| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Firefox lässt sich nicht mehr starten. Angebliche Beschränkungen auf meinem Benutzer...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.04.2014, 00:29
| #1 |
 |  Windows 7: Firefox lässt sich nicht mehr starten. Angebliche Beschränkungen auf meinem Benutzer... Schönen Guten Abend, vor drei Tagen habe ich den Fehler gemacht und wollte ein Spiel downloaden, dass es nicht mehr im Handel gab und habe mir dann natürlich prompt einen Virus eingefangen. Der hat dann erstmal Firefox blockiert, sodass ich ihn nicht mehr starten konnte, weil eine Registry geändert wurde. Firefox läuft aber wieder, weil gestern ein Freund von mir da war und diesen Registry-Eintrag gefunden und gelöscht hat. Trotzdem reicht mir das nicht und ich möchte das System wieder sauber kriegen, denn wahrscheinlich ist da noch mehr... Das System Neuaufsetzen konnte ich aber nicht, weil ich die Windows 7 CD nicht da habe. Deswegen würde ich es gern mit eurer Hilfe versuchen  Wie gesagt, mein Kumpel hat schon ein paar Dateien gelöscht. Ich poste hier aber das MBAM-Logfile, was VOR seinem Eingriff gemacht wurde. Alle anderen Log-Files habe ich gerade eben erst erstellen lassen. Weil ich nicht weiß, ob es wichtig ist oder nicht: Ich habe gestern einmal mein System wiederhergestellt auf den Zeitpunkt vor dem Ereignis, habe es aber mittlerweile wieder rückgängig gemacht, weil eine Systemwiederherstellung angeblich den Virus nicht beseitigen kann. So, nun die Log-Files. Bei Avira wusste ich nicht wohin mein Log-file exportiert wurde  Bei GMER bekomme ich auch eine Fehlermeldung: "Der Prozess kann nicht auf die Datei zugreifen, weil sie von einem anderen Prozess verwendet wird." Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 05.04.2014 Suchlauf-Zeit: 20:50:25 Logdatei: bla.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.05.04 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Schahin Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 236713 Verstrichene Zeit: 37 Min, 48 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 3 PUP.Optional.AlexaTB.A, HKU\S-1-5-21-1382172772-2800325970-3324916210-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DISTROMATIC\Toolbars, , [793f70b68bf00333e7324348fe051ee2], PUP.Optional.InstallCore.A, HKU\S-1-5-21-1382172772-2800325970-3324916210-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [3187de48d9a2c472f0518ee0a06255ab], PUP.Optional.InstallCore.A, HKU\S-1-5-21-1382172772-2800325970-3324916210-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [7d3b36f0a2d97abcea9588fcbd46a35d], Registrierungswerte: 2 PUP.Optional.InstallCore.A, HKU\S-1-5-21-1382172772-2800325970-3324916210-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, , [7d3b36f0a2d97abcea9588fcbd46a35d] Security.Hijack, HKU\S-1-5-21-1382172772-2800325970-3324916210-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\DISALLOWRUN|1, firefox.exe, , [d2e683a37a010135d5a0c21c23df33cd] Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 2 Adware.Linkular, C:\Users\Schahin\AppData\Local\DownloadGuide\Offers\Lollipop.exe, , [b1075accf68559dd37e767d3659f1fe1], PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, , [892f76b0c7b451e582771c4b748e0ff1], Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 26 days old and could be outdated)
Ran by Schahin (administrator) on SCHAHIN-LAPI on 08-04-2014 00:39:40
Running from C:\Users\Schahin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Dropbox, Inc.) C:\Users\Schahin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apntex.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe [7138816 2014-01-27] (Broadcom Corporation)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [576376 2012-02-02] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-04-04] (Dritek System Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-02-26] (LogMeIn Inc.)
