| |
| |||||||
Log-Analyse und Auswertung: Vista: teilweise extrem langsam, Malwarebytes findet immer wieder BedrohungenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
14.03.2014, 21:47
| #1 |
 |  Vista: teilweise extrem langsam, Malwarebytes findet immer wieder Bedrohungen Hallo, habe hier das Notebook einer Bekannten (Medion Akoya Celeron Dual-Core) mit Win Vista. Sie hat mir das Teil gegeben, weil alles schon extrem langsam war. Immer auch wieder lästige Werbebanner. Bitte um Hilfe. Habe aber bereits folgende Programme deinstalliert:
Avira war nicht richtig registriert (Meldung "Keine Antivirensoftware installiert") und Windows Defender war deaktiviert. Nachdem ich Avira neu installiert habe und Windows Defender upgedatet habe, laufen beide wieder richtig. (sieht zumindest so aus ) Avira vollständigen Scan durchgeführt. Nichts gefunden. Malwarebytes findet aber bei jedem Scan etwas. Letztes Log: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.03.12.10 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 8.0.6001.19499 agnes :: AGNES-PC [Administrator] Schutz: Aktiviert 14.03.2014 14:54:43 mbam-log-2014-03-14 (14-54-43).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 529550 Laufzeit: 2 Stunde(n), 16 Minute(n), 44 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCU\Software\AppDataLow\Software\PriceGong (PUP.Optional.PriceGong.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1 (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 11 C:\Users\Elias\AppData\Local\Temp\6DD2F216-BAB0-7891-96E7-802D313633B7\MyBabylonTB.exe (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\Downloads\SoftonicDownloader_fuer_tubebox.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\System32\roboot.exe (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\eng_rcp.dat (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\ExcludeList.rcp (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\log_02-20-2014.log (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\log_02-22-2014.log (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\log_02-26-2014.log (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\results.rcp (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Elias\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\TempHLList.rcp (PUP.Optional.RegCleanerPro.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:54 on 12/03/2014 (agnes)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-03-2014 Ran by agnes (administrator) on AGNES-PC on 14-03-2014 18:38:15 Running from C:\Users\agnes\Desktop Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe ( ) C:\Windows\system32\lxbxcoms.exe (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Prolific Technology Inc.) C:\Windows\system32\IoctlSvc.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe () C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe (Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (S3 Graphics Co., Ltd.) C:\Windows\System32\s3trayp.exe () C:\Windows\System32\ESB.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Lexmark International, Inc.) C:\Program Files\Lexmark 7100 Series\lxbxmon.exe (Lexmark International Inc.) C:\Program Files\Lexmark 7100 Series\ezprint.exe (SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Telekom Austria TA AG) C:\Program Files\aon\OnlineFestplatte\OnlineFestplatte.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIGBU.EXE (ACD Systems, Ltd.) C:\Program Files\Common Files\ACD Systems\DE\DevDetect.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4018176 2006-11-20] (Realtek Semiconductor) HKLM\...\Run: [S3Trayp] - S3trayp.exe -chkautorun HKLM\...\Run: [ESB] - C:\Windows\system32\ESB.EXE [266240 2006-05-29] () HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1025320 2007-10-09] (Synaptics, Inc.) HKLM\...\Run: [LanguageShortcut] - C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe [52256 2007-01-08] () HKLM\...\Run: [SynTPStart] - C:\Program Files\Synaptics\SynTP\SynTPStart.exe [102400 2007-10-09] (Synaptics, Inc.) HKLM\...\Run: [LXBXCATS] - C:\Windows\system32\spool\DRIVERS\W32X86\3\LXBXtime.dll [73728 2007-02-22] () HKLM\...\Run: [lxbxmon.exe] - C:\Program Files\Lexmark 7100 Series\lxbxmon.exe [205744 2007-05-11] (Lexmark International, Inc.) HKLM\...\Run: [EzPrint] - C:\Program Files\Lexmark 7100 Series\ezprint.exe [103344 2007-05-11] (Lexmark International Inc.) HKLM\...