact.log
2014-02-21 10:53 - 2014-02-20 15:49 - 00000000 ____D () C:\Users\Public\Documents\STALKER-SHOC
2014-02-21 10:53 - 2013-01-16 13:40 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-21 10:21 - 2014-02-21 10:21 - 00407370 _____ () C:\Users\admin\Downloads\SC_International_Patch_1.2.9_beta.zip
2014-02-21 10:06 - 2013-01-26 16:32 - 00003396 _____ () C:\Windows\System32\Tasks\Scheduled scanning task
2014-02-20 21:17 - 2013-03-24 22:28 - 00007602 _____ () C:\Users\admin\AppData\Local\Resmon.ResmonCfg
2014-02-20 18:00 - 2014-02-20 16:28 - 737252976 _____ ( ) C:\Users\admin\Downloads\Stalker_Complete_2009_v1.4.4_Setup.exe
2014-02-20 16:36 - 2014-02-20 16:36 - 00003288 _____ () C:\Windows\System32\Tasks\{6FD1609D-032F-46A5-9C35-B66A7FF59411}
2014-02-20 16:32 - 2014-02-20 16:32 - 00003288 _____ () C:\Windows\System32\Tasks\{B6FD0BC7-4E2A-4743-8CD8-62B7FE1B35EA}
2014-02-20 16:31 - 2014-02-20 16:31 - 00003284 _____ () C:\Windows\System32\Tasks\{4E4FF085-2174-4810-87A1-6F3779F30147}
2014-02-20 16:30 - 2014-02-20 16:30 - 00003288 _____ () C:\Windows\System32\Tasks\{690C34E6-C2A1-416C-B081-1084BF080BC5}
2014-02-20 16:21 - 2014-02-20 16:12 - 72943370 _____ () C:\Users\admin\Desktop\stk-soundtrack.zip
2014-02-20 15:55 - 2013-01-18 23:20 - 00486437 _____ () C:\Windows\DirectX.log
2014-02-20 15:54 - 2014-02-20 15:54 - 00000986 _____ () C:\Users\Public\Desktop\S.T.A.L.K.E.R. - Shadow of Chernobyl.lnk
2014-02-19 20:40 - 2014-02-19 20:40 - 04375224 _____ (F-Secure Corporation) C:\Users\admin\Downloads\F-SecureOnlineScanner.exe
2014-02-19 19:40 - 2013-09-09 13:57 - 00000000 ____D () C:\Users\admin\Documents\SimCity 4
2014-02-16 10:48 - 2013-01-16 13:40 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-16 10:48 - 2013-01-16 13:40 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-15 17:45 - 2014-01-13 14:29 - 00000000 ____D () C:\Users\admin\.gimp-2.8
2014-02-15 17:22 - 2014-02-15 17:22 - 00046056 _____ () C:\Users\admin\AppData\Local\recently-used.xbel
2014-02-15 17:22 - 2014-01-13 14:53 - 00000000 ____D () C:\Users\admin\AppData\Local\gtk-2.0
2014-02-15 14:05 - 2013-11-04 17:59 - 00000000 ____D () C:\Program Files (x86)\Overwolf
2014-02-15 14:05 - 2013-11-04 17:48 - 00000000 ____D () C:\Users\admin\AppData\Local\Overwolf
2014-02-15 14:04 - 2014-02-15 14:04 - 00003174 _____ () C:\Windows\System32\Tasks\{EACE7BC1-CB24-44A2-B937-B703F4FC8F8B}
2014-02-15 13:56 - 2010-11-21 04:47 - 00025018 _____ () C:\Windows\PFRO.log
2014-02-14 14:59 - 2014-02-14 14:59 - 00000000 ____D () C:\Program Files (x86)\Traffic Simulator Configuration Tool
2014-02-14 14:41 - 2014-02-14 14:39 - 17632087 _____ () C:\Users\admin\Downloads\UPDATE_SKU2_TO_P1_B638.zip
2014-02-14 13:34 - 2014-02-14 13:34 - 00003172 _____ () C:\Windows\System32\Tasks\{51F7C50E-DB2A-478C-87D0-2DC4A7177004}
2014-02-13 21:47 - 2014-02-03 22:17 - 09779189 _____ () C:\Users\admin\Desktop\Human Colonies_2.xcf
2014-02-10 19:12 - 2013-04-08 18:16 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2014-02-07 22:14 - 2014-02-04 14:34 - 25059997 _____ () C:\Users\admin\Desktop\Thallarn_1.xcf