HKLM-x32\...\Run: [Avira Systray] - C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [173136 2014-03-25] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [132736 2013-09-07] ( (Atheros Communications))
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2014-01-27] (Microsoft Corporation)
HKU\S-1-5-21-1382172772-2800325970-3324916210-1000\...\MountPoints2: {f220e147-8763-11e3-820f-806e6f6e6963} - E:\wubi.exe
AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL => "C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL" File Not Found
Startup: C:\Users\Schahin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Schahin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Schahin\AppData\Roaming\Mozilla\Firefox\Profiles\o85teofe.default
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [312448 2013-09-07] (Windows (R) Win 7 DDK provider)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [121424 2014-03-25] (Avira Operations GmbH & Co. KG)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-02-26] (LogMeIn, Inc.)
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe [5824512 2014-01-27] (Broadcom Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-02-19] (Disc Soft Ltd)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-08 00:39 - 2014-04-08 00:39 - 00008722 _____ () C:\Users\Schahin\Desktop\FRST.txt
2014-04-08 00:39 - 2014-04-08 00:39 - 00000000 ____D () C:\FRST
2014-04-08 00:37 - 2014-04-08 00:37 - 02157056 _____ (Farbar) C:\Users\Schahin\Desktop\FRST64.exe
2014-04-08 00:36 - 2014-04-08 00:36 - 00000546 _____ () C:\Users\Schahin\Downloads\defogger_disable.log
2014-04-08 00:36 - 2014-04-08 00:36 - 00000168 _____ () C:\Users\Schahin\defogger_reenable
2014-04-08 00:35 - 2014-04-08 00:35 - 00050477 _____ () C:\Users\Schahin\Downloads\Defogger(1).exe
2014-04-08 00:33 - 2014-04-08 00:33 - 00050477 _____ () C:\Users\Schahin\Desktop\Defogger.exe
2014-04-07 23:38 - 2014-04-07 23:38 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Users\Schahin\AppData\Roaming\Mozilla
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Mozilla
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-07 07:50 - 2014-04-07 07:50 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Avira
2014-04-07 07:47 - 2014-04-07 07:47 - 00077744 _____ () C:\Users\Internet\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-07 07:47 - 2014-04-07 07:47 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Atheros
2014-04-07 07:47 - 2014-04-07 07:47 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Adobe
2014-04-07 07:46 - 2014-04-07 08:20 - 00000000 ____D () C:\Users\Internet
2014-04-07 07:46 - 2014-04-07 08:19 - 00000000 ____D () C:\Users\Internet\AppData\Local\LogMeIn Hamachi
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Vorlagen
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Startmenü
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Netzwerkumgebung
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Lokale Einstellungen
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Eigene Dateien
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Druckumgebung
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Documents\Eigene Musik
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Documents\Eigene Bilder
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\AppData\Local\Verlauf
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\AppData\Local\Anwendungsdaten
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Anwendungsdaten
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 ____D () C:\Users\Internet\AppData\Local\VirtualStore
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 ____D () C:\Users\Internet\AppData\Local\LogMeIn
2014-04-07 07:46 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\Internet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-04-07 07:46 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\Internet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-04-07 00:26 - 2014-04-07 08:19 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-07 00:25 - 2014-04-07 08:19 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-07 00:14 - 2014-04-07 08:19 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-04-07 00:14 - 2014-04-07 08:19 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator
2014-04-07 00:14 - 2014-04-07 00:14 - 00000000 ____D () C:\Users\Schahin\AppData\Roaming\Spyware Terminator
2014-04-05 20:09 - 2014-04-07 09:55 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-05 20:09 - 2014-04-07 08:19 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-05 20:09 - 2014-04-05 20:09 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-05 20:09 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-05 20:09 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-05 20:09 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-05 19:51 - 2014-04-07 08:17 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-05 19:10 - 2014-04-07 08:19 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Temp910635a7cff4bc840405de8245cfb2a6
2014-04-05 19:10 - 2014-04-05 19:10 - 01058296 _____ () C:\Users\Schahin\Downloads\Turok-lnstall.exe
2014-04-05 16:27 - 2014-04-07 08:19 - 00000000 ____D () C:\Users\Schahin\AppData\Roaming\uTorrent
2014-04-05 16:23 - 2014-04-07 08:19 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Tempe65c714e3db3a70ad2627d6763fdb41d
2014-04-05 16:14 - 2014-04-07 08:19 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Tempabb02a2c4a14cd2ce4d6b6c4a38776d2
2014-03-17 14:35 - 2014-03-17 15:13 - 00000000 ____D () C:\Users\Schahin\Desktop\lego
