|
Plagegeister aller Art und deren Bekämpfung: BKA/Gema Trojaner auf Internet-Seite erhaltenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
31.03.2014, 22:26 | #1 |
| BKA/Gema Trojaner auf Internet-Seite erhalten Hallo, ich habe heute beim Surfen auch eine sog. Warnmeldung erhalten, und sollte 100 Euro zum Entsperren bezahlen. Mein Browser (Chrome) konnte ich mit dem TaskManager schließen. Bis jetzt funktioniert auch alles soweit ich das beurteilen kann. Ich bin mir aber nicht sicher, ob ich mir doch evtl. etwas eingefangen habe. Mein Virenscanner Norton 2014 hat bisher nichts gefunden. Danke Jochen |
31.03.2014, 22:27 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | BKA/Gema Trojaner auf Internet-Seite erhalten Hallo und
__________________Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
31.03.2014, 22:41 | #3 |
| BKA/Gema Trojaner auf Internet-Seite erhalten Hallo, habe gerade noch zuvor einen Scan mit ADwCleaner gemacht.
__________________Hier das Ergebnis:AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.022 - Bericht erstellt am 31/03/2014 um 23:27:13 # Aktualisiert 13/03/2014 von Xplode # Betriebssystem : Windows 8.1 (64 bits) # Benutzername : Jochen - JOCHENNOTEBOOK # Gestartet von : C:\Users\Jochen\Downloads\adwcleaner_3.022.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Program Files (x86)\GreenTree Applications Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKCU\Software\APN PIP Schlüssel Gelöscht : HKLM\Software\PIP ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16518 -\\ Google Chrome v [ Datei : C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [1054 octets] - [31/03/2014 22:56:39] AdwCleaner[S0].txt - [929 octets] - [31/03/2014 23:27:13] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [988 octets] ########## |
31.03.2014, 22:43 | #4 |
/// Winkelfunktion /// TB-Süch-Tiger™ | BKA/Gema Trojaner auf Internet-Seite erhalten adwCleaner ist kein Virenscanner. Die Frage war, ob es bisherige Funde gab - von Virenscannern (abgesehen von Norton) Außerdem vermisse ich die FRST Logs.
__________________ Logfiles bitte immer in CODE-Tags posten |
31.03.2014, 22:49 | #5 |
| BKA/Gema Trojaner auf Internet-Seite erhalten FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Jochen (administrator) on JOCHENNOTEBOOK on 31-03-2014 23:44:29 Running from C:\Users\Jochen\Downloads Windows 8.1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe (Microsoft Corporation) C:\WINDOWS\system32\dashost.exe () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe () C:\ProgramData\MobileBrServ\mbbservice.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe (Microsoft Corporation) C:\Windows\System32\skydrive.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe (Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (Microsoft Corporation) C:\Program Files\Windows NT\Accessories\WORDPAD.EXE (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] () HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.) HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated) HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805} HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation) HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba) HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation) HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.) HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft) BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Chrome: ======= CHR HomePage: CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll () CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09] CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09] CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09] CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09] CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24] CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08] CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09] CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24] ==================== Services (Whitelisted) ================= R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft) R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd) S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd) R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] () R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] () R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] () R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] () S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation) R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] () S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation) R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON) S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated) R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider) S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-31 23:44 - 2014-03-31 23:44 - 00020134 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-03-31 23:43 - 2014-03-31 23:44 - 00000000 ____D () C:\FRST 2014-03-31 23:42 - 2014-03-31 23:42 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 22:56 - 2014-03-31 23:27 - 00000000 ____D () C:\AdwCleaner 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-31 22:09 - 2014-03-31 22:10 - 02038479 _____ () C:\Users\Jochen\Downloads\Brushless_Control+T_DE_EN_FR.zip 2014-03-31 22:04 - 2014-03-31 22:04 - 00234449 _____ () C:\Users\Jochen\Downloads\33745_33760_33770_air3g_6s_1a26.zip 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe 2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS 2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll 2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll 2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll 2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll 2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll 2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys 2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe 2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll 2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll 2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys 2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll 2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll 2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll 2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe 2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll 2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll 2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll 2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log ==================== One Month Modified Files and Folders ======= 2014-03-31 23:44 - 2014-03-31 23:44 - 00020134 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-03-31 23:44 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST 2014-03-31 23:44 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001 2014-03-31 23:42 - 2014-03-31 23:42 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-03-31 23:39 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat 2014-03-31 23:39 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat 2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-03-31 23:36 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8} 2014-03-31 23:36 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive 2014-03-31 23:36 - 2013-11-17 20:22 - 01964422 _____ () C:\WINDOWS\WindowsUpdate.log 2014-03-31 23:35 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job 2014-03-31 23:34 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job 2014-03-31 23:34 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI 2014-03-31 23:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2014-03-31 23:27 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner 2014-03-31 23:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job 2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 23:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton 2014-03-31 22:10 - 2014-03-31 22:09 - 02038479 _____ () C:\Users\Jochen\Downloads\Brushless_Control+T_DE_EN_FR.zip 2014-03-31 22:04 - 2014-03-31 22:04 - 00234449 _____ () C:\Users\Jochen\Downloads\33745_33760_33770_air3g_6s_1a26.zip 2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat 2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db 2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk 2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company 2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak 2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak 2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log 2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-01 08:05 - 2014-03-13 23:36 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-03-01 06:58 - 2014-03-13 23:36 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-03-01 06:30 - 2014-03-13 23:36 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-03-01 06:17 - 2014-03-13 23:36 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-03-01 05:54 - 2014-03-13 23:36 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-03-01 05:47 - 2014-03-13 23:36 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-03-01 05:42 - 2014-03-13 23:36 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-03-01 05:18 - 2014-03-13 23:36 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-03-01 05:14 - 2014-03-13 23:36 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-03-01 05:10 - 2014-03-13 23:36 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-03-01 05:03 - 2014-03-13 23:36 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-03-01 04:57 - 2014-03-13 23:36 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-03-01 04:38 - 2014-03-13 23:36 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-03-01 04:32 - 2014-03-13 23:36 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-03-01 04:27 - 2014-03-13 23:36 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-03-01 04:25 - 2014-03-13 23:36 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-03-01 04:25 - 2014-03-13 23:36 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll Some content of TEMP: ==================== C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02 LastRegBack: 2014-03-24 16:09 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 Ran by Jochen at 2014-03-31 23:45:06 Running from C:\Users\Jochen\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated) Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden ANNO 1404 - Königsedition (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 3.10.0000 - Ubisoft) ANNO 1503 GOLD (HKLM-x32\...