\Run: [NBKeyScan] - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-12-02] (Nero AG) HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION) HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Avira Systray] - C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [172624 2014-03-07] (Avira Operations GmbH & Co. KG) HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\Run: [SpybotSD TeaTimer] - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.) HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\Run: [OnlineFestplatte] - C:\Program Files\aon\Onlinefestplatte\OnlineFestplatte.exe [253976 2008-01-25] (Telekom Austria TA AG) HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424 2009-03-25] (Nero AG) HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\Run: [EPSON BX620FWD Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGBU.EXE [201216 2010-01-12] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\Run: [Device Detector] - DevDetect.exe -autorun HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\Run: [Akamai NetSession Interface] - "C:\Users\agnes\AppData\Local\Akamai\netsession_win.exe" HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_12_0_0_70_Plugin.exe -update plugin HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: F - F:\AutoRun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: G - G:\AutoRun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {2743aae0-35e2-11df-99fc-0015afd4c80a} - E:\AutoRun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {40584551-312e-11df-b98f-0040d0ffdf11} - F:\Autorun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {6e010f4b-6ffe-11df-86a9-806e6f6e6963} - F:\AutoRun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {8f14f51d-a227-11df-8a8a-0040d0ffdf11} - E:\AutoRun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {a986bc94-223a-11df-921d-0040d0ffdf11} - F:\Autorun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {b9c4cd97-3a6a-11df-b6e9-806e6f6e6963} - F:\AutoRun.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {e66884f2-ddb3-11de-936e-806e6f6e6963} - F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe HKU\S-1-5-21-1063051009-1961705550-1701730032-1000\...\MountPoints2: {f74c1e26-5459-11df-acc9-0040d0ffdf11} - RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe Startup: C:\Users\Elias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.telekom.at/suche SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647 BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: PCCBHO.CPCCBHO - {22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF} - C:\Program Files\Winferno\PC Confidential\PCCBHO.dll (Capital Intellect Inc) BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.) BHO: No Name - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO: Yontoo - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo\YontooIEClient.dll (Yontoo LLC) Toolbar: HKLM - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) Toolbar: HKCU - No Name - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - No File Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - No File Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 Tcpip\..\Interfaces\{D4D1A5F8-13BC-4F99-A375-877A1C4F3C9D}: [NameServer]195.3.96.67 213.33.98.136 FireFox: ======== FF ProfilePath: C:\Users\agnes\AppData\Roaming\Mozilla\Firefox\Profiles\pb6sgljk.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml Chrome: ======= CHR HomePage: hxxp://www.google.com ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [116816 2014-03-07] (Avira Operations GmbH & Co. KG) R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) R2 lxbx_device; C:\Windows\system32\lxbxcoms.exe [537520 2007-03-22] ( ) R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] () R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.) R2 SystemStore; C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe [50176 2012-05-21] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2014-01-01] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2014-01-01] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG) R3 FETND6V; C:\Windows\System32\DRIVERS\fetnd6v.sys [43520 2008-09-22] (VIA Technologies, Inc. ) S3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc. ) S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation) U0 rgeer; C:\Windows\System32\drivers\nbcygqs.sys [54016 2014-03-14] () R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [252416 2007-06-01] (Realtek Semiconductor Corporation ) R3 S3GIGP; C:\Windows\System32\DRIVERS\VTGKModeDX32.sys [791040 2007-07-20] (S3 Graphics Co., Ltd.