2014-02-04 18:51 - 2013-01-16 13:40 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-02-04 18:41 - 2014-02-04 13:39 - 04199189 _____ () C:\Users\admin\Desktop\SE Map.xcf
2014-02-04 13:29 - 2013-11-17 16:53 - 00000000 ____D () C:\ProgramData\Overwolf
2014-02-03 14:30 - 2014-01-29 16:01 - 00021840 ____T () C:\Windows\SysWOW64\SIntfNT.dll
2014-02-03 14:30 - 2014-01-29 16:01 - 00017212 ____T () C:\Windows\SysWOW64\SIntf32.dll
2014-02-03 14:30 - 2014-01-29 16:01 - 00012067 ____T () C:\Windows\SysWOW64\SIntf16.dll
2014-02-03 14:03 - 2014-02-03 12:11 - 02004070 _____ () C:\Users\admin\Desktop\Human Colonies.xcf
2014-02-02 18:40 - 2014-02-02 18:22 - 176785326 _____ () C:\Users\admin\Downloads\hqp2.zip
2014-01-31 14:18 - 2014-01-31 14:18 - 00000000 ____D () C:\Users\admin\Documents\Electronic Arts
2014-01-31 14:18 - 2014-01-31 14:18 - 00000000 ____D () C:\Users\admin\AppData\Local\Electronic Arts
2014-01-30 17:06 - 2014-01-30 16:32 - 321921474 _____ () C:\Users\admin\Downloads\avp207_v11_by_dex909.rar
2014-01-30 16:30 - 2014-01-30 16:29 - 07297476 _____ (Fox Interactive) C:\Users\admin\Downloads\avp2_en_096.exe
2014-01-30 16:30 - 2013-01-16 13:41 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-01-29 19:57 - 2013-03-06 20:13 - 00000000 ____D () C:\Users\admin\Desktop\Games
2014-01-29 19:03 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-29 16:14 - 2014-02-02 19:08 - 00000314 _____ () C:\Users\admin\Desktop\avp2cmds.txt
2014-01-29 16:13 - 2013-01-21 20:41 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-01-27 22:49 - 2014-01-01 17:12 - 00000000 ____D () C:\Users\admin\AppData\Local\The Witcher
2014-01-27 13:44 - 2014-01-27 13:39 - 48313789 _____ () C:\Users\admin\Downloads\8169809.SttfMnd-MrCvrp.zip
Some content of TEMP:
====================
C:\Users\admin\AppData\Local\Temp\AutoRun.exe
C:\Users\admin\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\admin\AppData\Local\Temp\CmdLineExt03.dll
C:\Users\admin\AppData\Local\Temp\cres.dll
C:\Users\admin\AppData\Local\Temp\cshell.dll
C:\Users\admin\AppData\Local\Temp\drm_dialogs.dll
C:\Users\admin\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\admin\AppData\Local\Temp\drm_dyndata_7380006.dll
C:\Users\admin\AppData\Local\Temp\drm_dyndata_7380007.dll
C:\Users\admin\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\admin\AppData\Local\Temp\GLF9649GLF9649.EXE
C:\Users\admin\AppData\Local\Temp\Installer.exe
C:\Users\admin\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\admin\AppData\Local\Temp\nvStInst.exe
C:\Users\admin\AppData\Local\Temp\SIntf16.dll
C:\Users\admin\AppData\Local\Temp\SIntf32.dll
C:\Users\admin\AppData\Local\Temp\SIntfNT.dll
C:\Users\admin\AppData\Local\Temp\sonarinst.exe
C:\Users\admin\AppData\Local\Temp\sres.dll
C:\Users\admin\AppData\Local\Temp\_is11BB.exe
C:\Users\admin\AppData\Local\Temp\_is1E3A.exe
C:\Users\admin\AppData\Local\Temp\_is2433.exe
C:\Users\admin\AppData\Local\Temp\_is2F4A.exe
C:\Users\admin\AppData\Local\Temp\_is4182.exe
C:\Users\admin\AppData\Local\Temp\_is42AA.exe
C:\Users\admin\AppData\Local\Temp\_is4D94.exe
