|
Plagegeister aller Art und deren Bekämpfung: Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
21.04.2014, 15:31 | #1 |
| Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? Hallo, Bitdefender meldet, es sei im Temp-Ordner eine Datei namens X5y1uSJw.exe gefunden worden und weiter: "Bitdefender konnte das Objekt nicht bereinigen. Ihr Computer ist nicht virenfrei. Virusname: Gen: Variant Symmi.27617." In dem besagten Ordner ist die angegeben Datei nicht zu finden gewesen (Versteckte/Systemdateien sichtbar), auch nicht über die MS-DOS-Oberfläche. Ich habe Bitdefender einen Scan des Ordners machen lassen ohne dass erneut ein Fund angezeigt wurde und danach einen Systemscan ebenfalls ohne Fund. Danach habe ich eine Reihe anderer Programme auf den Ordner angesetzt sowie weitere Systemscans gemacht mit: Housecall (TrendMicro), Hitman Pro, Spybot Search/Destroy, Emisoft Anti-Malware. Kein Fund. Über das genannte Virus habe ich im Netz lediglich einen kurzen Foreneintrag bei Bitdefender gefunden: hxxp://forum.bitdefender.com/index.php?showtopic=42546 Dort wurde zum Löschen des Ordners geraten. Dementsprechend habe ich alle Dateien im Temp-Ordner gelöscht, obwohl die besagte Datei dort nicht zu sehen war. Den Ordner selbst habe ich nicht gelöscht, weil dieser ja zu Windows selbst gehört und ich nicht sicher bin, ob das überhaupt möglich ist. Obwohl ich hoffe, dass Bitdefender eine Falschmeldung ausgegeben hat, bin ich verunsichert und wäre für eine Einschätzung dankbar, ob mein System nicht eventuell doch kompromittiert ist. Noch kurz zur Sicherung meines Systems: Ich nutze Bitdefender Internet Security 2013, HitmanPro64, EMET Notification, Secure Banking, Keepass/KeeFox, Noscript. Das Benutzerkonto läuft nicht als Admin, sondern als Standardkonto. Letzteres habe ich allerdings erst heute nach der Meldung von Bitdefender eingerichtet. Logfiles zu lang: Ich habe versucht, die Logfiles gemäß der Anleitung in Text einzubinden, bekam aber die Fehlermeldung, der Text sei zu lang. Deshalb hänge ich die Logfiles von FRST und GMER als Anhänge an und hoffe, das ist so in Ordnung. Beste Grüße und Dank im Voraus |
21.04.2014, 19:11 | #2 |
/// the machine /// TB-Ausbilder | Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke. So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
21.04.2014, 21:24 | #3 |
| Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? Moinsen schrauber,
__________________vielen Dank für die Antwort. Entsprechend Deiner Beschreibung hatte ich es (eigentlich) auch gemacht und bekam dann die Meldung, der Text sei zu lang. Dementsprechend habe ich mir jetzt gerade noch einmal angeguckt, welche Länge die Logfiles haben. Bei den Ergebnissen von FRST ist das vergleichsweise noch "überschaubar". Diese ergeben in einem Word-Dokument 46 Seiten mit 97 000 Zeichen (mit Leerzeichen) und wurden von mir nachfolgend eingebunden. Bei dem Ergebnis von GMER sind es hingegen über 400 Seiten und 1,9 Mio. Zeichen (72 000 Wörter)!! Ist ein solcher Umfang noch "normal" oder habe ich etwas falsch gemacht? Ich kann das Ergenis natürlich auf 16 Posts verteilen, denke aber nicht, dass das zielführend ist, oder? Vielleicht magst Du dazu noch etwas sagen und ansonsten helfen ja vielleicht auch die FRST Ergebnisse schon weiter? Grüße Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-04-2014 02 Ran by Moonchild at 2014-04-21 14:20:23 Running from K:\Windows_SSD\Downloads\Antivirenaktion Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Bitdefender Virenschutz (Enabled - Up to date) {9B5F5313-CAF9-DD97-C460-E778420237B4} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} AS: Bitdefender Spyware-Schutz (Enabled - Up to date) {203EB2F7-ECC3-D219-FED0-DC0A39857D09} FW: Bitdefender Firewall (Enabled) {A364D236-8096-DCCF-EF3F-4E4DBCD170CF} ==================== Installed Programs ====================== Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft) 7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov) 7-Zip 9.22beta (HKLM-x32\...\7-Zip) (Version: - ) Adobe Digital Editions (HKLM-x32\...\Digital Editions) (Version: - ) Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.0.112 - Adobe Systems, Inc.) Advanced Archive Password Recovery (HKLM-x32\...