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-05-11] (Avira GmbH) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-14 18:37 - 2014-03-14 18:37 - 00054016 _____ () C:\Windows\system32\Drivers\nbcygqs.sys 2014-03-12 21:58 - 2014-03-12 21:59 - 00024089 _____ () C:\Users\agnes\Desktop\Addition.txt 2014-03-12 21:56 - 2014-03-14 18:38 - 00015147 _____ () C:\Users\agnes\Desktop\FRST.txt 2014-03-12 21:56 - 2014-03-14 18:38 - 00000000 ____D () C:\FRST 2014-03-12 21:55 - 2014-03-12 21:55 - 01145856 _____ (Farbar) C:\Users\agnes\Desktop\FRST.exe 2014-03-12 21:54 - 2014-03-12 21:55 - 00000472 _____ () C:\Users\agnes\Downloads\defogger_disable.log 2014-03-12 21:54 - 2014-03-12 21:54 - 00000000 _____ () C:\Users\agnes\defogger_reenable 2014-03-12 21:53 - 2014-03-12 21:53 - 00050477 _____ () C:\Users\agnes\Downloads\Defogger.exe 2014-03-12 21:49 - 2014-03-12 21:49 - 00000910 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-12 21:49 - 2014-03-12 21:49 - 00000000 ____D () C:\Users\agnes\AppData\Roaming\Malwarebytes 2014-03-12 21:49 - 2014-03-12 21:49 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-12 21:49 - 2014-03-12 21:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware 2014-03-12 21:49 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-12 21:48 - 2014-03-12 21:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\agnes\Downloads\mbam-setup-1.75.0.1300.exe 2014-03-12 21:28 - 2014-03-12 21:28 - 04051048 _____ (Avira Operations GmbH & Co. KG) C:\Users\agnes\Downloads\avira_de_av___ws.exe 2014-03-12 21:28 - 2014-03-12 21:28 - 00001006 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-03-12 21:28 - 2014-03-12 21:28 - 00000000 ____D () C:\ProgramData\Package Cache 2014-02-20 21:40 - 2014-03-14 18:37 - 00000000 ____D () C:\Users\Elias\AppData\Roaming\Systweak 2014-02-19 20:20 - 2014-02-19 20:20 - 00000000 ____D () C:\Users\Elias\AppData\Roaming\Avira 2014-02-16 11:53 - 2014-02-02 21:10 - 11111424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 06019584 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 02005504 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-16 11:53 - 2014-02-02 21:10 - 01213440 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-16 11:53 - 2014-02-02 21:10 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll 2014-02-16 11:53 - 2014-02-01 23:54 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-02-16 11:53 - 2014-02-01 23:47 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-16 11:53 - 2014-02-01 23:47 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-16 11:53 - 2014-02-01 23:46 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-16 11:53 - 2014-02-01 23:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-02-16 11:53 - 2013-12-22 16:42 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-16 11:52 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll ==================== One Month Modified Files and Folders ======= 2014-03-14 18:38 - 2014-03-12 21:56 - 00015147 _____ () C:\Users\agnes\Desktop\FRST.txt 2014-03-14 18:38 - 2014-03-12 21:56 - 00000000 ____D () C:\FRST 2014-03-14 18:37 - 2014-03-14 18:37 - 00054016 _____ () C:\Windows\system32\Drivers\nbcygqs.sys 2014-03-14 18:37 - 2014-02-20 21:40 - 00000000 ____D () C:\Users\Elias\AppData\Roaming\Systweak 2014-03-14 18:37 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\LiveKernelReports 2014-03-14 18:36 - 2011-04-30 21:40 - 00000396 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{5F1D3512-AD3D-4A15-B530-A3DCAD61B31B}.job 2014-03-14 18:36 - 2010-04-10 12:06 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{4AC8B7AF-F916-4E15-B70B-E04EB3A8D1E2}.job 2014-03-14 18:36 - 2009-08-03 10:20 - 01628721 _____ () C:\Windows\WindowsUpdate.log 2014-03-14 17:47 - 2012-07-14 09:51 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-14 16:33 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-14 16:33 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-13 13:47 - 2012-05-11 15:18 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-03-13 13:47 - 2011-10-22 18:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-03-12 21:59 - 2014-03-12 21:58 - 00024089 _____ () C:\Users\agnes\Desktop\Addition.txt 2014-03-12 21:55 - 2014-03-12 21:55 - 01145856 _____ (Farbar) C:\Users\agnes\Desktop\FRST.exe 2014-03-12 21:55 - 2014-03-12 21:54 - 00000472 _____ () C:\Users\agnes\Downloads\defogger_disable.log 