C:\Users\admin\AppData\Local\Temp\_is5C91.exe
C:\Users\admin\AppData\Local\Temp\_is5D5B.exe
C:\Users\admin\AppData\Local\Temp\_is7001.exe
C:\Users\admin\AppData\Local\Temp\_is8027.exe
C:\Users\admin\AppData\Local\Temp\_is8729.exe
C:\Users\admin\AppData\Local\Temp\_is8851.exe
C:\Users\admin\AppData\Local\Temp\_isA84F.exe
C:\Users\admin\AppData\Local\Temp\_isB6C1.exe
C:\Users\admin\AppData\Local\Temp\_isC39D.exe
C:\Users\admin\AppData\Local\Temp\_isC909.exe
C:\Users\admin\AppData\Local\Temp\_isCEA3.exe
C:\Users\admin\AppData\Local\Temp\_isF48B.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-20 17:24
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-02-2014
Ran by admin at 2014-02-21 13:48:02
Running from C:\Users\admin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Computer Security (Enabled - Up to date) {15414183-282E-D62C-CA37-EF24860A2F17}
AS: Computer Security (Enabled - Up to date) {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
1187 - Episode One 1.3 (x32 Version: 1.3 - TeamGT)
Adobe Flash Player 11 ActiveX (x32 Version: 11.6.602.180 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Aliens versus Predator 2: Primal Hunt (x32 Version: - )
Aliens vs. Predator 2 (x32 Version: - )
ARMA 2 Operation Arrowhead Uninstall (x32 Version: - )
ArmA 2 Uninstall (x32 Version: - )
Arma: Gold Edition (x32 Version: - Bohemia Interactive)
Asmedia ASM104x USB 3.0 Host Controller Driver (x32 Version: 1.14.3.0 - Asmedia Technology)
Asmedia ASM106x SATA Host Controller Driver (x32 Version: 1.3.4.000 - Asmedia Technology)
ASUS Product Register Program (x32 Version: 1.0.014 - ASUS)
Battlefield 3™ (x32 Version: 1.5.0.0 - Electronic Arts)
Battlefield 4™ (x32 Version: 1.0.0.0 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.3.0 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (x32 Version: - )
BattlEye Uninstall (x32 Version: - )
Broadcom InConcert Maestro (Version: 1.0.5.3200 - Broadcom Corporation)
Broadcom Wireless Utility (Version: 5.100.196.16 - Broadcom Corporation)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
Computer Security 12.71.102.0 (release) (x32 Version: 12.71.102.0 - F-Secure Corporation) Hidden
Corsair USB Headset (x32 Version: 1.00.0007 - )
Crossfire 1.9 (HKCU Version: 1.90.00.00 - SWAT-Portal)
Crossfire1.9 (remove only) (x32 Version: - )
Diaspora version 1.0.4 (x32 Version: 1.0.4 - Diaspora Development)
Empire: Total War Demo (x32 Version: - The Creative Assembly)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
Fallout 3 (x32 Version: 1.00.0000 - Bethesda Softworks)
Freelancer (x32 Version: - )
F-Secure CCF Reputation (x32 Version: 1.0.25.1877 - F-Secure) Hidden
F-Secure CCF Scanning 1.23.124.8831 (release) (x32 Version: 1.23.124.8831 - F-Secure Corporation) Hidden
F-Secure Network CCF 1.02.126 (x32 Version: 1.02.126 - F-Secure Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
GIMP 2.8.10 (Version: 2.8.10 - The GIMP Team)
Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Grand Theft Auto III (x32 Version: - Rockstar Games)
Grand Theft Auto IV (x32 Version: - Rockstar North)