\{01011662-76A8-41E8-B1A8-4F8821570AC5}) (Version: 4.54.48.1338 - Elcomsoft Co. Ltd.) Advanced PDF Password Recovery (HKCU\...\Advanced PDF Password Recovery) (Version: 4.0 - ElcomSoft Co. Ltd.) Advanced PDF Password Recovery (HKLM-x32\...\{6A2B148A-5D96-40D2-8450-692713BB7457}) (Version: 5.05.97.1109 - Elcomsoft Co. Ltd.) Advanced Renamer (HKLM-x32\...\Advanced Renamer_is1) (Version: 3.51 - Hulubulu Software) Alan Wake (HKLM-x32\...\Steam App 108710) (Version: - Remedy Entertainment) Alan Wake's American Nightmare (HKLM-x32\...\Steam App 202750) (Version: - Remedy Entertainment) Amazon Cloud Drive (HKLM-x32\...\{9A766E33-BB01-480F-ABFC-424B8AC11212}) (Version: 0.11.12.0 - Amazon.com) Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon) Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC) Amazon Send to Kindle (HKLM-x32\...\SendToKindle) (Version: 1.0.0.192 - Amazon) AMD Accelerated Video Transcoding (Version: 12.5.100.20928 - Advanced Micro Devices, Inc.) Hidden AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden AMD Catalyst Install Manager (HKLM\...\{46DA7FD9-8BC1-7BA8-98D1-27F46647871B}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.) AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden AMD Media Foundation Decoders (Version: 1.0.70928.1539 - Advanced Micro Devices, Inc.) Hidden Apple Application Support (HKLM-x32\...\{343666E2-A059-48AC-AD67-230BF74E2DB2}) (Version: 2.1.6 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{75104836-CAC7-444E-A39E-3F54151942F5}) (Version: 4.0.0.97 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Ashampoo Photo Optimizer 4 v.4.0.3 (HKLM-x32\...\Ashampoo Photo Optimizer 4_is1) (Version: 4.0.3 - Ashampoo GmbH & Co. KG) Assassin’s Creed® III (HKLM-x32\...\Steam App 208480) (Version: - Ubisoft Montreal) AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2001616110.48.56.4132210 - Audible, Inc.) Aufgaben (HKLM-x32\...\{38AFF23A-CE45-4D7D-B8D4-3517125E7DD2}) (Version: 1.1.3 - Holliesoft) Avidemux 2.5 (HKLM-x32\...\Avidemux 2.5 (64-bit)) (Version: 2.5.6.7716 - ) Batman: Arkham City™ (HKLM-x32\...\GFWL_{57520FA0-AC56-469B-9983-FF1000008300}) (Version: 1.0.0000.131 - WB Games) Batman: Arkham City™ (x32 Version: 1.0.0000.131 - WB Games) Hidden Batman: Arkham City™ (x32 Version: 1.0.0003.131 - WB Games) Hidden Beurer HealthManager (HKLM-x32\...\Beurer HealthManager) (Version: 2.2.0.0 - Beurer Health And Well-Being) Beurer HealthManager (x32 Version: 2.2.0.0 - Beurer Health And Well-Being) Hidden Bitdefender Internet Security 2013 (HKLM\...\Bitdefender) (Version: 16.26.0.1739 - Bitdefender) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) BoxCryptor 1.5 (HKLM-x32\...\BoxCryptor) (Version: 1.5.410.149 - Secomba GmbH) BS.Player FREE (HKLM-x32\...\BSPlayerf) (Version: 2.63.1070 - AB Team, d.o.o.) BurnAware Free 6.9.2 (HKLM-x32\...\BurnAware Free_is1) (Version: - Burnaware) calibre 64bit (HKLM\...\{50A398DA-4562-40AA-9535-0A14C4AB1DD9}) (Version: 1.21.0 - Kovid Goyal) CamStudio (HKLM-x32\...\CamStudio) (Version: - ) Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - ) Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - ) Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version: - ) Canon MP540 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series) (Version: - ) Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - ) Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - ) Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center (x32 Version: 2012.0928.1532.26058 - Ihr Firmenname) Hidden Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center InstallProxy (x32 Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Standard (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Traditional (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Czech (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Danish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Dutch (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help English (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Finnish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help French (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help German (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Greek (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Hungarian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Italian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Japanese (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Korean (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Norwegian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Polish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Portuguese (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Russian (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Spanish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Swedish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Thai (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden CCC Help Turkish (x32 Version: 2012.0928.1531.26058 - Advanced Micro Devices, Inc.) Hidden ccc-utility64 (Version: 2012.0928.1532.26058 - Advanced Micro Devices, Inc.) Hidden CCleaner (HKLM\...\CCleaner) (Version: 3.14 - Piriform) CD Bremse 1.49 (HKLM-x32\...\CD Bremse_is1) (Version: 1.49 - ) Cimaware OfficeFIX 6.xx (HKCU\...\Cimaware OfficeFIX 6.xx) (Version: - Cimaware Software) click.to version 0.9.6.1330 (HKLM-x32\...\18BED8D1-0ECA-4ADA-889D-152A6FD11022_is1) (Version: 0.9.6.1330 - Axonic) ConvertHelper 2.2 (HKLM-x32\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version: - DownloadHelper) CPU Speed Pro version 3 (HKLM-x32\...\{E0E0C30A-89AF-11E0-951E-11904824019B}_is1) (Version: 3 - CPU Speed Pro) CPUID CPU-Z 1.63.0 (HKLM\...\CPUID CPU-Z_is1) (Version: - ) CPUID HWMonitor Pro 1.16 (HKLM\...\CPUID HWMonitorPro_is1) (Version: - ) CrystalDiskInfo 6.1.8 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.1.8 - Crystal Dew World) CrystalDiskMark 3.0.1b (HKLM\...\CrystalDiskMark_is1) (Version: 3.0.1b - Crystal Dew World) CUEcards® 2005 (HKLM-x32\...\{C0E7B43A-39F7-4ADA-BF28-B988544F2833}) (Version: 4.29.0 - Marcus Humann Software-Technik) Data Lifeguard Diagnostic for Windows 1.24 (HKLM-x32\...\{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1) (Version: - Western Digital Corporation) Debugging Tools for Windows (HKLM-x32\...\{1C943495-B69F-4D41-AE0E-23C57ECD90EE}) (Version: 6.4.7.2 - Microsoft Corporation) Desktop-Reminder 2 (HKLM-x32\...\Desktop-Reminder 2) (Version: 2.56 - Polenter - Software Solutions) Desktop-Reminder 2 (x32 Version: 2.56 - Polenter - Software Solutions) Hidden devolo Cockpit (HKLM-x32\...\dlancockpit) (Version: 4.2.1.0 - devolo AG) Digitale Bibliothek 4 (HKLM-x32\...\Digitale Bibliothek 4) (Version: - ) DisplayView Click (HKLM-x32\...\{7B2E26A2-84CF-4B58-86ED-DE8E73391BDB}) (Version: 5.30.002 - Portrait Displays, Inc.) DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.100 - DivX, LLC) Doc Scrubber v1.2 (HKLM-x32\...\Doc Scrubber_is1) (Version: 1.2 - BrightFort LLC) Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.13 - Dolby Laboratories Inc) Dragon Age Redesigned © Morrigan (HKCU\...\Dragon Age Redesigned © Morrigan) (Version: - ) Dragon Age Redesigned- Leliana's Song (HKCU\...\Dragon Age Redesigned- Leliana's Song) (Version: - ) Dragon Age Redesigned Oghren© (HKCU\...\Dragon Age Redesigned Oghren©) (Version: - ) Dragon Age Redesigned© Zevran (HKCU\...\Dragon Age Redesigned© Zevran) (Version: - ) Dragon Age Redesigned© (HKCU\...\Dragon Age Redesigned©) (Version: - ) Dragon Age Redesigned© Leliana (HKCU\...\Dragon Age Redesigned© Leliana) (Version: - ) Dragon Age Redesigned© Sten (HKCU\...\Dragon Age Redesigned© Sten) (Version: - ) Dragon Age Redesigned© Wynne (HKCU\...\Dragon Age Redesigned© Wynne) (Version: - ) Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.) EasyBCD 2.1.2 (HKLM-x32\...\EasyBCD) (Version: 2.1.2 - NeoSmart Technologies) EMET 4.1 (HKLM-x32\...\{65BC2BDA-D828-4596-99E4-A8799C45C84C}) (Version: 4.1 - Microsoft Corporation) Emsisoft Anti-Malware (HKLM-x32\...\{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1) (Version: 6.0 - Emsi Software GmbH) Eraser 6.0.9.2343 (HKLM\...\{3D33F6F0-4D90-484D-A1D9-09AE791CCBD9}) (Version: 6.0.2343 - The Eraser Project) eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden EssentialPIM (HKLM-x32\...