2014-03-12 21:54 - 2014-03-12 21:54 - 00000000 _____ () C:\Users\agnes\defogger_reenable 2014-03-12 21:54 - 2009-08-03 10:28 - 00000000 ____D () C:\Users\agnes 2014-03-12 21:53 - 2014-03-12 21:53 - 00050477 _____ () C:\Users\agnes\Downloads\Defogger.exe 2014-03-12 21:49 - 2014-03-12 21:49 - 00000910 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-12 21:49 - 2014-03-12 21:49 - 00000000 ____D () C:\Users\agnes\AppData\Roaming\Malwarebytes 2014-03-12 21:49 - 2014-03-12 21:49 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-12 21:49 - 2014-03-12 21:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware 2014-03-12 21:48 - 2014-03-12 21:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\agnes\Downloads\mbam-setup-1.75.0.1300.exe 2014-03-12 21:40 - 2012-03-17 10:59 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-03-12 21:29 - 2008-01-21 08:16 - 01567488 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-12 21:28 - 2014-03-12 21:28 - 04051048 _____ (Avira Operations GmbH & Co. KG) C:\Users\agnes\Downloads\avira_de_av___ws.exe 2014-03-12 21:28 - 2014-03-12 21:28 - 00001006 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-03-12 21:28 - 2014-03-12 21:28 - 00000000 ____D () C:\ProgramData\Package Cache 2014-03-12 21:28 - 2013-05-11 09:33 - 00000000 ____D () C:\ProgramData\Avira 2014-03-12 21:28 - 2013-05-11 09:33 - 00000000 ____D () C:\Program Files\Avira 2014-03-12 21:26 - 2012-05-15 09:47 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-03-12 21:23 - 2009-08-03 10:28 - 00000000 ____D () C:\Users\agnes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema 2014-03-12 21:21 - 2010-05-23 16:18 - 00000416 _____ () C:\Windows\Tasks\PCConfidential.job 2014-03-12 21:21 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-12 21:20 - 2008-07-24 07:27 - 00000000 ____D () C:\Program Files\Google 2014-03-12 21:20 - 2008-01-21 03:47 - 00119382 _____ () C:\Windows\PFRO.log 2014-03-12 21:19 - 2006-11-02 14:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-12 21:04 - 2013-03-14 09:46 - 00000000 ____D () C:\Users\agnes\AppData\Roaming\Systweak 2014-03-12 20:19 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-03-12 19:55 - 2009-08-03 10:29 - 00000000 ____D () C:\Users\agnes\AppData\Local\Google 2014-03-12 19:55 - 2008-07-24 07:27 - 00000000 ____D () C:\ProgramData\Google 2014-03-02 10:03 - 2009-09-07 11:07 - 00000000 ____D () C:\Program Files\Lx_cats 2014-03-02 10:01 - 2010-05-31 17:24 - 00000000 ____D () C:\Users\Elias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema 2014-02-19 20:20 - 2014-02-19 20:20 - 00000000 ____D () C:\Users\Elias\AppData\Roaming\Avira 2014-02-16 11:57 - 2013-08-15 02:10 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-16 11:54 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe Files to move or delete: ==================== C:\Users\agnes\epson326477eu.exe C:\Users\agnes\epson373287eu.exe C:\Users\agnes\epson373413eu.exe C:\Users\Elias\AT-SkiChallenge11.exe Some content of TEMP: ==================== C:\Users\agnes\AppData\Local\Temp\AskSLib.dll C:\Users\agnes\AppData\Local\Temp\avgnt.exe C:\Users\agnes\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe C:\Users\agnes\AppData\Local\Temp\MgxVistaTools.dll C:\Users\agnes\AppData\Local\Temp\_isB9C0.exe C:\Users\Elias\AppData\Local\Temp\7za.exe C:\Users\Elias\AppData\Local\Temp\AskSLib.dll C:\Users\Elias\AppData\Local\Temp\avgnt.exe C:\Users\Elias\AppData\Local\Temp\dhpb3rff.dll C:\Users\Elias\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe C:\Users\Elias\AppData\Local\Temp\GLF7847.tmp.ConduitEngineSetup.exe C:\Users\Elias\AppData\Local\Temp\ietBB01.tmp.exe C:\Users\Elias\AppData\Local\Temp\softonic-de3.exe C:\Users\Elias\AppData\Local\Temp\Softonicde3.exe C:\Users\Elias\AppData\Local\Temp\sqlite3.exe C:\Users\Elias\AppData\Local\Temp\tbuTor.dll C:\Users\Elias\AppData\Local\Temp\tmp8624.tmp.exe C:\Users\Elias\AppData\Local\Temp\tmpD725.tmp.exe C:\Users\Elias\AppData\Local\Temp\TubeBox_Setup.exe C:\Users\Elias\AppData\Local\Temp\YontooIEClient.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-12 21:32 ==================== End Of Log ============================ Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-03-2014
Ran by agnes at 2014-03-14 18:39:03
Running from C:\Users\agnes\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
ACDSee for PENTAX 3.0 (HKLM\...\{C40FDA46-40CD-46EE-A79D-EA4AE56EA008}) (Version: 9.0.34 - ACD Systems Ltd.)
Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
aon Online Festplatte (entfernen) (HKCU\...\OnlineFestplatte) (Version: - )
aonFTP (HKLM\...\aonFTP) (Version: - Telekom Austria TA AG)
aonFTP (Version: 1.6 - Telekom Austria TA AG) Hidden
aonUpdate (HKLM\...\aonUpdate) (Version: - Telekom Austria TA AG)
aonUpdate (Version: 1.3 - Telekom Austria TA AG) Hidden
Avira (HKLM\...\{b0281a65-bf49-4b99-9ba4-8bd5acf46421}) (Version: 1.0.5179.26566 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.0.5179.26566 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.338 - Avira)
Conduit Engine (HKLM\...\conduitEngine) (Version: 6.2.2.4 - Conduit Ltd.) <==== ATTENTION
Controller (HKLM\...\Controller) (Version: - Telekom Austria TA AG)
Controller (Version: 2.7 - Telekom Austria TA AG) Hidden
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.1109a - CyberLink Corp.)
CyberLink Power2Go (Version: 6.0.1109a - CyberLink Corp.) Hidden
Easy Start Button (HKLM\...\ESB) (Version: - )
EPSON BX620FWD Series Handbuch (HKLM\...\EPSON BX620FWD Series Manual) (Version: - )
EPSON BX620FWD Series Netzwerk-Handbuch (HKLM\...\EPSON BX620FWD Series Network Guide) (Version: - )
EPSON BX620FWD Series Printer Uninstall (HKLM\...\EPSON BX620FWD Series) (Version: - SEIKO EPSON Corporation)
Epson Easy Photo Print 2 (HKLM\...\{310C1558-F6B5-4889-98B0-7471966BA7F2}) (Version: 2.2.3.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EpsonNet Print (HKLM\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
EpsonNet Setup 3.3 (HKLM\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.3a - SEIKO EPSON CORPORATION)
Final Media Player 2010 (HKLM\...\FinalMediaPlayer_is1) (Version: - Bitberry Software) <==== ATTENTION
Firebird SQL Server - MAGIX Edition (HKLM\...\{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}) (Version: 2.1.27.0 - MAGIX AG)
Free Audio CD Burner version 1.4 (HKLM\...\Free Audio CD Burner_is1) (Version: - DVDVideoSoft Limited.)
Free YouTube to MP3 Converter version 3.7 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: - DVDVideoSoft Limited.)
HappyFoto Bestellassistent (nur entfernen) (HKLM\...\HF_Bestellassistent) (Version: - )
HappyFoto-Designer 4.4 (HKLM\...\HappyFoto-Designer_is1) (Version: - )
Highspeed-Internet-Installation (HKLM\...\Highspeed-Internet-Installation) (Version: - Telekom Austria TA AG)
Highspeed-Internet-Installation (Version: 1.0.0.2 - Telekom Austria TA AG) Hidden
Hofer Foto Manager Free (HKLM\...\Hofer Foto Manager Free D) (Version: 3.4.0.466 - MAGIX AG)
Hofer Foto Service (HKLM\...\Hofer Foto Service D) (Version: 1.12.0.95 - MAGIX AG)
Hofer Fotobuch und Kalender Druck Service (HKLM\...\Pixelspeed_LayouterH) (Version: - )
Hofer Online Druck Service 3.0.6.0 (D) (HKLM\...\Hofer Online Druck Service D) (Version: 3.0.6.0 - MAGIX AG)
Java(TM) 6 Update 5 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160050}) (Version: 1.6.0.50 - Sun Microsystems, Inc.)
Lexmark 7100 Series (HKLM\...\Lexmark 7100 Series) (Version: - Lexmark International, Inc.)