2014-03-14 08:55 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 08:55 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 08:55 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 08:55 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 08:55 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 08:55 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 08:55 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 08:55 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 08:55 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 08:55 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 08:55 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 08:55 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 08:55 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 08:55 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 08:55 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 08:55 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 08:55 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 08:55 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 08:55 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 08:55 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 08:55 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 08:55 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 08:55 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 08:55 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 08:55 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 08:55 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 08:55 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 08:55 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 08:55 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 08:55 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 08:55 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 08:54 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 08:54 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 08:54 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 08:54 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 08:54 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 08:54 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 08:54 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 08:54 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 08:54 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 08:54 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-14 08:54 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-14 08:54 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 08:54 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-14 08:54 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-14 08:54 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-14 08:54 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-14 08:54 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
==================== One Month Modified Files and Folders =======
2014-04-08 00:39 - 2014-04-08 00:39 - 00008722 _____ () C:\Users\Schahin\Desktop\FRST.txt
2014-04-08 00:39 - 2014-04-08 00:39 - 00000000 ____D () C:\FRST
2014-04-08 00:37 - 2014-04-08 00:37 - 02157056 _____ (Farbar) C:\Users\Schahin\Desktop\FRST64.exe
2014-04-08 00:36 - 2014-04-08 00:36 - 00000546 _____ () C:\Users\Schahin\Downloads\defogger_disable.log
2014-04-08 00:36 - 2014-04-08 00:36 - 00000168 _____ () C:\Users\Schahin\defogger_reenable
2014-04-08 00:36 - 2014-01-27 17:08 - 00000000 ____D () C:\Users\Schahin
2014-04-08 00:35 - 2014-04-08 00:35 - 00050477 _____ () C:\Users\Schahin\Downloads\Defogger(1).exe
2014-04-08 00:33 - 2014-04-08 00:33 - 00050477 _____ () C:\Users\Schahin\Desktop\Defogger.exe
2014-04-07 23:43 - 2014-01-27 21:08 - 00003954 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{066FC137-E1E4-496F-810B-76D32AA9E94B}
2014-04-07 23:42 - 2009-07-14 06:45 - 00014992 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-07 23:42 - 2009-07-14 06:45 - 00014992 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-07 23:38 - 2014-04-07 23:38 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Users\Schahin\AppData\Roaming\Mozilla
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Mozilla
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-07 23:38 - 2014-04-07 23:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-07 23:38 - 2014-01-27 17:05 - 01713536 _____ () C:\Windows\WindowsUpdate.log
2014-04-07 23:36 - 2014-01-29 00:03 - 00000000 ___RD () C:\Users\Schahin\Dropbox
2014-04-07 23:36 - 2014-01-28 23:56 - 00000000 ____D () C:\Users\Schahin\AppData\Roaming\Dropbox
2014-04-07 23:35 - 2014-02-19 19:43 - 00000000 ____D () C:\Users\Schahin\AppData\Local\LogMeIn Hamachi
2014-04-07 23:34 - 2014-03-06 11:38 - 00006507 _____ () C:\Windows\setupact.log
2014-04-07 23:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-07 09:55 - 2014-04-05 20:09 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-07 08:44 - 2014-03-08 10:13 - 00065626 _____ () C:\Windows\PFRO.log
2014-04-07 08:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SchCache
2014-04-07 08:20 - 2014-04-07 07:46 - 00000000 ____D () C:\Users\Internet
2014-04-07 08:19 - 2014-04-07 07:46 - 00000000 ____D () C:\Users\Internet\AppData\Local\LogMeIn Hamachi
2014-04-07 08:19 - 2014-04-07 00:26 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-07 08:19 - 2014-04-07 00:25 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-07 08:19 - 2014-04-07 00:14 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-04-07 08:19 - 2014-04-07 00:14 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator
2014-04-07 08:19 - 2014-04-05 20:09 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-07 08:19 - 2014-04-05 19:10 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Temp910635a7cff4bc840405de8245cfb2a6
2014-04-07 08:19 - 2014-04-05 16:27 - 00000000 ____D () C:\Users\Schahin\AppData\Roaming\uTorrent
2014-04-07 08:19 - 2014-04-05 16:23 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Tempe65c714e3db3a70ad2627d6763fdb41d
2014-04-07 08:19 - 2014-04-05 16:14 - 00000000 ____D () C:\Users\Schahin\AppData\Local\Tempabb02a2c4a14cd2ce4d6b6c4a38776d2
2014-04-07 08:19 - 2014-01-27 21:14 - 00000000 ____D () C:\ProgramData\Package Cache
2014-04-07 08:19 - 2014-01-27 17:09 - 00000000 ___RD () C:\Users\Schahin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-07 08:19 - 2009-07-14 20:18 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-04-07 08:19 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-04-07 08:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-04-07 08:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-04-07 08:17 - 2014-04-05 19:51 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-07 08:17 - 2014-01-27 21:19 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-04-07 07:50 - 2014-04-07 07:50 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Avira
2014-04-07 07:47 - 2014-04-07 07:47 - 00077744 _____ () C:\Users\Internet\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-07 07:47 - 2014-04-07 07:47 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Atheros
2014-04-07 07:47 - 2014-04-07 07:47 - 00000000 ____D () C:\Users\Internet\AppData\Roaming\Adobe
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Vorlagen
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Startmenü
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Netzwerkumgebung
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Lokale Einstellungen
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Eigene Dateien
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Druckumgebung
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Documents\Eigene Musik
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Documents\Eigene Bilder
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\AppData\Local\Verlauf
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\AppData\Local\Anwendungsdaten
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 _SHDL () C:\Users\Internet\Anwendungsdaten
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 ____D () C:\Users\Internet\AppData\Local\VirtualStore
2014-04-07 07:46 - 2014-04-07 07:46 - 00000000 ____D () C:\Users\Internet\AppData\Local\LogMeIn
2014-04-07 00:14 - 2014-04-07 00:14 - 00000000 ____D () C:\Users\Schahin\AppData\Roaming\Spyware Terminator
2014-04-05 20:09 - 2014-04-05 20:09 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-05 19:10 - 2014-04-05 19:10 - 01058296 _____ () C:\Users\Schahin\Downloads\Turok-lnstall.exe
2014-04-03 09:51 - 2014-04-05 20:09 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-05 20:09 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-05 20:09 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-01 10:34 - 2009-07-14 19:58 - 00699440 _____ () C:\Windows\system32\perfh007.dat
2014-04-01 10:34 - 2009-07-14 19:58 - 00149548 _____ () C:\Windows\system32\perfc007.dat
2014-04-01 10:34 - 2009-07-14 07:13 - 01619700 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-30 11:31 - 2014-01-28 01:14 - 00000000 ____D () C:\Users\Schahin\Documents\Scores
2014-03-17 15:13 - 2014-03-17 14:35 - 00000000 ____D () C:\Users\Schahin\Desktop\lego
2014-03-16 16:39 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-14 09:02 - 2009-07-14 06:45 - 00321464 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 08:58 - 2014-01-27 20:24 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-14 08:56 - 2014-01-27 20:24 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-14 08:45 - 2014-01-28 23:00 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-14 08:45 - 2014-01-28 23:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-11 14:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
Some content of TEMP:
====================
C:\Users\Schahin\AppData\Local\Temp\avgnt.exe
C:\Users\Schahin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpymohbv.dll
C:\Users\Schahin\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Schahin\AppData\Local\Temp\sdapskill.exe
C:\Users\Schahin\AppData\Local\Temp\sdaspwn.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-01 12:37
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Schahin at 2014-04-08 00:41:21
Running from C:\Users\Schahin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.32 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0932-000001000000}) (Version: 9.32.00.0 - Igor Pavlov)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2904.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.5.2904.00 - CyberLink Corp.) Hidden
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3010 - Acer Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.109.2020.208 - Alps Electric)
Avira (HKLM-x32\...\{628220ce-1d5b-48fe-8fc8-73b111141180}) (Version: 1.0.5197.30752 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.0.5197.30752 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 15.0.7.3 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 15.0.7.1 - Broadcom Corporation)
Broadcom Wireless Utility (HKLM\...\Broadcom Wireless Utility) (Version: 5.100.82.120 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 4.11 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Die Schlacht um Mittelerde(tm) (HKLM-x32\...\{3F290582-3F4E-4B96-009C-E0BABAA40C42}) (Version: - )
Dropbox (HKCU\...\Dropbox) (Version: 2.6.2 - Dropbox, Inc.)