\EssentialPIM) (Version: 5.51 - Astonsoft Ltd) Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.115 - Etron Technology) Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology) Hidden FlashCatch (HKLM-x32\...\{A0AB2980-1FDD-4b6c-940C-FC87C84F05B7}_is1) (Version: - ) Folderico 4.0 RC12 (HKLM-x32\...\Folderico) (Version: 4.0 RC12 - Shedko ( www.softq.org )) Free DVD Video Converter version 2.0.13.430 (HKLM-x32\...\Free DVD Video Converter_is1) (Version: 2.0.13.430 - DVDVideoSoft Ltd.) Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.15.0 - Futuremark Corporation) GetDataBack for NTFS (HKLM-x32\...\{56582EEA-3AEF-4D84-8B9D-C87A3CD9250F}) (Version: 4.25.000 - Runtime Software) GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team) GMX SMS-Manager (HKLM-x32\...\GMX SMS-Manager) (Version: - ) Google Chrome (HKCU\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.) Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden Google+ Auto Backup (HKCU\...\Google+ Auto Backup) (Version: 1.0.25.133 - Google, Inc.) Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google) HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.216 - SurfRight B.V.) Hot CPU Tester Pro 4.4.1 (HKLM-x32\...\{BEE9DFE1-7CDF-4D1C-A473-3B3DF8FF1431}_is1) (Version: 4.4 - 7Byte Computers) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.6.0.1002 - Intel Corporation) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.35 - Irfan Skiljan) iTunes (HKLM\...\{5E11C972-1E76-45FE-8F92-14E0D1140B1B}) (Version: 10.5.3.3 - Apple Inc.) Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.510 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden JPEG Resampler Vs 5.99.99 (HKLM-x32\...\JPEG Resampler_is1) (Version: - David Macek) KeePass Password Safe 2.25 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.25 - Dominik Reichl) Klebezettel NG (Version 2.9.12) (HKLM-x32\...\{4F81901F-3655-4340-8227-F687F69A3C79}}_is1) (Version: - ) K-Lite Codec Pack 9.8.0 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 9.8.0 - ) Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech) MAXQDA 10 (R210312) (HKLM-x32\...\MAXQDA10) (Version: (R210312) - VERBI Software.Consult.Sozialforschung GmbH) MAXQDA 10 Reader (R240113) (HKLM-x32\...\MAXQDA10Reader) (Version: (R240113) - VERBI Software.Consult.Sozialforschung GmbH) MDB Repair Tool (HKLM-x32\...\ST6UNST #1) (Version: - ) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation) Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Ultimate 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{471AAD2C-9078-4DAC-BD43-FA10FB7C3FCE}) (Version: 10.51.2500.0 - Microsoft Corporation) Microsoft SQL Server 2008 R2 Setup (English) (HKLM-x32\...\{48B08845-0CB0-45EC-893C-15319ADDA312}) (Version: 10.51.2500.0 - Microsoft Corporation) Microsoft SQL Server 2008 Setup Support Files (HKLM-x32\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation) Microsoft SQL Server Browser (HKLM-x32\...\{BF9BF038-FE03-429D-9B26-2FA0FD756052}) (Version: 10.51.2500.0 - Microsoft Corporation) Microsoft SQL Server VSS Writer (HKLM\...\{288D79EE-A2D1-42AF-9597-B0ADCC23A8ED}) (Version: 10.51.2500.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Windows Debugging Symbols (HKLM-x32\...\{68ADAEAA-DABD-45C1-9CC2-F995407549CD}) (Version: 7601 - Microsoft) Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.145.0 - Microsoft Corporation) Microsoft-Maus- und Tastatur-Center (Version: 2.3.145.0 - Microsoft Corporation) Hidden Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla) Mozy Sync (HKLM\...\{1996E34F-8A17-49D9-8735-FE78ADDE48A4}) (Version: 1.2.0.4028 - Mozy, Inc) MozyHome (HKLM\...\{06BFC7A0-2C6A-ED03-5684-37E8949A5823}) (Version: 2.26.0.376 - Mozy, Inc.) MSXML 4.0 (x32 Version: 4.20.9818.0 - Microsoft Corporation) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.11100.8.0 - Nero AG) Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.49.0 - Black Tree Gaming) NVIDIA PhysX (HKLM-x32\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation) PC Connectivity Solution (HKLM-x32\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia) PDF Architect (HKLM-x32\...\{80A07844-CA64-4DE4-AB61-D37DDBE8074F}) (Version: 1.0.52.8917 - pdfforge) PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.2 - pdfforge) pdfforge Images2PDF 0.9.2.546 (HKLM\...