Grand Theft Auto: Vice City (x32 Version: - Rockstar Games)
Half-Life 2: Episode Two (x32 Version: - Valve)
Homeworld2 (x32 Version: - Sierra)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Hunted: The Demon's Forge Version 1.0 (x32 Version: 1.0 - Bethesda Softworks)
Imperium Galactica 2 (x32 Version: - )
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 8.0.2.1410 - Intel Corporation)
Intel(R) Network Connections 17.0.200.2 (Version: 17.0.200.2 - Intel)
Intel(R) Network Connections 17.0.200.2 (Version: 17.0.200.2 - Intel) Hidden
Intel(R) Rapid Storage Technology (x32 Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.225 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.23.605.1 - Intel Corporation)
Launch Pad (x32 Version: 1.71.340.0 - F-Secure Corporation)
Launch Pad (x32 Version: 1.71.340.0 - F-Secure Corporation) Hidden
Metro 2033 (x32 Version: - THQ)
Metro: Last Light (x32 Version: - )
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Game Studios Common Redistributables Pack 1 (x32 Version: 1.0.0 - Microsoft Game Studios) Hidden
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)
Microsoft StarLancer (x32 Version: - )
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft XML Parser (x32 Version: 8.20.8730.4 - Microsoft Corporation) Hidden
Napoleon: Total War (x32 Version: - The Creative Assembly)
Need for Speed Underground 2 (x32 Version: - )
Network Addon Mod (HKCU Version: 32 - The NAM Team)
NVIDIA 3D Vision Controller-Treiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.7 (Version: 1.7 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.140.952 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden
NVIDIA Update 9.3.16 (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 9.3.16 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.9 (Version: 1.2.9 - NVIDIA Corporation)
Online Safety 2.71.927.655 (x32 Version: 2.71.927.655 - F-Secure Corporation) Hidden
OpenAL (x32 Version: - )
Origin (x32 Version: 9.1.11.2678 - Electronic Arts, Inc.)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6636 - Realtek Semiconductor Corp.)
S.T.A.L.K.E.R. - Shadow of Chernobyl [v1.0005] (x32 Version: 1.0005 - THQ)
SC4 Mapper 2013 (HKCU Version: - )
SHIELD Streaming (Version: 1.6.34 - NVIDIA Corporation) Hidden
SimCity 4 Deluxe (x32 Version: - )
Sins of a Solar Empire: Rebellion (x32 Version: - )
Sleeping Dogs™ (x32 Version: - United Front Games)
Source SDK Base 2007 (x32 Version: - Valve)
SpaceEngine Version 0.9.7.1 (x32 Version: 0.9.7.1 - SpaceEngine)
Stalker Complete 2009 v1.4.4 (x32 Version: - )
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)
The Elder Scrolls III: Morrowind (x32 Version: - Bethesda Game Studios®)
The Elder Scrolls Online Beta (x32 Version: 0.3.4 - )
The Elder Scrolls V: Skyrim (x32 Version: - Bethesda Game Studios)
The Witcher (x32 Version: 1.00.0000 - CD Projekt Red)
Total War: ROME II (x32 Version: - Creative Assembly)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
VLC media player 2.0.5 (Version: 2.0.5 - VideoLAN)
WIDCOMM Bluetooth Software (Version: 6.5.0.3200 - Broadcom Corporation)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (Version: 4.20.0 - win.rar GmbH)