MAGIX Foto Manager 9 (HKLM\...\MAGIX Foto Manager 9 D) (Version: 7.0.0.91 - MAGIX AG)
MAGIX Online Druck Service (HKLM\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)
MAGIX Screenshare (HKLM\...\MAGIX Screenshare D) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Xtreme Web Designer 5 5.0.2.10712 (D) (HKLM\...\MAGIX Xtreme Web Designer 5 D) (Version: 5.0.2.10712 - MAGIX AG)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation)
MEDION Fotos auf CD Hofer (HKLM\...\MEDION Fotos auf CD Hofer D) (Version: 6.0.2.0 - MAGIX AG)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Windows Media Video 9 VCM (HKLM\...\WMV9_VCM) (Version: - )
Mobiles Internet für unterwegs (HKLM\...\Mobiles Internet für unterwegs) (Version: - Telekom Austria TA AG)
Mobiles Internet für unterwegs (Version: 1.6.0.25 - Telekom Austria TA AG) Hidden
Mozilla Firefox 27.0.1 (x86 de) (HKLM\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{C9FFC925-E27E-436E-A2DF-652324D51031}) (Version: 8.3.630 - Nero AG)
neroxml (Version: 1.0.0 - Nero AG) Hidden
OpenOffice.org 3.1 (HKLM\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9399 - OpenOffice.org)
PC Confidential 2008 (HKLM\...\PCConfidential_is1) (Version: 2008 - Winferno.com)
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PhotoNow! (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.0.4310 - CyberLink Corp.)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2209a - CyberLink Corp.)
PowerDirector (Version: 6.5.2209a - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation)
PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 4.2.2219 - CyberLink Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5464 - )
Sicherheitsupdate für Windows Media Player (KB2845142) (HKLM\...\KB2845142_WM64) (Version: - Microsoft Corporation)
Skype™ 5.10 (HKLM\...\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}) (Version: 5.10.116 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 10.0.19.0 - Synaptics)
TubeBox (HKLM\...\{D8C04BEB-2F74-4321-AF24-83B70953005A}) (Version: 3.6 - Freemium)
TubeBox! (HKLM\...\{A78A5C61-2397-407E-A41F-0A0FFAD2572F}) (Version: 3.4.9 - Jens Lorek)
Uninstall 1.0.0.1 (HKLM\...\Uninstall_is1) (Version: - )
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
VIA Display Vista Driver 7.14.14.0019 (HKLM\...\VIA Chrome9 HC IGP Family Windows Vista Display) (Version: - )
VIA Rhine Family Fast Ethernet Adapter (HKLM\...\VN_VUIns_Rhine_VIA) (Version: - )
Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)
Yontoo 1.10.02 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.02 - Yontoo LLC) <==== ATTENTION
==================== Restore Points =========================
02-01-2014 09:26:18 Geplanter Prüfpunkt
19-01-2014 14:24:01 Geplanter Prüfpunkt
19-01-2014 17:11:28 Windows Update
16-02-2014 10:47:21 Windows Update
19-02-2014 18:43:49 Windows Update
20-02-2014 20:43:11 Windows Update
21-02-2014 09:23:45 Geplanter Prüfpunkt
22-02-2014 20:42:01 Geplanter Prüfpunkt
26-02-2014 14:18:17 Geplanter Prüfpunkt
12-03-2014 18:52:32 Windows Update
14-03-2014 13:52:04 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2006-11-02 11:23 - 2010-05-28 11:13 - 00396959 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 www.123fporn.info
127.0.0.1 123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: {0F006B5B-FD4C-4BD6-8C42-1C1CAD82FC73} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {16E94130-E421-4333-9565-659549382BB9} - System32\Tasks\{7D94D76E-24A4-40C0-9719-E1E4F3689740} => C:\Program Files\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2E23350E-827E-4A7A-971C-C728A90C714A} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - agnes => C:\Program Files\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {621CB0A8-C70E-4338-8408-DB2F5186D138} - System32\Tasks\PCConfidential => C:\Program Files\Winferno\PC Confidential\PCConfidential.exe [2008-04-01] (Capital Intellect, Inc)
Task: {85D61FA7-00CE-4F24-8ABB-B0BF06825358} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {DF052C4B-2D7E-4236-B6C1-03348DE8CF0D} - System32\Tasks\{839FEA11-E00F-4485-85F8-A44C47D3C0BF} => Firefox.exe hxxp://ui.skype.com/ui/0/5.8.0.158/de/abandoninstall?source=lightinstaller&page=tsProgressBar