\{DB833EF9-A198-49BE-970A-BD46F30BFBB4}) (Version: 1.05.00 - ) bavarianDEMON (HKLM-x32\...\{A6916452-1065-4F69-A8B0-96A7E0AEC999}) (Version: 6.31.0 - captron electronic GmbH) Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden Canon iP4600 series Benutzerregistrierung (HKLM-x32\...\Canon iP4600 series Benutzerregistrierung) (Version: - ) Canon iP4600 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4600_series) (Version: - ) Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - ) Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - ) Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - ) Castle Link (HKLM-x32\...\{D5C2DABD-6180-4F2F-82BA-AB2608D6BD19}) (Version: 3.56.05 - Castle Creations) CD-LabelPrint (HKLM-x32\...\MediaNavigation.CDLabelPrint) (Version: - ) Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden Classic Shell (HKLM\...\{7F34ADBE-77C0-47A0-BBC6-B3DA16CE8E68}) (Version: 3.6.7 - IvoSoft) Creative Centrale (HKLM-x32\...\Creative Centrale) (Version: 1.18.03 - Creative Technology Ltd.) Creative Centrale (x32 Version: 1.18.03 - Creative Technology Ltd.) Hidden Creative Software Update (x32 Version: 1.03.01 - Creative Technology Ltd.) Hidden Creative ZEN Style Series Dokumentation (HKLM-x32\...\ZENSTYLESERIESUG) (Version: - Creative Technology Ltd.) Digital Copy (HKLM-x32\...\Digital Copy) (Version: - ) Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden Glary Utilities 4.0 (HKLM-x32\...\Glary Utilities 4) (Version: 4.0.0.50 - Glarysoft Ltd) Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.) HiSuite (HKLM-x32\...\Hi Suite) (Version: 32.610.20.00.06 - Huawei Technologies Co.,Ltd) Inkjet Printer/Scanner Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - ) Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation) Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden Java 7 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417017FF}) (Version: 7.0.170 - Oracle) Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4420.1017 - Microsoft Corporation) Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd) Nero 12 Essentials Toshiba (HKLM-x32\...\{BA8958DC-ADD7-41E5-8436-5883C7E871C7}) (Version: 12.0.00400 - Nero AG) Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.2.0.38 - Symantec Corporation) OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation) Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden PhoenixRC (HKLM-x32\...\{7A03BEDC-6390-440E-8D13-721A22F0BD1F}) (Version: 3.00.12 - Ihr Firmenname) Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden Premium Sound HD (HKLM\...\{94F03B8E-CB73-4653-AFE9-79112C01FED2}) (Version: 1.12.4600 - SRS Labs, Inc.) PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.) Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - ) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6738 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.) Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.) Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.3 - Synaptics Incorporated) TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.0007.00002 - Toshiba Corporation) TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation) TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425 - Toshiba Corporation) TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA) Toshiba Password Utility (HKLM-x32\...\InstallShield_{6D35FF17-A8B3-43D3-917E-5A1F2C3FB628}) (Version: 2.00.910 - Toshiba Corporation) Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation) Toshiba Places Icon Utility (HKLM\...\{C991A8C4-307C-4FDD-8AAE-A1BF44881E95}) (Version: 2.1.1 - TOSHIBA) TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation) TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation) TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA) TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0012 - Toshiba Corporation) TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation) Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.5.0 - Toshiba Europe GmbH) TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation) Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.3.0 - WildTangent) WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden Windows Driver Package - Silicon Laboratories (silabenm) Ports (10/05/2012 6.6.0.0) (HKLM\...\5118100F6945E20FB40C6DEA7D3D348AFD9E43D7) (Version: 10/05/2012 6.6.0.0 - Silicon Laboratories) Windows-Treiberpaket - captron electronic GmbH CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\3C146DB26794293E02F5A5C8DC3DD9D0525039F2) (Version: 10/22/2009 2.06.00 - captron electronic GmbH) YTD Video Downloader 4.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.1 - GreenTree Applications SRL) ==================== Restore Points ========================= 21-02-2014 11:44:27 Windows Update 18-03-2014 16:22:13 Windows Update 24-03-2014 12:43:50 Removed BRAIN ==================== Hosts content: ========================== 2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {03B751AF-7831-44CB-A13B-FCFF4A8560B3} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-18] (Toshiba Europe GmbH) Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask Task: {2595AA48-1B94-4C39-ACBB-0405AC56F018} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation) Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation) Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance Task: {5C6724F8-77CB-40E8-8CE5-D1A3EA02EB1B} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-28] (TOSHIBA Corporation) Task: {63F9EBAE-3CFA-4E30-BD55-A1004CA23A4C} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation) Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup Task: {6CDEF921-5167-43E9-A11B-5AA5B55F5341} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation) Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task Task: {70620B4F-1F0A-482C-8B19-BDB0177600CE} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated) Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task Task: {8A12E7E6-355A-4E02-AFA4-5CAED4C2B9A9} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-02-04] (Microsoft Corporation) Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask Task: {91FE3CA7-951A-432E-9D17-1F269DE8D83E} - System32\Tasks\SoftwareUpdateGU3 => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe Task: {9DD1E390-D212-4E4D-85F6-6A34B345597B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.) Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work Task: {A8932318-36BF-4119-867E-D0E08EAD503B} - System32\Tasks\GlaryInitialize 4 => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe [2013-11-18] (Glarysoft Ltd) Task: {ABE9EA28-EE73-47AD-B684-E37B40D88E8E} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\WSCStub.exe [2014-03-12] (Symantec Corporation) Task: {B9E8ED11-21F5-4A6E-A014-CBF8B81D20B7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.) Task: {C399CE48-FB6D-4EB5-8B94-838E582F83DE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {C41D1328-1DB2-4031-A2A8-A2F45DDF2BFC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation) Task: {CA6E1AE1-FF1B-4C9F-829E-75B25F71E935} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization Task: {E2C2B81A-7E8E-4C30-81D3-7B68A51C136F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {E2E9AB63-9714-4435-A6C9-4A44C419F1A2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-14] (Adobe Systems Incorporated) Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE Task: {EB72F876-1E0C-4465-BABC-FE55FD534A7C} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\GlaryInitialize 4.job => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\SoftwareUpdateGU3.job => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ==================== Loaded Modules (whitelisted) ============= 2011-10-14 00:38 - 2011-10-14 00:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe 2013-08-04 19:20 - 2013-07-11 16:50 - 00137024 _____ () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe 2013-08-04 19:20 - 2013-05-02 04:15 - 00197632 _____ () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe 2013-03-10 16:39 - 2008-01-22 19:35 - 00103808 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE 2013-03-18 20:00 - 2012-03-12 11:05 - 00232288 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe 2012-07-19 04:38 - 2012-07-19 04:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll 2012-07-19 04:38 - 2012-07-19 04:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll 2012-08-14 05:13 - 2012-08-14 05:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll 2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2012-07-31 09:11 - 2012-07-31 09:11 - 00024576 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll 2013-11-18 11:54 - 2013-11-18 11:54 - 00080160 _____ () C:\Program Files (x86)\Glarysoft\Glary Utilities 4\zlib1.