HdR Die Rückkehr des Königs tm (HKLM-x32\...\{6E298B0A-558C-4138-0096-740677B382CD}) (Version: - )
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2712 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.15 - Acer Inc.)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.173 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.173 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Mass Effect (HKLM-x32\...\{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}) (Version: 1.00 - Electronic Arts, Inc.)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.305 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.07 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.10.0909 - REALTEK Semiconductor Corp.)
Sibelius 6 (HKLM-x32\...\{17FE44E2-D21A-4F0C-BE49-798A8FBC374E}) (Version: 6.0.0 - Sibelius Software)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Star Wars JK II Jedi Outcast (HKLM-x32\...\{576E71DA-3000-48F6-9B21-B9A70D47DFCF}) (Version: - )
==================== Restore Points =========================
14-03-2014 06:55:17 Windows Update
18-03-2014 20:29:44 Windows Update
22-03-2014 09:30:11 Windows Update
01-04-2014 10:45:00 Geplanter Prüfpunkt
06-04-2014 22:00:11 Wiederherstellungsvorgang
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {75A33940-2DFB-4B45-9E95-30977FEFD200} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-02-20] (Piriform Ltd)
==================== Loaded Modules (whitelisted) =============
2013-09-07 02:45 - 2013-09-07 02:45 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2012-03-27 09:33 - 2012-03-27 09:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-27 21:24 - 2013-12-18 10:32 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-03-25 17:07 - 2014-03-25 17:07 - 00137808 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-03-25 17:07 - 2014-03-25 17:07 - 00063568 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-04-07 23:35 - 2014-04-07 23:35 - 00041984 _____ () c:\users\schahin\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpymohbv.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Schahin\AppData\Roaming\Dropbox\bin\libcef.dll
2014-01-27 21:25 - 2014-03-25 17:07 - 00049744 _____ () C:\Users\Schahin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-01-27 19:45 - 2012-06-26 02:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-04-07 23:38 - 2014-03-15 10:40 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Disabled items from MSCONFIG ==============
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\startupfolder: C:^Users^Schahin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Download Protect => C:\ProgramData\dlprotect.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/07/2014 07:45:57 AM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (04/07/2014 01:06:19 AM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: Die Lizenzdatei enthält keine gültige Lizenz. Der Dienst wird beendet!