\{00120495-F25C-4F44-9DC7-2D812D025DBA}) (Version: 0.9.2.546 - pdfforge GbR) PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.210.0 - Tracker Software Products Ltd) Philips Songbird (HKLM-x32\...\Philips Songbird) (Version: 2.6.1 Build: 6.1.2265 - Koninklijke Philips Electronics N.V.) Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.) Pivot Pro Plugin (x32 Version: 9.50.110 - Portrait Displays, Inc.) Hidden PL-2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: 1.2.10 - Prolific Technology INC) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek) Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6519 - Realtek Semiconductor Corp.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6873 - Realtek Semiconductor Corp.) Recuva (HKLM\...\Recuva) (Version: 1.42 - Piriform) Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - ) Samsung New PC Studio USB Driver Installer (HKLM-x32\...\InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Samsung New PC Studio USB Driver Installer (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.650.0 - SAMSUNG Electronics Co., Ltd.) SamsungConnectivityCableDriver (HKLM-x32\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung) Sandboxie 4.08 (64-bit) (HKLM\...\Sandboxie) (Version: 4.08 - Sandboxie Holdings, LLC) SDK (x32 Version: 2.34.014 - Portrait Displays, Inc.) Hidden SDS (Shutdown Scheduler) (HKLM-x32\...\CWK) (Version: 2.50.2.40 - Damian Pasternak) Secure Banking Version 1.5.2 (HKLM-x32\...\{0BEE0AF9-79F3-4C4F-B374-90C0A16BF294}_is1) (Version: 1.5.2 - Hopfgartner Niklas) Service Pack 1 for SQL Server 2008 R2 (KB2528583) (HKLM-x32\...\KB2528583) (Version: 10.51.2500.0 - Microsoft Corporation) SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions) SMPlayer 0.8.0 (x64) (HKLM\...\SMPlayer) (Version: 0.8.0 - Ricardo Villalba) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.) Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) SumatraPDF (HKLM-x32\...\SumatraPDF) (Version: 2.4 - Krzysztof Kowalczyk) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden TaskUnifier 3.1.1 (HKLM-x32\...\TaskUnifier 3.1.1) (Version: 3.1.1 - ) TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - TechPowerUp) The Walking Dead (HKLM-x32\...\Steam App 207610) (Version: - ) The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED) TimeComX Basic (64-Bit) (HKLM-x32\...\TimeComX Basic 64-Bit) (Version: 1.3.2.4 - Bitdreamers) TrojanHunter 5.5 (HKLM-x32\...\TrojanHunter_is1) (Version: 5.5 - Mischel Internet Security) Überwachungstool für die Intel® Turbo-Boost-Technik 2.6 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.6.2.0 - Intel) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ULTIMATER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft) VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden Veoh Web Player (HKLM-x32\...\Veoh Web Player Beta) (Version: 1.1.2.0000 - Veoh Networks, Inc.) Vista Shortcut Manager x64 (HKLM\...\{C7311329-C491-427B-8880-133E84869B3A}) (Version: 2.0 - Frameworkx) Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64) (HKLM\...\{4A5A427F-BA39-4BF0-7777-9A47FBE60C9F}) (Version: 11.0.200 - Nuance Communications Inc.) VLC media player 2.0.8 (HKLM-x32\...\VLC media player) (Version: 2.0.8 - VideoLAN) WhoCrashed 4.01 (HKLM\...\WhoCrashed_is1) (Version: - Resplendence Software Projects Sp.) Wieldy 0.3.1.996 (HKLM-x32\...\Wieldy) (Version: 0.3.1.996 - Kevin Erath) Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp) Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\BC15EA930074932BB2C4B4493C9FD4EA95087D1A) (Version: 10/12/2007 6.85.4.0 - Nokia) WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) x64 Components v3.9.6 (HKLM\...\x64 Components_is1) (Version: 3.9.6 - Shark007) xp-AntiSpy 3.98-1 (HKLM-x32\...\xp-AntiSpy) (Version: - Christian Taubenheim) ==================== Restore Points ========================= 18-09-2013 09:29:03 Windows Update 10-04-2014 09:01:07 Avery Wizard 4.0 wurde entfernt. 10-04-2014 09:02:26 Avery Wizard 4.0 wurde entfernt. 