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {ECB104B9-3462-4F25-AEB1-A9FA0F91B78A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13] (Adobe Systems Incorporated)
Task: {FC38F5F8-B552-4B4B-81D1-0500A2C489C9} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\PCConfidential.job => C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{4AC8B7AF-F916-4E15-B70B-E04EB3A8D1E2}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{5F1D3512-AD3D-4A15-B530-A3DCAD61B31B}.job => C:\Windows\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) =============
2013-05-11 09:33 - 2013-05-11 09:23 - 00397704 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2008-06-26 05:36 - 2007-01-09 10:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2012-05-21 14:42 - 2012-05-21 14:42 - 00050176 _____ () C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.WindowsService.exe
2012-05-21 14:42 - 2012-05-21 14:42 - 00020480 _____ () C:\Program Files\Freemium\SystemStore\Freemium.SystemStore.Infrastructure.dll
2008-06-25 13:36 - 2006-05-29 12:40 - 00266240 _____ () C:\Windows\System32\ESB.EXE
2009-09-07 11:08 - 2005-09-20 07:40 - 00122880 _____ () C:\Program Files\Lexmark 7100 Series\lxbxdrec.dll
2009-09-07 11:08 - 2005-06-14 16:08 - 00196608 _____ () C:\Program Files\Lexmark 7100 Series\iptk.dll
2014-03-12 21:28 - 2014-03-07 14:48 - 00049744 _____ () C:\Users\agnes\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-03-07 14:47 - 2014-03-07 14:47 - 00111696 _____ () C:\Program Files\Avira\My Avira\Avira.OE.NativeCore.dll
2014-03-07 14:48 - 2014-03-07 14:48 - 00061520 _____ () C:\Program Files\Avira\My Avira\Avira.OE.AvConnectorNative.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\agnes\Documents\Frühlingskurs Haag.eml:OECustomProperty
AlternateDataStreams: C:\Users\agnes\Documents\Kostenvoranschlag Bepflanzung.eml:OECustomProperty
AlternateDataStreams: C:\Users\agnes\Documents\Logo.eml:OECustomProperty
AlternateDataStreams: C:\Users\agnes\Documents\Re_ Visitenkarte druckfähig.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/12/2014 09:21:29 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/12/2014 09:19:55 PM) (Source: SDWinSec.exe) (User: )
Description: Der Computer wird heruntergefahren
Error: (03/12/2014 08:02:37 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070003
Error: (03/12/2014 07:50:17 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung DevDetect.exe, Version 3.1.45.1, Zeitstempel 0x45f60020, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000, Ausnahmecode 0xc0000005, Fehleroffset 0x6d68632e,
Prozess-ID 0xdc0, Anwendungsstartzeit DevDetect.exe0.
Error: (03/12/2014 07:47:34 PM) (Source: UpdateService) (User: )
Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen
Error: (03/12/2014 07:47:31 PM) (Source: LaunchSystemStore) (User: )
Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen
Error: (03/12/2014 07:47:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/02/2014 10:00:11 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/26/2014 02:22:54 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung NMIndexStoreSvr.exe, Version 3.3.10.0, Zeitstempel 0x49c9efad, fehlerhaftes Modul NMIndexStoreSvr.exe, Version 3.3.10.0, Zeitstempel 0x49c9efad, Ausnahmecode 0xc0000409, Fehleroffset 0x001101f2,
Prozess-ID 0xe00, Anwendungsstartzeit NMIndexStoreSvr.exe0.
Error: (02/26/2014 02:19:16 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (03/14/2014 02:33:13 PM) (Source: DCOM) (User: )
Description: {6295DF2D-35EE-11D1-8707-00C04FD93327}
Error: (03/13/2014 05:25:04 PM) (Source: Service Control Manager) (User: )
Description: 30000AntiVirSchedulerService
Error: (03/12/2014 09:22:50 PM) (Source: Service Control Manager) (User: )
Description: cdrom
Error: (03/12/2014 09:21:30 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (03/12/2014 07:49:23 PM) (Source: Service Control Manager) (User: )
Description: cdrom
Error: (03/12/2014 07:47:14 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (03/12/2014 07:46:49 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 02.03.2014 um 18:10:27 unerwartet heruntergefahren.