Error: (02/19/2014 10:18:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MassEffect.exe, Version: 1.2.20608.0, Zeitstempel: 0x4a55ff66
Name des fehlerhaften Moduls: MassEffect.exe, Version: 1.2.20608.0, Zeitstempel: 0x4a55ff66
Ausnahmecode: 0xc0000005
Fehleroffset: 0x008b784d
ID des fehlerhaften Prozesses: 0xd30
Startzeit der fehlerhaften Anwendung: 0xMassEffect.exe0
Pfad der fehlerhaften Anwendung: MassEffect.exe1
Pfad des fehlerhaften Moduls: MassEffect.exe2
Berichtskennung: MassEffect.exe3
Error: (02/19/2014 10:18:41 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MassEffect.exe, Version: 1.2.20608.0, Zeitstempel: 0x4a55ff66
Name des fehlerhaften Moduls: MassEffect.exe, Version: 1.2.20608.0, Zeitstempel: 0x4a55ff66
Ausnahmecode: 0xc0000005
Fehleroffset: 0x008b784d
ID des fehlerhaften Prozesses: 0x9a8
Startzeit der fehlerhaften Anwendung: 0xMassEffect.exe0
Pfad der fehlerhaften Anwendung: MassEffect.exe1
Pfad des fehlerhaften Moduls: MassEffect.exe2
Berichtskennung: MassEffect.exe3
Error: (02/19/2014 10:10:22 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Name des fehlerhaften Moduls: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Ausnahmecode: 0xc000000d
Fehleroffset: 0x000ad694
ID des fehlerhaften Prozesses: 0x1018
Startzeit der fehlerhaften Anwendung: 0xMassEffectConfig.exe0
Pfad der fehlerhaften Anwendung: MassEffectConfig.exe1
Pfad des fehlerhaften Moduls: MassEffectConfig.exe2
Berichtskennung: MassEffectConfig.exe3
Error: (02/19/2014 10:10:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Name des fehlerhaften Moduls: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Ausnahmecode: 0xc000000d
Fehleroffset: 0x000ad694
ID des fehlerhaften Prozesses: 0x1334
Startzeit der fehlerhaften Anwendung: 0xMassEffectConfig.exe0
Pfad der fehlerhaften Anwendung: MassEffectConfig.exe1
Pfad des fehlerhaften Moduls: MassEffectConfig.exe2
Berichtskennung: MassEffectConfig.exe3
Error: (02/19/2014 10:09:20 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Name des fehlerhaften Moduls: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Ausnahmecode: 0xc000000d
Fehleroffset: 0x000ad694
ID des fehlerhaften Prozesses: 0x137c
Startzeit der fehlerhaften Anwendung: 0xMassEffectConfig.exe0
Pfad der fehlerhaften Anwendung: MassEffectConfig.exe1
Pfad des fehlerhaften Moduls: MassEffectConfig.exe2
Berichtskennung: MassEffectConfig.exe3
Error: (02/19/2014 10:07:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Name des fehlerhaften Moduls: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Ausnahmecode: 0xc000000d
Fehleroffset: 0x000ad694
ID des fehlerhaften Prozesses: 0xa04
Startzeit der fehlerhaften Anwendung: 0xMassEffectConfig.exe0
Pfad der fehlerhaften Anwendung: MassEffectConfig.exe1
Pfad des fehlerhaften Moduls: MassEffectConfig.exe2
Berichtskennung: MassEffectConfig.exe3
Error: (02/19/2014 10:06:58 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Name des fehlerhaften Moduls: MassEffectConfig.exe, Version: 1.2.0.13, Zeitstempel: 0x481b677e
Ausnahmecode: 0xc000000d
Fehleroffset: 0x000ad694
ID des fehlerhaften Prozesses: 0x12c8
Startzeit der fehlerhaften Anwendung: 0xMassEffectConfig.exe0
Pfad der fehlerhaften Anwendung: MassEffectConfig.exe1
Pfad des fehlerhaften Moduls: MassEffectConfig.exe2
Berichtskennung: MassEffectConfig.exe3
Error: (02/19/2014 07:33:12 PM) (Source: MsiInstaller) (User: Schahin-Lapi)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)
System errors:
=============
Error: (04/07/2014 08:35:26 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/07/2014 00:27:12 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/07/2014 00:20:27 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/07/2014 00:16:26 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/07/2014 00:16:26 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (04/05/2014 07:23:49 PM) (Source: DCOM) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (04/05/2014 07:23:49 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/05/2014 07:23:48 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.