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00891392 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtNetwork4.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 02281984 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtCore4.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00016896 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\featureController.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\osEvents.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00322048 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\log4cplus.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00339456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtXml4.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00400384 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\sqlite3.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00195584 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\libgsoap.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00062464 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\zlib1.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00446976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\deviceProfile.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00019456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\eventsSender.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\serviceManagerStarter.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00051016 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00716616 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libglesv2.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00100168 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libegl.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 04061000 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00394568 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 01647432 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll 2012-11-27 15:16 - 2012-06-25 20:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll 2014-03-31 23:39 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2014-03-31 23:39 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2014-03-31 23:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2014-03-31 23:39 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2014-03-31 23:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 13637448 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Users\Jochen\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (03/31/2014 11:29:43 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/31/2014 10:43:13 PM) (Source: Application Hang) (User: ) Description: Programm wwahost.exe, Version 6.3.9600.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1370 Startzeit: 01cf4d211a225124 Endzeit: 4294967295 Anwendungspfad: C:\WINDOWS\syswow64\wwahost.exe Berichts-ID: 0e7097b3-b915-11e3-bed9-7054d249348e Vollständiger Name des fehlerhaften Pakets: Microsoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5c Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App Error: (03/31/2014 10:23:33 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program) (User: ) Description: 80070005 Error: (03/27/2014 06:20:02 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: skydrive.exe, Version: 6.3.9600.16507, Zeitstempel: 0x52ce4d58 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0x00000000 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x1fc0 Startzeit der fehlerhaften Anwendung: 0xskydrive.exe0 Pfad der fehlerhaften Anwendung: skydrive.exe1 Pfad des fehlerhaften Moduls: skydrive.exe2 Berichtskennung: skydrive.exe3 Vollständiger Name des fehlerhaften Pakets: skydrive.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: skydrive.exe5 Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program) (User: ) Description: 80070005 Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag) (User: ) Description: Das Volume "TI30992300A (C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (03/24/2014 04:11:22 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/24/2014 04:09:47 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/24/2014 02:47:43 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. System errors: ============= Error: (03/31/2014 11:29:43 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%14001 Error: (03/31/2014 10:23:33 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%14001 Error: (03/31/2014 10:22:29 PM) (Source: Ntfs) (User: ) Description: Auf dem Volume "\\?\Volume{0e57c233-b6f4-4c75-bd98-bc62c6387e95}" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten. Error: (03/31/2014 09:45:45 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/27/2014 06:10:34 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/26/2014 10:10:21 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/24/2014 02:47:43 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%14001 Error: (03/24/2014 02:43:26 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Software Protection" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Software Protection erreicht. Microsoft Office Sessions: ========================= Error: (03/31/2014 11:29:43 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe Error: (03/31/2014 10:43:13 PM) (Source: Application Hang)(User: ) Description: wwahost.exe6.3.9600.16431137001cf4d211a2251244294967295C:\WINDOWS\syswow64\wwahost.exe0e7097b3-b915-11e3-bed9-7054d249348eMicrosoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5cApp Error: (03/31/2014 10:23:33 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program)(User: ) Description: 80070005 Error: (03/27/2014 06:20:02 PM) (Source: Application Error)(User: ) Description: skydrive.exe6.3.9600.1650752ce4d58unknown0.0.0.0000000000000000000000000000000001fc001cf49d6b2f4a12fC:\Windows\System32\skydrive.exeunknowna5cbdbef-b5cb-11e3-bed8-7054d249348e Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program)(User: ) Description: 80070005 Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag)(User: ) Description: TI30992300A (C:)Falscher Parameter. (0x80070057) Error: (03/24/2014 04:11:22 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe Error: (03/24/2014 04:09:47 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe Error: (03/24/2014 02:47:43 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe CodeIntegrity Errors: =================================== Date: 2014-03-24 07:08:24.000 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-24 07:08:23.938 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-24 07:08:23.938 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-24 07:08:22.547 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 22:29:57.725 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-18 22:21:15.061 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 22:20:37.609 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-18 22:20:19.686 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 22:18:22.712 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 19:01:30.703 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 29% Total physical RAM: 6025.22 MB Available physical RAM: 4265.98 MB Total Pagefile: 6985.22 MB Available Pagefile: 5135.19 MB Total Virtual: 131072 MB Available Virtual: 131071.79 MB ==================== Drives ================================ Drive c: (TI30992300A) (Fixed) (Total:687.83 GB) (Free:621.41 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 699 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ |
31.03.2014, 22:51 | #6 |
/// Winkelfunktion /// TB-Süch-Tiger™ | BKA/Gema Trojaner auf Internet-Seite erhalten Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> BKA/Gema Trojaner auf Internet-Seite erhalten |
31.03.2014, 22:53 | #7 |
| BKA/Gema Trojaner auf Internet-Seite erhalten Habe ich vorher mißverstanden. Ich habe nur Norton als Virenscaner. Auch das Norton Reparaturtool Power Eraser, was bei mir in Norton auch integriert ist und ausgewählt werden kann, hat keine Viren gefunden. |
31.03.2014, 23:07 | #8 |
/// Winkelfunktion /// TB-Süch-Tiger™ | BKA/Gema Trojaner auf Internet-Seite erhalten Schon ok, mach einfach mit den anderen Tools weiter.
__________________ Logfiles bitte immer in CODE-Tags posten |
31.03.2014, 23:15 | #9 |
| BKA/Gema Trojaner auf Internet-Seite erhaltenCode:
ATTFilter # AdwCleaner v3.022 - Bericht erstellt am 31/03/2014 um 23:58:23 # Aktualisiert 13/03/2014 von Xplode # Betriebssystem : Windows 8.1 (64 bits) # Benutzername : Jochen - JOCHENNOTEBOOK # Gestartet von : C:\Users\Jochen\Downloads\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16518 -\\ Google Chrome v [ Datei : C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [1054 octets] - [31/03/2014 22:56:39] AdwCleaner[R1].txt - [889 octets] - [31/03/2014 23:57:39] AdwCleaner[S0].txt - [1067 octets] - [31/03/2014 23:27:13] AdwCleaner[S1].txt - [811 octets] - [31/03/2014 23:58:23] ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [870 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.3 (03.23.2014:1) OS: Windows 8.1 x64 Ran by Jochen on 01.04.2014 at 0:09:19,49 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Failed to delete: [Folder] "C:\ProgramData\ytd video downloader" Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader" ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 01.04.2014 at 0:14:05,02 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
31.03.2014, 23:18 | #10 |
/// Winkelfunktion /// TB-Süch-Tiger™ | BKA/Gema Trojaner auf Internet-Seite erhalten Hm richtig, adwCleaner hast ja schon vorher ausgeführt, aber JRT auch schon?