Error: (03/02/2014 10:01:13 AM) (Source: Service Control Manager) (User: )
Description: cdrom
Error: (03/02/2014 10:00:11 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (02/26/2014 02:20:12 PM) (Source: Service Control Manager) (User: )
Description: cdrom
Microsoft Office Sessions:
=========================
Error: (03/12/2014 09:21:29 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/12/2014 09:19:55 PM) (Source: SDWinSec.exe)(User: )
Description: Der Computer wird heruntergefahren
Error: (03/12/2014 08:02:37 PM) (Source: .NET Runtime Optimization Service)(User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - 1>Failed to compile: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070003
mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Error: (03/12/2014 07:50:17 PM) (Source: Application Error)(User: )
Description: DevDetect.exe3.1.45.145f60020unknown0.0.0.000000000c00000056d68632edc001cf3e23d5af4774
Error: (03/12/2014 07:47:34 PM) (Source: UpdateService)(User: )
Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen
Error: (03/12/2014 07:47:31 PM) (Source: LaunchSystemStore)(User: )
Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen
Error: (03/12/2014 07:47:14 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/02/2014 10:00:11 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/26/2014 02:22:54 PM) (Source: Application Error)(User: )
Description: NMIndexStoreSvr.exe3.3.10.049c9efadNMIndexStoreSvr.exe3.3.10.049c9efadc0000409001101f2e0001cf32f5ccb3686e
Error: (02/26/2014 02:19:16 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2014-03-14 16:43:50.603
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:49.400
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:48.165
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:46.931
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:45.712
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:44.478
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:40.509
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:39.306
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:38.072
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-03-14 16:43:36.853
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22713_none_b39feb737f8937a0\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 56%
Total physical RAM: 2813.4 MB
Available physical RAM: 1214.97 MB
Total Pagefile: 5879.33 MB
Available Pagefile: 4224.41 MB
Total Virtual: 2047.88 MB
Available Virtual: 1904.18 MB
==================== Drives ================================
Drive c: (BOOT) (Fixed) (Total:204.99 GB) (Free:124.42 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:27.88 GB) (Free:21.06 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: B641FCBA)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-14 21:10:48
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500BEVS-00UST0 rev.01.01A01 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\agnes\AppData\Local\Temp\fwlorpow.sys
---- System - GMER 2.1 ----
SSDT 8C9F44EE ZwCreateSection
SSDT 8C9F44F8 ZwRequestWaitReplyPort
SSDT 8C9F44F3 ZwSetContextThread
SSDT 8C9F44FD ZwSetSecurityObject
SSDT 8C9F4502 ZwSystemDebugControl
SSDT 8C9F448F ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 82AF8860 4 Bytes [EE, 44, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 539 82AF8B84 4 Bytes [F8, 44, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 56D 82AF8BB8 4 Bytes [F3, 44, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 5D1 82AF8C1C 4 Bytes [FD, 44, 9F, 8C]
.text ntkrnlpa.exe!KeSetEvent + 619 82AF8C64 4 Bytes [02, 45, 9F, 8C]
.text ...
? System32\drivers\nbcygqs.sys Das System kann den angegebenen Pfad nicht finden. !
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@f!s!\30!\30!f!`!{!s!r!t!t!s!d!\30!s!d! 19583823
---- EOF - GMER 2.1 ----
|
| Themen zu Vista: teilweise extrem langsam, Malwarebytes findet immer wieder Bedrohungen |
| akamai, appdatalow, browser, converter, device driver, failed, flash player, freemium, helper, home, internet, karte, mozilla, mp3, pup.optional.babylon, pup.optional.babylontoolbar.a, pup.optional.pcperformer.a, pup.optional.pricegong.a, pup.optional.regcleanerpro.a, pup.optional.softonic.a, registry, rundll, safer networking, security, software, super, vista, win32/adware.yontoo, win32/adware.yontoo.a, win32/adware.yontoo.b, windows |
Baum-Darstellung