11-04-2014 13:24:57 Windows Update 14-04-2014 12:02:18 Installiert TP-LINK-Konfigurationstool und Treiber 14-04-2014 12:02:45 Installiert TP-LINK-Konfigurationstool 14-04-2014 16:36:23 Installed MozyHome 19-04-2014 14:21:32 Entfernt TP-LINK-Konfigurationstool und Treiber 19-04-2014 14:22:55 Entfernt TP-LINK-Konfigurationstool ==================== Hosts content: ========================== 2009-07-14 04:34 - 2014-04-21 01:32 - 00450639 ____R C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 www.1-2005-search.com 127.0.0.1 1-2005-search.com 127.0.0.1 123fporn.info 127.0.0.1 www.123fporn.info 127.0.0.1 123haustiereundmehr.com 127.0.0.1 www.123haustiereundmehr.com 127.0.0.1 123moviedownload.com There are 1000 more lines. ==================== Scheduled Tasks (whitelisted) ============= Task: {02EE3BDF-CAC4-4B2B-8056-6C94627C0759} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-09-04] (Microsoft Corporation) Task: {0E163F5A-1595-4977-860C-B43D3DE85C55} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {13F215A9-1BAE-4256-8B7C-636752B50E9E} - System32\Tasks\{908E7C89-6B27-4387-A35B-CD58E4FB5C1C} => K:\Windows_SSD\Downloads\Nokia_Test\Ntest.exe Task: {383AB062-0B80-4EC4-9A6A-6E78C53868E8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {3D164F79-9BFA-4DF2-B890-819EF93A9E2A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-10] (Google Inc.) Task: {44C02131-87F1-46AD-88B1-2FEB57EC2275} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000Core => C:\Users\Moonchild\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-16] (Google Inc.) Task: {6C3B8262-6596-4879-9A55-888F7A59761C} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-09-04] (Microsoft Corporation) Task: {92198E16-A1E7-466C-9E11-69DCA9360F42} - System32\Tasks\{27D3C864-D718-4323-883F-9EC0ABD8964F} => K:\Windows_SSD\Downloads\Nokia_Test\Ntest.exe Task: {952B9C35-D8D3-4CA6-A693-17BDEB382A7F} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-09-04] (Microsoft Corporation) Task: {986E44E2-C71F-4F0B-ACC6-DB067932DEFA} - System32\Tasks\RunAsStdUser Task for VeohWebPlayer => C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe [2013-06-14] (Veoh Networks) <==== ATTENTION Task: {A3680CF8-47C9-4909-AB19-207A902797B8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-10] (Google Inc.) Task: {B1FC9824-417D-4817-8EE0-86611B85FD1F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated) Task: {B7832003-FF66-4EDE-8332-BB88E4BC2DDA} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-09-04] (Microsoft Corporation) Task: {D951EC09-52CC-449C-8912-71134ADCBA84} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-09-04] (Microsoft) Task: {E29559E6-B3D0-40C0-93E0-69DE8B2B0B78} - System32\Tasks\CrystalDiskInfo => C:\Program Files (x86)\CrystalDiskInfo\DiskInfo.exe [2014-02-09] (Crystal Dew World) Task: {E9EEB2E7-C9D4-4CD3-AE76-288D865B5EE8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000UA => C:\Users\Moonchild\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-16] (Google Inc.) Task: {EE600A7A-7015-4F30-B5ED-A6CC9B431874} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000Core.job => C:\Users\Moonchild\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000UA.job => C:\Users\Moonchild\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2013-11-21 11:14 - 2013-11-21 11:14 - 00089232 _____ () C:\Program Files (x86)\EMET 4.1\EMET_CE64.DLL 2013-03-07 12:52 - 2013-10-24 15:11 - 00265080 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\txmlutil.dll 2013-10-24 15:12 - 2013-10-24 15:12 - 00003072 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\UI\accessl.ui 2013-03-07 12:52 - 2011-11-14 20:17 - 00153680 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\bdfwcore.dll 2013-03-07 12:52 - 2013-10-24 15:11 - 00005120 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\UI\IMSecurityAL.ui 2014-03-25 11:41 - 2014-03-25 11:41 - 00771328 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00038_020\ashttpbr.mdl 2014-03-25 11:41 - 2014-03-25 11:41 - 00568400 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00038_020\ashttpdsp.mdl 2014-03-25 11:41 - 2014-03-25 11:41 - 02593416 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00038_020\ashttpph.mdl 2014-03-25 11:41 - 2014-03-25 11:41 - 01317216 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\otengines_00038_020\ashttprbl.mdl 