__________________ Logfiles bitte immer in CODE-Tags posten |
31.03.2014, 23:24 | #11 |
| BKA/Gema Trojaner auf Internet-Seite erhalten FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Jochen (administrator) on JOCHENNOTEBOOK on 01-04-2014 00:19:52 Running from C:\Users\Jochen\Downloads Windows 8.1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe (Microsoft Corporation) C:\WINDOWS\system32\dashost.exe () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe () C:\ProgramData\MobileBrServ\mbbservice.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (Microsoft Corporation) C:\Windows\System32\skydrive.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe (Microsoft Corporation) C:\Program Files\Windows NT\Accessories\WORDPAD.EXE (Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] () HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.) HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated) HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805} HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation) HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba) HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation) HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.) HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKCU - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft) BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Chrome: ======= CHR HomePage: CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll () CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09] CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09] CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09] CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09] CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24] CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08] CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09] CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24] ==================== Services (Whitelisted) ================= R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft) R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd) S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd) R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] () R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] () R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] () R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] () S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation) R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] () S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation) R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON) S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated) R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider) S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-04-01 00:19 - 2014-04-01 00:19 - 00020127 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt 2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe 2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe 2014-03-31 23:43 - 2014-04-01 00:18 - 00000000 ____D () C:\FRST 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 22:56 - 2014-03-31 23:58 - 00000000 ____D () C:\AdwCleaner 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe 2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS 2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll 2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll 2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll 2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll 2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll 2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys 2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe 2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll 2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll 2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys 2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll 2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll 2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll 2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe 2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll 2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll 2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll 2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log ==================== One Month Modified Files and Folders ======= 2014-04-01 00:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job 2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-04-01 00:19 - 2014-04-01 00:19 - 00020127 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-04-01 00:19 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST 2014-04-01 00:15 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001 2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt 2014-04-01 00:14 - 2013-11-17 20:22 - 01361935 _____ () C:\WINDOWS\WindowsUpdate.log 2014-04-01 00:10 - 2013-06-12 19:43 - 00000000 ____D () C:\ProgramData\YTD Video Downloader 2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe 2014-04-01 00:08 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8} 2014-04-01 00:06 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-04-01 00:06 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat 2014-04-01 00:06 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat 2014-04-01 00:01 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive 2014-04-01 00:00 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job 2014-04-01 00:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-03-31 23:59 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job 2014-03-31 23:59 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-03-31 23:58 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner 2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI 2014-03-31 23:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton 2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat 2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db 2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk 2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company 2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak 2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak 2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log 2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl Some content of TEMP: ==================== C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02 LastRegBack: 2014-03-24 16:09 ==================== End Of Log ============================ --- --- --- Nach dem letzen Scan mit dem FRST Tool hat sich nur ein Fenster mit der FRST Logdatei geöffnet. Eine Addition Datei wurde nicht geöffnet. |
31.03.2014, 23:31 | #12 |
/// Winkelfunktion /// TB-Süch-Tiger™ | BKA/Gema Trojaner auf Internet-Seite erhalten Was ist mit meiner Frage zu JRT? FRST erstellt nur eine additions.txt wenn ein Haken entsprechend gesetzt ist. Ab dem 2. Scan mit FRST musst du selbst den Haken setzen.
__________________ Logfiles bitte immer in CODE-Tags posten |
31.03.2014, 23:34 | #13 |
| BKA/Gema Trojaner auf Internet-Seite erhalten JRT habe ich schon gepostet um 00:15 Uhr. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Jochen (administrator) on JOCHENNOTEBOOK on 01-04-2014 00:31:41 Running from C:\Users\Jochen\Downloads Windows 8.1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe (Microsoft Corporation) C:\WINDOWS\system32\dashost.exe () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe () C:\ProgramData\MobileBrServ\mbbservice.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (Microsoft Corporation) C:\Windows\System32\skydrive.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe (Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] () HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.) HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated) HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805} HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation) HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba) HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation) HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.) HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKCU - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft) BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Chrome: ======= CHR HomePage: CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll () CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09] CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09] CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09] CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09] CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24] CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08] CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09] CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24] ==================== Services (Whitelisted) ================= R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft) R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd) S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd) R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] () R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] () R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] () R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] () S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation) R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] () S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation) R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON) S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated) R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider) S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-01 00:19 - 2014-04-01 00:31 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt 2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe 2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe 2014-03-31 23:43 - 2014-04-01 00:31 - 00000000 ____D () C:\FRST 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 22:56 - 2014-03-31 23:58 - 00000000 ____D () C:\AdwCleaner 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe 2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS 2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll 2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll 2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll 2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll 2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll 2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys 2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe 2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll 2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll 2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys 2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll 2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll 2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll 2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe 2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll 2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll 2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll 2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log ==================== One Month Modified Files and Folders ======= 2014-04-01 00:31 - 2014-04-01 00:19 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-04-01 00:31 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST 2014-04-01 00:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-04-01 00:24 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8} 2014-04-01 00:20 - 2013-11-17 20:22 - 01384775 _____ () C:\WINDOWS\WindowsUpdate.log 2014-04-01 00:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job 2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-04-01 00:15 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001 2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt 2014-04-01 00:10 - 2013-06-12 19:43 - 00000000 ____D () C:\ProgramData\YTD Video Downloader 2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe 2014-04-01 00:06 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-04-01 00:06 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat 2014-04-01 00:06 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat 2014-04-01 00:01 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive 2014-04-01 00:00 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job 2014-04-01 00:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-03-31 23:59 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job 2014-03-31 23:59 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-03-31 23:58 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner 2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI 2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton 2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat 2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db 2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk 2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company 2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak 2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak 2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log 2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl Some content of TEMP: ==================== C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02 LastRegBack: 2014-03-24 16:09 ==================== End Of Log ============================ --- --- --- |
31.03.2014, 23:34 | #14 |
/// Winkelfunktion /// TB-Süch-Tiger™ | BKA/Gema Trojaner auf Internet-Seite erhalten Das hatte ich gefragt
__________________ Logfiles bitte immer in CODE-Tags posten |
31.03.2014, 23:40 | #15 |
| BKA/Gema Trojaner auf Internet-Seite erhalten FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Jochen (administrator) on JOCHENNOTEBOOK on 01-04-2014 00:31:41 Running from C:\Users\Jochen\Downloads Windows 8.1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe (Microsoft Corporation) C:\WINDOWS\system32\dashost.exe () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe (IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe () C:\ProgramData\MobileBrServ\mbbservice.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (Glarysoft Ltd) C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Integrator.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe (Microsoft Corporation) C:\Windows\System32\skydrive.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe (Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe (Google Inc.) C:\Users\Jochen\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-27] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2608040 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] () HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-07-27] (SRS Labs, Inc.) HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-18] (CANON INC.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-14] (Synaptics Incorporated) HKLM\...\Run: [CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}] - "C:\ProgramData\cisF4DE.exe" --PostUninstall {15198508-521A-4D69-8E5B-B94A6CCFF805} HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] - "C:\ProgramData\cisA41D.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82} HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation) HKLM-x32\...\Run: [ToshibaDynamicIconUtility] - C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [1498624 2012-08-09] (Toshiba) HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [6884352 2012-08-23] (Pegatron Corporation) HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\Run: [Google Update] - C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-09] (Google Inc.) HKU\S-1-5-21-4259684610-3218734656-3660589806-1001\...\MountPoints2: {10be0c7f-4fb2-11e3-824f-806e6f6e6963} - "E:\Start.exe" ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://toshiba13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com SearchScopes: HKLM - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM-x32 - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKCU - DefaultScope {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = SearchScopes: HKCU - {B385048D-B9D8-4D1E-AD82-554BAB8FE207} URL = BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft) BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Chrome: ======= CHR HomePage: CHR Plugin: (Shockwave Flash) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll () CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (Google Update) - C:\Users\Jochen\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File CHR Extension: (Google Docs) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-09] CHR Extension: (Google Drive) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-09] CHR Extension: (YouTube) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-09] CHR Extension: (Google-Suche) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-09] CHR Extension: (Norton Identity Protection) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-03-24] CHR Extension: (Google Wallet) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08] CHR Extension: (Google Mail) - C:\Users\Jochen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-09] CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\Exts\Chrome.crx [2014-03-24] ==================== Services (Whitelisted) ================= R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft) R2 CTDevice_Srv; C:\Program Files (x86)\Creative\Shared Files\CTDevSrv.exe [61440 2007-04-02] (Creative Technology Ltd) S3 CTUPnPSv; C:\Program Files (x86)\Creative\Creative Centrale\CTUPnPSv.exe [64000 2008-05-21] (Creative Technology Ltd) R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-14] () R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] () R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] () R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-27] (Realtek Semiconductor) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-03-10] () S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [1525976 2014-03-19] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-03-24] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-03-24] (Symantec Corporation) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140328.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation) R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-03-10] () S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\ENG64.SYS [126040 2014-03-24] (Symantec Corporation) R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140331.003\EX64.SYS [2099288 2014-03-24] (Symantec Corporation) R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-12] (PEGATRON) S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-14] (Synaptics Incorporated) R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation) S0 SymELAM; C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys [23568 2013-09-10] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-24] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider) S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-01 00:19 - 2014-04-01 00:31 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt 2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe 2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe 2014-03-31 23:43 - 2014-04-01 00:31 - 00000000 ____D () C:\FRST 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:00 - 2014-03-31 23:01 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 22:56 - 2014-03-31 23:58 - 00000000 ____D () C:\AdwCleaner 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:20 - 2014-03-31 22:30 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:07 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe 2014-03-24 15:07 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:52 - 2014-03-31 22:23 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-24 14:52 - 2014-03-31 22:23 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-31 22:23 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-24 14:51 - 2014-03-31 22:21 - 00000000 ____D () C:\ProgramData\Norton 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-18 19:06 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2014-03-18 19:06 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2014-03-18 19:06 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2014-03-18 18:33 - 2014-01-08 03:46 - 00325464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS 2014-03-18 18:33 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2014-03-18 18:33 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2014-03-18 18:33 