World In Conflict Editor (x32 Version: 1.2.1.0 - Massive Entertainment AB)
World in Conflict MW Mod 3.5 (HKCU Version: - )
WORLD IN CONFLICT: SOVIET ASSAULT (x32 Version: 1.0.1.1 - Ubisoft Entertainment)
X3 Terran Conflict v3.2 (x32 Version: - EGOSOFT)
X3: Albion Prelude (x32 Version: - Egosoft)
X3: Terran Conflict (x32 Version: - Egosoft)
==================== Restore Points =========================
31-12-2013 23:29:42 Geplanter Prüfpunkt
01-01-2014 14:36:28 Installiert The Witcher
01-01-2014 14:43:38 DirectX wurde installiert
13-01-2014 16:13:27 Geplanter Prüfpunkt
28-01-2014 18:03:29 Geplanter Prüfpunkt
29-01-2014 16:11:59 Installed Aliens versus Predator 2: Primal Hunt
05-02-2014 17:34:40 Geplanter Prüfpunkt
15-02-2014 13:04:36 Removed Overwolf
15-02-2014 13:05:49 Removed Overwolf
20-02-2014 14:41:03 DirectX wurde installiert
20-02-2014 14:54:54 DirectX wurde installiert
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {364EA5DB-15D9-4634-84B2-DE9D770A2ADD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-16] (Google Inc.)
Task: {4C4B6E98-5A01-4E90-8A8B-DE729E75BA7E} - System32\Tasks\{F9339031-2AF0-4648-8904-36A585EB0C05} => E:\Spiele\Fallout New Vegas\FalloutNVLauncher.exe
Task: {779FFCA9-CE35-4C22-9706-99AF2F32DC12} - System32\Tasks\Scheduled scanning task => C:\Program Files (x86)\Internet Security\apps\ComputerSecurity\Anti-Virus\fsav.exe [2012-10-18] (F-Secure Corporation)
Task: {77B4D8F8-F1D6-4FA7-8DA7-4A8220484852} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-16] (Google Inc.)
Task: {98E52C3A-D26C-4E33-9A4D-8FC3F8E34175} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2586655326-3906653631-2063846596-1000
Task: {B29433EF-F5A3-4614-B910-43E6E9A5F6F3} - System32\Tasks\{3D9D0E11-88EE-4BF4-B8CE-1889272CFEE6} => E:\Spiele\WORLD IN CONFLICT\wic.exe [2009-06-10] (Massive Entertainment)
Task: {F1B75800-1749-4646-BE28-B3C618FF4353} - System32\Tasks\{A1802F05-8587-442B-ADE3-7E188F7A24AB} => E:\Spiele\WORLD IN CONFLICT\wic.exe [2009-06-10] (Massive Entertainment)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Scheduled scanning task.job => C:\PROGRA~2\INTERN~2\apps\COMPUT~1\ANTI-V~1\fsav.exe
==================== Loaded Modules (whitelisted) =============
2013-01-16 14:20 - 2013-10-23 09:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-02-04 15:12 - 2013-10-29 15:38 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-03-02 18:08 - 2011-09-28 16:29 - 00905216 ____N () C:\Program Files\Corsair USB Headset\customapp\program\CAHS.EXE
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
Name: Broadcom Virtual Wireless Adapter
Description: Broadcom Virtual Wireless Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom
Service: BcmVWL
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/21/2014 01:48:03 PM) (Source: FSecure-FSecure-F-Secure DeepGuard) (User: )
Description: 1 2014-02-21 13:48:03+02:00 ADMIN-PC SYSTEM F-Secure DeepGuard
Application was blocked. This was determined to be a high-risk application by system control heuristics.