2013-11-26 16:41 - 2012-09-26 12:14 - 00091504 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\msgHook64.dll 2013-07-24 00:13 - 2013-07-24 00:13 - 00075136 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2013-11-26 16:40 - 2012-09-26 12:14 - 00273264 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dthook.dll 2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll 2012-01-15 20:36 - 2013-02-05 15:40 - 00094416 _____ () C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe 2014-02-24 21:03 - 2012-09-07 18:30 - 00002560 _____ () C:\Program Files (x86)\Secure Banking\sbservice.exe 2013-11-21 11:14 - 2013-11-21 11:14 - 00114176 _____ () C:\Program Files (x86)\EMET 4.1\HelperLib.dll 2013-11-12 10:22 - 2013-11-12 10:22 - 00028672 _____ () C:\Program Files (x86)\EMET 4.1\ReportingSubsystem.dll 2013-11-21 11:14 - 2013-11-21 11:14 - 00348160 _____ () C:\Program Files (x86)\EMET 4.1\DevExpress.UserSkins.HighContrast.dll 2013-11-21 11:14 - 2013-11-21 11:14 - 00023040 _____ () C:\Program Files (x86)\EMET 4.1\TrayIconSubsystem.dll 2013-11-21 11:14 - 2013-11-21 11:14 - 00042496 _____ () C:\Program Files (x86)\EMET 4.1\PKIPinningSubsystem.dll 2012-01-16 20:55 - 2010-05-13 17:34 - 00674928 _____ () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe 2012-01-16 20:55 - 2010-05-13 17:34 - 00711792 _____ () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe 2013-11-26 16:41 - 2012-09-26 12:14 - 00164208 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe 2013-11-26 16:41 - 2012-09-26 12:14 - 00198000 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe 2011-06-24 23:56 - 2011-06-24 23:56 - 00087328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2011-06-24 23:56 - 2011-06-24 23:56 - 01241888 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-04-21 01:16 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2014-04-21 01:16 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2014-04-21 01:16 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2014-04-21 01:16 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2014-04-21 01:16 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2012-01-15 20:36 - 2011-12-27 13:31 - 07726080 _____ () C:\Program Files (x86)\Allway Sync\Bin\syncapp.dll 2012-01-15 20:36 - 2013-02-05 15:10 - 00043520 _____ () C:\Program Files (x86)\Allway Sync\Bin\SyncHook.dll 2013-11-26 16:41 - 2012-09-26 12:14 - 00086384 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\msgHook.dll 2014-02-24 21:03 - 2013-06-30 18:01 - 00017920 _____ () C:\Program Files (x86)\Secure Banking\SecureBanking.dll 2014-02-24 21:03 - 2013-05-26 14:13 - 00008704 _____ () C:\Program Files (x86)\Secure Banking\funcs.dll 2012-01-16 20:54 - 2012-09-26 12:14 - 00188784 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Shared\PresetsCOM.dll 2012-01-16 20:55 - 2012-09-26 12:14 - 00123248 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\CC\gui.dll 2014-02-15 19:16 - 2014-02-15 19:16 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3755381f4fd94e23b6b2972d67bd4e03\IsdiInterop.ni.dll 2012-01-15 18:04 - 2011-05-20 11:05 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll 2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL 2013-03-29 17:10 - 2013-10-24 15:11 - 00204280 _____ () C:\Program Files\Bitdefender\Bitdefender 2013\antispam32\txmlutil.dll 2009-02-26 14:46 - 2009-02-26 14:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll 2011-06-22 12:46 - 2011-06-22 12:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll 2013-11-21 11:14 - 2013-11-21 11:14 - 00080528 _____ () C:\Program Files (x86)\EMET 4.1\EMET_CE.DLL 2014-02-15 10:51 - 2014-03-29 10:51 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8 AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9 AlternateDataStreams: C:\Users\Moonchild\Downloads\allwaysync-14-0-1.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\DANZIG Mama1.avi:TOC.WMV AlternateDataStreams: C:\Users\Moonchild\Downloads\dbg_x86_6.4.7.2.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\docscrubbersetup12.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\Duden_Rechtschreibpruefung_9_Demo.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\Everything-1.2.1.371.