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll 2014-03-18 18:33 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll 2014-03-18 18:33 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll 2014-03-18 18:33 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll 2014-03-18 18:33 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2014-03-18 18:33 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2014-03-18 18:33 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll 2014-03-18 18:33 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll 2014-03-18 18:33 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll 2014-03-18 18:33 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll 2014-03-18 18:33 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll 2014-03-18 18:33 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll 2014-03-18 18:33 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2014-03-18 18:33 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll 2014-03-18 18:33 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll 2014-03-18 18:33 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2014-03-18 18:33 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2014-03-18 18:33 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll 2014-03-18 18:33 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys 2014-03-18 18:33 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2014-03-18 18:33 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe 2014-03-18 18:33 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll 2014-03-18 18:33 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll 2014-03-18 18:33 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2014-03-18 18:33 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2014-03-13 23:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-03-13 23:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-03-13 23:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-03-13 23:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-03-13 23:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-03-13 23:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-03-13 23:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-03-13 23:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-03-13 23:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-03-13 23:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-03-13 23:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-03-13 23:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2014-03-13 23:36 - 2014-01-31 18:15 - 00311640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys 2014-03-13 23:36 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll 2014-03-13 23:36 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll 2014-03-13 23:36 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll 2014-03-13 23:36 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll 2014-03-13 23:36 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2014-03-13 23:36 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2014-03-13 23:36 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2014-03-13 23:36 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2014-03-13 23:36 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2014-03-13 23:36 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2014-03-13 23:36 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2014-03-13 23:36 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll 2014-03-13 23:36 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll 2014-03-13 23:36 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2014-03-13 23:36 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2014-03-13 23:36 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll 2014-03-13 23:36 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE 2014-03-13 23:36 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll 2014-03-13 23:36 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll 2014-03-13 23:36 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2014-03-13 23:36 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2014-03-13 23:36 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml 2014-03-13 23:36 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll 2014-03-13 23:36 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe 2014-03-13 23:36 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll 2014-03-13 23:36 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2014-03-13 23:36 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2014-03-13 23:35 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-03-13 23:35 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll 2014-03-13 23:35 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll 2014-03-11 17:57 - 2014-03-31 23:33 - 00010118 _____ () C:\WINDOWS\PFRO.log ==================== One Month Modified Files and Folders ======= 2014-04-01 00:31 - 2014-04-01 00:19 - 00020467 _____ () C:\Users\Jochen\Downloads\FRST.txt 2014-04-01 00:31 - 2014-03-31 23:43 - 00000000 ____D () C:\FRST 2014-04-01 00:28 - 2013-03-13 20:43 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2014-04-01 00:24 - 2013-11-19 17:51 - 00003958 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{2E7FC38A-7CAE-410E-926E-6CEBEFD729C8} 2014-04-01 00:20 - 2013-11-17 20:22 - 01384775 _____ () C:\WINDOWS\WindowsUpdate.log 2014-04-01 00:20 - 2013-03-09 22:44 - 00001154 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job 2014-04-01 00:19 - 2014-04-01 00:19 - 02157056 _____ (Farbar) C:\Users\Jochen\Downloads\FRST64.exe 2014-04-01 00:15 - 2013-03-09 19:29 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4259684610-3218734656-3660589806-1001 2014-04-01 00:14 - 2014-04-01 00:14 - 00000791 _____ () C:\Users\Jochen\Desktop\JRT.txt 2014-04-01 00:10 - 2013-06-12 19:43 - 00000000 ____D () C:\ProgramData\YTD Video Downloader 2014-04-01 00:09 - 2014-04-01 00:09 - 00000000 ____D () C:\WINDOWS\ERUNT 2014-04-01 00:08 - 2014-04-01 00:08 - 01038974 _____ (Thisisu) C:\Users\Jochen\Downloads\JRT.exe 2014-04-01 00:06 - 2013-09-30 06:14 - 01785718 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-04-01 00:06 - 2013-09-30 05:56 - 00769220 _____ () C:\WINDOWS\system32\perfh007.dat 2014-04-01 00:06 - 2013-09-30 05:56 - 00160448 _____ () C:\WINDOWS\system32\perfc007.dat 2014-04-01 00:01 - 2013-11-17 20:54 - 00000000 __RDO () C:\Users\Jochen\SkyDrive 2014-04-01 00:00 - 2013-11-19 17:50 - 00000382 _____ () C:\WINDOWS\Tasks\GlaryInitialize 4.job 2014-04-01 00:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-03-31 23:59 - 2013-10-23 20:23 - 00000394 _____ () C:\WINDOWS\Tasks\SoftwareUpdateGU3.job 2014-03-31 23:59 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-03-31 23:58 - 2014-03-31 22:56 - 00000000 ____D () C:\AdwCleaner 2014-03-31 23:55 - 2014-03-31 23:55 - 01950720 _____ () C:\Users\Jochen\Downloads\adwcleaner.exe 2014-03-31 23:39 - 2014-03-31 23:39 - 00001406 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-03-31 23:39 - 2014-03-31 23:39 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-03-31 23:39 - 2013-06-22 19:56 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-03-31 23:33 - 2014-03-31 23:33 - 00000085 _____ () C:\WINDOWS\wininit.ini 2014-03-31 23:33 - 2014-03-11 17:57 - 00010118 _____ () C:\WINDOWS\PFRO.log 2014-03-31 23:32 - 2014-03-31 23:32 - 00001067 _____ () C:\Users\Jochen\Documents\AdwCleaner[S0].txt 2014-03-31 23:28 - 2013-08-22 15:25 - 00786432 ___SH () C:\WINDOWS\system32\config\BBI 2014-03-31 23:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2014-03-31 23:01 - 2014-03-31 23:00 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Jochen\Downloads\spybot-2.2.25.exe 2014-03-31 22:30 - 2014-03-31 22:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\NPE 2014-03-31 22:28 - 2014-03-31 22:28 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Norton Internet Security 2014-03-31 22:24 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-03-31 22:23 - 2014-03-24 14:52 - 00003234 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration 2014-03-31 22:23 - 2014-03-24 14:52 - 00002532 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk 2014-03-31 22:23 - 2014-03-24 14:51 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NISx64 2014-03-31 22:21 - 2014-03-24 14:51 - 00000000 ____D () C:\ProgramData\Norton 2014-03-27 18:46 - 2013-03-09 19:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Packages 2014-03-27 18:20 - 2014-03-27 18:20 - 00000000 ____D () C:\Users\Jochen\AppData\Local\CrashDumps 2014-03-27 18:18 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-03-24 17:37 - 2014-03-24 17:37 - 00033280 ___SH () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Thumbs.db 2014-03-24 17:37 - 2014-03-24 17:37 - 00000946 _____ () C:\Users\Jochen\Desktop\Studium FFB.lnk 2014-03-24 15:04 - 2013-03-11 19:33 - 00000000 ____D () C:\Users\Jochen\Documents\Studium FFB 2014-03-24 14:56 - 2014-03-24 14:56 - 00000000 ____D () C:\Users\Jochen\Documents\Symantec 2014-03-24 14:55 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-03-24 14:52 - 2014-03-24 14:52 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS 2014-03-24 14:52 - 2014-03-24 14:52 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT 2014-03-24 14:52 - 2014-03-24 14:52 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared 2014-03-24 14:51 - 2014-03-24 14:51 - 00000000 ____D () C:\Program Files (x86)\Norton Internet Security 2014-03-24 14:50 - 2014-03-24 14:50 - 00000299 _____ () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Music Place.lnk 2014-03-24 14:46 - 2013-03-13 19:59 - 01474832 _____ () C:\WINDOWS\system32\Drivers\sfi.dat 2014-03-24 14:46 - 2013-03-13 19:59 - 00000000 ____D () C:\WINDOWS\System32\Tasks\COMODO 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-03-18 23:18 - 2013-03-09 19:22 - 00000000 ___RD () C:\Users\Jochen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-03-18 23:17 - 2013-08-22 16:44 - 00507912 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender 2014-03-18 20:29 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-03-18 20:01 - 2013-03-17 12:23 - 00898048 ___SH () C:\Users\Jochen\Downloads\Thumbs.db 2014-03-18 19:34 - 2013-03-09 22:45 - 00002437 _____ () C:\Users\Jochen\Desktop\Google Chrome.lnk 2014-03-18 18:39 - 2013-03-13 21:42 - 00000000 ____D () C:\Users\Jochen\AppData\Local\Eastman_Kodak_Company 2014-03-18 18:39 - 2013-03-13 21:31 - 00000000 ____D () C:\Program Files (x86)\Kodak 2014-03-18 18:39 - 2013-03-13 21:29 - 00000000 ____D () C:\ProgramData\Kodak 2014-03-18 18:38 - 2013-03-10 16:39 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-03-14 00:28 - 2013-03-13 20:43 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2014-03-10 21:26 - 2013-11-21 16:50 - 00003261 _____ () C:\WINDOWS\setupact.log 2014-03-05 00:53 - 2014-02-21 13:32 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-03-05 00:53 - 2014-02-21 13:32 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl Some content of TEMP: ==================== C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll C:\Users\Jochen\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys [2014-03-13 23:36] - [2014-01-31 18:15] - 0311640 ____A (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02 LastRegBack: 2014-03-24 16:09 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 Ran by Jochen at 2014-04-01 00:32:06 Running from C:\Users\Jochen\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} ==================== Installed Programs ====================== Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated) Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden ANNO 1404 - Königsedition (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 3.10.0000 - Ubisoft) ANNO 1503 GOLD (HKLM-x32\...