Application path: \\?\c:\windows\mod_frst.exe
File hash: 4bb423ae4bf7b46ba1cd43c521cf9314c03cf8c4
Error: (02/21/2014 01:14:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/21/2014 01:12:33 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (02/21/2014 11:02:19 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005
Error: (02/21/2014 10:07:51 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/21/2014 10:06:09 AM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (02/20/2014 04:14:44 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005
Error: (02/20/2014 03:32:12 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/20/2014 03:30:30 PM) (Source: Steam Client Service) (User: )
Description: Error: Failed to poke open firewall
Error: (02/19/2014 08:50:03 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005
System errors:
=============
Error: (02/21/2014 11:07:02 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:07:02 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:07:01 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:07:01 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:07:00 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:06:58 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:06:58 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:06:57 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:06:57 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Error: (02/21/2014 11:06:56 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
Microsoft Office Sessions:
=========================
Error: (02/21/2014 01:48:03 PM) (Source: FSecure-FSecure-F-Secure DeepGuard)(User: )
Description: 1 2014-02-21 13:48:03+02:00 ADMIN-PC SYSTEM F-Secure DeepGuard
Application was blocked. This was determined to be a high-risk application by system control heuristics.
Application path: \\?\c:\windows\mod_frst.exe
File hash: 4bb423ae4bf7b46ba1cd43c521cf9314c03cf8c4
Error: (02/21/2014 01:14:14 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/21/2014 01:12:33 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (02/21/2014 11:02:19 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005
Error: (02/21/2014 10:07:51 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/21/2014 10:06:09 AM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (02/20/2014 04:14:44 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005
Error: (02/20/2014 03:32:12 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/20/2014 03:30:30 PM) (Source: Steam Client Service)(User: )
Description: Failed to poke open firewall
Error: (02/19/2014 08:50:03 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005
==================== Memory info ===========================
Percentage of memory in use: 15%
Total physical RAM: 16332.07 MB
Available physical RAM: 13858.19 MB
Total Pagefile: 32662.33 MB
Available Pagefile: 30001.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:223.57 GB) (Free:82.11 GB) NTFS
Drive e: (Daten) (Fixed) (Total:931.41 GB) (Free:561.55 GB) NTFS
Drive f: (LACIE SHARE) (Fixed) (Total:130.38 GB) (Free:112.86 GB) FAT32
Drive g: (LaCie) (Fixed) (Total:801.1 GB) (Free:638.59 GB) NTFS
Drive h: () (Removable) (Total:15.09 GB) (Free:1.07 GB) FAT32
Drive i: () (Removable) (Total:15.09 GB) (Free:11 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: C72F980C)
Partition: GPT Partition Type.
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 224 GB) (Disk ID: C72F9874)
Partition: GPT Partition Type.
========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 8F82B942)
Partition 1: (Not Active) - (Size=130 GB) - (Type=0C)
Partition 2: (Not Active) - (Size=801 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition: GPT Partition Type.
========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-21 14:03:49
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2 INTEL_SS rev.300i 223.57GB
Running: Gmer-19357.exe; Driver: C:\Users\admin\AppData\Local\Temp\aglorpod.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Internet Security\apps\CCF_Reputation\fsorsp.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000774b1465 2 bytes [4B, 77]
.text C:\Program Files (x86)\Internet Security\apps\CCF_Reputation\fsorsp.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774b14bb 2 bytes [4B, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000774b1465 2 bytes [4B, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774b14bb 2 bytes [4B, 77]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000774b1465 2 bytes [4B, 77]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[2544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774b14bb 2 bytes [4B, 77]
.text ... * 2
.text C:\Windows\SysWOW64\PnkBstrA.exe[2616] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 00000000707d1a22 2 bytes [7D, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2616] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 00000000707d1ad0 2 bytes [7D, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2616] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 00000000707d1b08 2 bytes [7D, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2616] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 00000000707d1bba 2 bytes [7D, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2616] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 00000000707d1bda 2 bytes [7D, 70]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000774b1465 2 bytes [4B, 77]
.text C:\Windows\SysWOW64\PnkBstrA.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774b14bb 2 bytes [4B, 77]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000774b1465 2 bytes [4B, 77]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[3928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774b14bb 2 bytes [4B, 77]
.text ... * 2
.text C:\Windows\SysWOW64\RunDll32.exe[5668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000774b1465 2 bytes [4B, 77]
.text C:\Windows\SysWOW64\RunDll32.exe[5668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000774b14bb 2 bytes [4B, 77]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\94dbc9e2f3fb
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\94dbc9e2f3fb (not active ControlSet)
---- EOF - GMER 2.1 ----
PS: Nach der Deaktivierung der Netzwerkverbindung für den Gmer-Scan war es hinterher unmöglich diese wieder zu aktivieren, auch wollte sich der Rechner nicht mehr herunterfahren lassen. Nach dem Neustart war jedoch alles wieder normal. |
|
21.02.2014, 20:20
| #2 |
| /// the machine /// TB-Ausbilder    | doppelte conhost und csrss.exe ohne Dateipfad Hi,