Error: (03/31/2014 04:51:08 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
Error: (03/26/2014 11:45:12 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Microsoft Office Sessions:
=========================
Error: (04/07/2014 07:45:57 AM) (Source: Avira Antivirus)(User: NT-AUTORITÄT)
Description: 0x0
Error: (04/07/2014 01:06:19 AM) (Source: Avira Antivirus)(User: NT-AUTORITÄT)
Description: 0x0
Error: (02/19/2014 10:18:56 PM) (Source: Application Error)(User: )
Description: MassEffect.exe1.2.20608.04a55ff66MassEffect.exe1.2.20608.04a55ff66c0000005008b784dd3001cf2dafcc64e10dC:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exeC:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe0e5e2202-99a3-11e3-be7f-b888e35a751a
Error: (02/19/2014 10:18:41 PM) (Source: Application Error)(User: )
Description: MassEffect.exe1.2.20608.04a55ff66MassEffect.exe1.2.20608.04a55ff66c0000005008b784d9a801cf2dafbf3578ceC:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exeC:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe05747569-99a3-11e3-be7f-b888e35a751a
Error: (02/19/2014 10:10:22 PM) (Source: Application Error)(User: )
Description: MassEffectConfig.exe1.2.0.13481b677eMassEffectConfig.exe1.2.0.13481b677ec000000d000ad694101801cf2dae9e1ae5c6C:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exeC:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exedc080be8-99a1-11e3-be7f-b888e35a751a
Error: (02/19/2014 10:10:10 PM) (Source: Application Error)(User: )
Description: MassEffectConfig.exe1.2.0.13481b677eMassEffectConfig.exe1.2.0.13481b677ec000000d000ad694133401cf2dae9709e595C:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exeC:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exed4ddd67e-99a1-11e3-be7f-b888e35a751a
Error: (02/19/2014 10:09:20 PM) (Source: Application Error)(User: )
Description: MassEffectConfig.exe1.2.0.13481b677eMassEffectConfig.exe1.2.0.13481b677ec000000d000ad694137c01cf2dae795b2650C:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exeC:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exeb7606081-99a1-11e3-be7f-b888e35a751a
Error: (02/19/2014 10:07:27 PM) (Source: Application Error)(User: )
Description: MassEffectConfig.exe1.2.0.13481b677eMassEffectConfig.exe1.2.0.13481b677ec000000d000ad694a0401cf2dae35c7a2d9C:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exeC:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exe73c4b70f-99a1-11e3-be7f-b888e35a751a
Error: (02/19/2014 10:06:58 PM) (Source: Application Error)(User: )
Description: MassEffectConfig.exe1.2.0.13481b677eMassEffectConfig.exe1.2.0.13481b677ec000000d000ad69412c801cf2dae2238e40bC:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exeC:\Program Files (x86)\Mass Effect\Binaries\MassEffectConfig.exe6264decb-99a1-11e3-be7f-b888e35a751a
Error: (02/19/2014 07:33:12 PM) (Source: MsiInstaller)(User: Schahin-Lapi)
Description: Product: Skype Click to Call -- Error 1609. An error occurred while applying security settings. Users is not a valid user or group. This could be a problem with the package, or a problem connecting to a domain controller on the network. Check your network connection and click Retry, or Cancel to end the install. Unable to locate the user's SID, system error 1332(NULL)(NULL)(NULL)(NULL)(NULL)
==================== Memory info ===========================
Percentage of memory in use: 30%
Total physical RAM: 5957.28 MB
Available physical RAM: 4115.71 MB
Total Pagefile: 11912.74 MB
Available Pagefile: 9849.36 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:135.41 GB) (Free:78.31 GB) NTFS
Drive d: () (Fixed) (Total:13.42 GB) (Free:8.71 GB) NTFS
Drive f: (LOTRBFME) (CDROM) (Total:3.95 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 149 GB) (Disk ID: 30B18491)
Partition: GPT Partition Type.
==================== End Of Log ============================
Für eure Hilfe bin ich euch sehr dankbar. Schön, dass es so ein Forum gibt und ihr den Leuten helft. Danke schonmal in Vorraus!!  |
| Themen zu Windows 7: Firefox lässt sich nicht mehr starten. Angebliche Beschränkungen auf meinem Benutzer... |
| adware.linkular, antivir, avira, blockiert, c:\windows\system32\roboot64.exe, download protect, fehler, firefox blockiert, flash player, home, launch, lightning, mozilla, msiinstaller, problem, pup.optional.alexatb.a, pup.optional.installcore.a, pup.optional.pcperformer.a, registry, rückgängig, scan, security.hijack, spyware, starten, svchost.exe, system, system error, warnung, windows |
Baum-Darstellung