\{DB833EF9-A198-49BE-970A-BD46F30BFBB4}) (Version: 1.05.00 - ) bavarianDEMON (HKLM-x32\...\{A6916452-1065-4F69-A8B0-96A7E0AEC999}) (Version: 6.31.0 - captron electronic GmbH) Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden Canon iP4600 series Benutzerregistrierung (HKLM-x32\...\Canon iP4600 series Benutzerregistrierung) (Version: - ) Canon iP4600 series Printer Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4600_series) (Version: - ) Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - ) Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - ) Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - ) Castle Link (HKLM-x32\...\{D5C2DABD-6180-4F2F-82BA-AB2608D6BD19}) (Version: 3.56.05 - Castle Creations) CD-LabelPrint (HKLM-x32\...\MediaNavigation.CDLabelPrint) (Version: - ) Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden Classic Shell (HKLM\...\{7F34ADBE-77C0-47A0-BBC6-B3DA16CE8E68}) (Version: 3.6.7 - IvoSoft) Creative Centrale (HKLM-x32\...\Creative Centrale) (Version: 1.18.03 - Creative Technology Ltd.) Creative Centrale (x32 Version: 1.18.03 - Creative Technology Ltd.) Hidden Creative Software Update (x32 Version: 1.03.01 - Creative Technology Ltd.) Hidden Creative ZEN Style Series Dokumentation (HKLM-x32\...\ZENSTYLESERIESUG) (Version: - Creative Technology Ltd.) Digital Copy (HKLM-x32\...\Digital Copy) (Version: - ) Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden Glary Utilities 4.0 (HKLM-x32\...\Glary Utilities 4) (Version: 4.0.0.50 - Glarysoft Ltd) Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.) HiSuite (HKLM-x32\...\Hi Suite) (Version: 32.610.20.00.06 - Huawei Technologies Co.,Ltd) Inkjet Printer/Scanner Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - ) Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation) Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden Java 7 Update 17 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417017FF}) (Version: 7.0.170 - Oracle) Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office 32-bit Components 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4420.1017 - Microsoft Corporation) Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.14.00.03 - Huawei Technologies Co.,Ltd) Nero 12 Essentials Toshiba (HKLM-x32\...\{BA8958DC-ADD7-41E5-8436-5883C7E871C7}) (Version: 12.0.00400 - Nero AG) Nero BackItUp (x32 Version: 12.0.1000 - Nero AG) Hidden Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero Blu-ray Player (x32 Version: 12.0.12600 - Nero AG) Hidden Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero BurnRights (x32 Version: 12.0.3000 - Nero AG) Hidden Nero BurnRights Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero ControlCenter (x32 Version: 11.0.14800.0.48 - Nero AG) Hidden Nero ControlCenter Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero Core Components (x32 Version: 11.0.17600.2.3 - Nero AG) Hidden Nero Express (x32 Version: 12.0.14001 - Nero AG) Hidden Nero Express Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero Kwik Media (x32 Version: 1.18.16800 - Nero AG) Hidden Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden Nero Launcher (x32 Version: 12.2.1000 - Nero AG) Hidden Nero RescueAgent (x32 Version: 12.0.7002 - Nero AG) Hidden Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden Norton Internet Security (HKLM-x32\...\NIS) (Version: 21.2.0.38 - Symantec Corporation) OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation) Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden PhoenixRC (HKLM-x32\...\{7A03BEDC-6390-440E-8D13-721A22F0BD1F}) (Version: 3.00.12 - Ihr Firmenname) Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden Premium Sound HD (HKLM\...\{94F03B8E-CB73-4653-AFE9-79112C01FED2}) (Version: 1.12.4600 - SRS Labs, Inc.) PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.) Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - ) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6738 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.) Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0020 - REALTEK Semiconductor Corp.) Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.3 - Synaptics Incorporated) TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.0007.00002 - Toshiba Corporation) TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation) TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6425 - Toshiba Corporation) TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA) Toshiba Password Utility (HKLM-x32\...\InstallShield_{6D35FF17-A8B3-43D3-917E-5A1F2C3FB628}) (Version: 2.00.910 - Toshiba Corporation) Toshiba Password Utility (x32 Version: 2.00.910 - Toshiba Corporation) Hidden TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation) Toshiba Places Icon Utility (HKLM\...\{C991A8C4-307C-4FDD-8AAE-A1BF44881E95}) (Version: 2.1.1 - TOSHIBA) TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.0.54043005 - Toshiba Corporation) TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation) TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA) TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0012 - Toshiba Corporation) TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation) Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.5.0 - Toshiba Europe GmbH) TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation) Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden Welcome App (Start-up experience) (x32 Version: 12.0.13000 - Nero AG) Hidden WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.3.0 - WildTangent) WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden Windows Driver Package - Silicon Laboratories (silabenm) Ports (10/05/2012 6.6.0.0) (HKLM\...\5118100F6945E20FB40C6DEA7D3D348AFD9E43D7) (Version: 10/05/2012 6.6.0.0 - Silicon Laboratories) Windows-Treiberpaket - captron electronic GmbH CDM Driver Package (10/22/2009 2.06.00) (HKLM\...\3C146DB26794293E02F5A5C8DC3DD9D0525039F2) (Version: 10/22/2009 2.06.00 - captron electronic GmbH) YTD Video Downloader 4.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.1 - GreenTree Applications SRL) ==================== Restore Points ========================= 21-02-2014 11:44:27 Windows Update 18-03-2014 16:22:13 Windows Update 24-03-2014 12:43:50 Removed BRAIN ==================== Hosts content: ========================== 2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {03B751AF-7831-44CB-A13B-FCFF4A8560B3} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList Task: {0CD45EEE-BA60-402C-83D0-7AE300826A81} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-18] (Toshiba Europe GmbH) Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask Task: {2595AA48-1B94-4C39-ACBB-0405AC56F018} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation) Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation) Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance Task: {5C6724F8-77CB-40E8-8CE5-D1A3EA02EB1B} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-28] (TOSHIBA Corporation) Task: {63F9EBAE-3CFA-4E30-BD55-A1004CA23A4C} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation) Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup Task: {6CDEF921-5167-43E9-A11B-5AA5B55F5341} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation) Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task Task: {70620B4F-1F0A-482C-8B19-BDB0177600CE} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-14] (Synaptics Incorporated) Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task Task: {8A12E7E6-355A-4E02-AFA4-5CAED4C2B9A9} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-02-04] (Microsoft Corporation) Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask Task: {91FE3CA7-951A-432E-9D17-1F269DE8D83E} - System32\Tasks\SoftwareUpdateGU3 => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe Task: {9DD1E390-D212-4E4D-85F6-6A34B345597B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.) Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work Task: {A8932318-36BF-4119-867E-D0E08EAD503B} - System32\Tasks\GlaryInitialize 4 => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe [2013-11-18] (Glarysoft Ltd) Task: {ABE9EA28-EE73-47AD-B684-E37B40D88E8E} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\WSCStub.exe [2014-03-12] (Symantec Corporation) Task: {B9E8ED11-21F5-4A6E-A014-CBF8B81D20B7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-09] (Google Inc.) Task: {C399CE48-FB6D-4EB5-8B94-838E582F83DE} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\SymErr.exe [2014-01-30] (Symantec Corporation) Task: {C41D1328-1DB2-4031-A2A8-A2F45DDF2BFC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation) Task: {CA6E1AE1-FF1B-4C9F-829E-75B25F71E935} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization Task: {E2C2B81A-7E8E-4C30-81D3-7B68A51C136F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {E2E9AB63-9714-4435-A6C9-4A44C419F1A2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-14] (Adobe Systems Incorporated) Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE Task: {EB72F876-1E0C-4465-BABC-FE55FD534A7C} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\GlaryInitialize 4.job => C:\Program Files (x86)\Glarysoft\Glary Utilities 4\Initialize.