__________________alles sauber.
__________________ |
|
22.02.2014, 10:47
| #3 |
| | doppelte conhost und csrss.exe ohne Dateipfad Hallo,
__________________Danke für die schnelle Antwort, allerdings habe ich noch ein paar Fragen: Spielt es keine Rolle, dass bei den Scans Fehler aufgetreten sind und diese dadurch unvollständig sind? Bei gewissen Prozessen (wie eben der conhost und csrss) kann es also sein, dass die Beschreibung und der Dateipfad im Taskmanager fehlen ohne dass dies gleich mit einem Schädling zu tun hat? Aus welchem Grund werden zum Beispiel beim GMER-Scan nicht alle Festplatten gescannt? |
|
23.02.2014, 11:09
| #4 | ||
| /// the machine /// TB-Ausbilder | doppelte conhost und csrss.exe ohne Dateipfad Gmer scannt grundsätzlich eigentlich nur die C Platte, das ist ja auch die einzige die intressiert (Windows Partition). Zitat:
 Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.02.2014, 17:41
| #5 |
| | doppelte conhost und csrss.exe ohne Dateipfad Hallo schrauber, vielen Dank für die Auskunft. Hab mir jetzt mal Malwarebytes Anti-Malware heruntergeladen, da hier im Forum doch sehr viel davon die Rede war. Hat (im Gegensatz zu F-Secure  ) prompt was gefunden, scheint aber nichts ernstes zu sein. Wie sicher ist Malwarebytes denn beim Entfernen von gefundener Malware? Gewisse Programme würden die Spuren ja nur verwischen und nicht vollständig entfernen wie ich hier irgendwo gelesen habe.Hier sonst schnell noch der mbam log: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.23.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 admin :: ADMIN-PC [Administrator] 23.02.2014 16:31:08 mbam-log-2014-02-23 (16-31-08).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 698739 Laufzeit: 48 Minute(n), 18 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\admin\AppData\Local\Temp\smartbar\Installer.msi (PUP.Optional.SmartBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Mit freundlichen Grüssen Jerot |
|
24.02.2014, 17:17
| #6 |
| /// the machine /// TB-Ausbilder | doppelte conhost und csrss.exe ohne Dateipfad MBAM ist schon sehr gut. Aber wie du schon sagst, der Fund is nix
__________________ --> doppelte conhost und csrss.exe ohne Dateipfad |
|
| Themen zu doppelte conhost und csrss.exe ohne Dateipfad |
| 4d36e972-e325-11ce-bfc1-08002be10318, avp, blockiert, conhost.exe, doppelt, failed, flash player, frage, google, helper, home, homepage, iexplore.exe, installation, internet, internet explorer, nicht öffnen, officejet, prozesse, realtek, registry, rundll, schwankender speicherplatz, sicherheit, sierra, software, svchost.exe, system, taskmanager, usb, vice city, windows, windows 7 64-bit, windows xp |
Linear-Darstellung