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001Core.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4259684610-3218734656-3660589806-1001UA.job => C:\Users\Jochen\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\SoftwareUpdateGU3.job => C:\Program Files (x86)\Glary Utilities 3\SoftwareUpdate.exe Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ==================== Loaded Modules (whitelisted) ============= 2011-10-14 00:38 - 2011-10-14 00:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe 2013-08-04 19:20 - 2013-07-11 16:50 - 00137024 _____ () C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe 2013-08-04 19:20 - 2013-05-02 04:15 - 00197632 _____ () C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe 2013-03-10 16:39 - 2008-01-22 19:35 - 00103808 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE 2013-03-18 20:00 - 2012-03-12 11:05 - 00232288 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe 2012-07-19 04:38 - 2012-07-19 04:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll 2012-07-19 04:38 - 2012-07-19 04:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll 2012-08-14 05:13 - 2012-08-14 05:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll 2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2012-07-31 09:11 - 2012-07-31 09:11 - 00024576 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll 2013-11-18 11:54 - 2013-11-18 11:54 - 00080160 _____ () C:\Program Files (x86)\Glarysoft\Glary Utilities 4\zlib1.dll 2014-03-31 23:39 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2014-03-31 23:39 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2014-03-31 23:39 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2014-03-31 23:39 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2014-03-31 23:39 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00891392 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtNetwork4.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 02281984 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtCore4.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00016896 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\featureController.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\osEvents.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00322048 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\log4cplus.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00339456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\QtXml4.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00400384 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\sqlite3.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00195584 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\libgsoap.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00062464 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\zlib1.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00446976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\deviceProfile.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00019456 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\eventsSender.dll 2012-09-10 23:02 - 2012-08-02 00:01 - 00062976 _____ () C:\Program Files (x86)\Intel\IntelAppStore\bin\serviceManagerStarter.dll 2012-11-27 15:16 - 2012-06-25 20:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00051016 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00716616 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libglesv2.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00100168 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\libegl.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 04061000 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 00394568 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 01647432 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll 2014-03-18 19:34 - 2014-03-15 02:50 - 13637448 _____ () C:\Users\Jochen\AppData\Local\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Users\Jochen\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (03/31/2014 11:29:43 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/31/2014 10:43:13 PM) (Source: Application Hang) (User: ) Description: Programm wwahost.exe, Version 6.3.9600.16431 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1370 Startzeit: 01cf4d211a225124 Endzeit: 4294967295 Anwendungspfad: C:\WINDOWS\syswow64\wwahost.exe Berichts-ID: 0e7097b3-b915-11e3-bed9-7054d249348e Vollständiger Name des fehlerhaften Pakets: Microsoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5c Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App Error: (03/31/2014 10:23:33 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program) (User: ) Description: 80070005 Error: (03/27/2014 06:20:02 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: skydrive.exe, Version: 6.3.9600.16507, Zeitstempel: 0x52ce4d58 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0x00000000 Fehleroffset: 0x0000000000000000 ID des fehlerhaften Prozesses: 0x1fc0 Startzeit der fehlerhaften Anwendung: 0xskydrive.exe0 Pfad der fehlerhaften Anwendung: skydrive.exe1 Pfad des fehlerhaften Moduls: skydrive.exe2 Berichtskennung: skydrive.exe3 Vollständiger Name des fehlerhaften Pakets: skydrive.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: skydrive.exe5 Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program) (User: ) Description: 80070005 Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag) (User: ) Description: Das Volume "TI30992300A (C:)" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057) Error: (03/24/2014 04:11:22 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/24/2014 04:09:47 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. Error: (03/24/2014 02:47:43 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName1". Die Einstellung "hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayName" ist nicht registriert. System errors: ============= Error: (03/31/2014 11:29:43 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%14001 Error: (03/31/2014 10:23:33 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%14001 Error: (03/31/2014 10:22:29 PM) (Source: Ntfs) (User: ) Description: Auf dem Volume "\\?\Volume{0e57c233-b6f4-4c75-bd98-bc62c6387e95}" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten. Error: (03/31/2014 09:45:45 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/27/2014 06:10:34 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/26/2014 10:10:21 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/24/2014 02:47:43 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%14001 Error: (03/24/2014 02:43:26 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: ComputerstandardLokalAktivierung{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}NT-AUTORITÄTLokaler DienstS-1-5-19LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Software Protection" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (03/24/2014 08:08:20 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Software Protection erreicht. Microsoft Office Sessions: ========================= Error: (03/31/2014 11:29:43 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe Error: (03/31/2014 10:43:13 PM) (Source: Application Hang)(User: ) Description: wwahost.exe6.3.9600.16431137001cf4d211a2251244294967295C:\WINDOWS\syswow64\wwahost.exe0e7097b3-b915-11e3-bed9-7054d249348eMicrosoft.SkypeApp_2.6.0.1000_x86__kzf8qxf38zg5cApp Error: (03/31/2014 10:23:33 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe Error: (03/28/2014 08:22:46 AM) (Source: Customer Experience Improvement Program)(User: ) Description: 80070005 Error: (03/27/2014 06:20:02 PM) (Source: Application Error)(User: ) Description: skydrive.exe6.3.9600.1650752ce4d58unknown0.0.0.0000000000000000000000000000000001fc001cf49d6b2f4a12fC:\Windows\System32\skydrive.exeunknowna5cbdbef-b5cb-11e3-bed8-7054d249348e Error: (03/26/2014 10:18:43 PM) (Source: Customer Experience Improvement Program)(User: ) Description: 80070005 Error: (03/24/2014 04:21:09 PM) (Source: Microsoft-Windows-Defrag)(User: ) Description: TI30992300A (C:)Falscher Parameter. (0x80070057) Error: (03/24/2014 04:11:22 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe Error: (03/24/2014 04:09:47 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNamec:\program files (x86)\spybot - search & destroy 2\SDWSCSvc.exe Error: (03/24/2014 02:47:43 PM) (Source: SideBySide)(User: ) Description: hxxp://schemas.microsoft.com/SMI/2005/WindowsSettings^antispywareProductDisplayNameC:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe CodeIntegrity Errors: =================================== Date: 2014-03-24 07:08:24.000 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-24 07:08:23.938 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-24 07:08:23.938 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-24 07:08:22.547 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 22:29:57.725 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-18 22:21:15.061 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 22:20:37.609 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-03-18 22:20:19.686 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 22:18:22.712 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. Date: 2014-03-18 19:01:30.703 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 33% Total physical RAM: 6025.22 MB Available physical RAM: 3982.17 MB Total Pagefile: 6985.22 MB Available Pagefile: 4835.64 MB Total Virtual: 131072 MB Available Virtual: 131071.84 MB ==================== Drives ================================ Drive c: (TI30992300A) (Fixed) (Total:687.83 GB) (Free:621.29 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 699 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ Nur den adwcleaner |
Themen zu BKA/Gema Trojaner auf Internet-Seite erhalten |
browser, eingefangen, erhalte, euro, funktioniert, gefangen, gen, heute, interne, konnte, meldung, nichts, norton, scan, scanner, schließe, sperre, sperren, surfe, surfen, taskmanager, trojaner, virenscan, virenscanner, warnmeldung |