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\firmware-dlan-200-av-windows-4-4-0-5.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\HitmanPro_x64.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\mozy-sync.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\software-dlan-cockpit-windows-4-2-1.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\spybot-2.2.25.exe:BDU AlternateDataStreams: C:\Users\Moonchild\Downloads\winx-dvd63-author.exe:BDU ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver" ==================== Disabled items from MSCONFIG ============== MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MozyHome Status.lnk => C:\Windows\pss\MozyHome Status.lnk.CommonStartup MSCONFIG\startupfolder: C:^Users^Moonchild^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^A Note.lnk => C:\Windows\pss\A Note.lnk.Startup MSCONFIG\startupfolder: C:^Users^Moonchild^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^click.to.lnk => C:\Windows\pss\click.to.lnk.Startup MSCONFIG\startupfolder: C:^Users^Moonchild^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: amd_dc_opt => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" MSCONFIG\startupreg: AutoStartNPSAgent => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon MSCONFIG\startupreg: CanonSolutionMenu => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon MSCONFIG\startupreg: DivXMediaServer => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW MSCONFIG\startupreg: DNS7reminder => "C:\Program Files (x86)\Nuance\NaturallySpeaking12\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking12\Ereg.ini" MSCONFIG\startupreg: Dolby Home Theater v4 => "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart MSCONFIG\startupreg: Eraser => "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart MSCONFIG\startupreg: GMX SMS-Manager => C:\Program Files (x86)\GMX\GMX SMS-Manager\SMSMngr.exe MSCONFIG\startupreg: Google Update => "C:\Users\Moonchild\AppData\Local\Google\Update\GoogleUpdate.exe" /c MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler MSCONFIG\startupreg: iTunesHelper => "K:\Windows_SSD\iTunes\iTunesHelper.exe" MSCONFIG\startupreg: Klebezettel NG => "C:\Program Files (x86)\Klebezettel NG\klebez.exe" MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch MSCONFIG\startupreg: Philips Device Listener => "C:\Program Files (x86)\Philips\Philips Songbird Resources\Autolauncher\PhilipsDeviceListener.exe" MSCONFIG\startupreg: PivotSoftware => "C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe" -delay=10 MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime MSCONFIG\startupreg: SandboxieControl => "C:\Program Files\Sandboxie\SbieCtrl.exe" MSCONFIG\startupreg: SpywareTerminatorShield => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe MSCONFIG\startupreg: SpywareTerminatorUpdater => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" MSCONFIG\startupreg: THGuard => "C:\Program Files (x86)\TrojanHunter 5.5\THGuard.exe" MSCONFIG\startupreg: TrojanScanner => C:\Program Files (x86)\Trojan Remover\Trjscan.exe /boot MSCONFIG\startupreg: VeohPlugin => "C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (04/21/2014 01:32:10 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/21/2014 09:13:37 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/21/2014 00:47:21 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/20/2014 05:52:19 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/20/2014 03:53:34 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/20/2014 09:19:28 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/19/2014 07:32:56 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/19/2014 04:22:15 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/19/2014 04:00:42 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (04/19/2014 03:35:59 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (04/21/2014 01:30:39 PM) (Source: DCOM) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Error: (04/21/2014 04:27:46 AM) (Source: DCOM) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Error: (04/21/2014 00:46:10 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit folgendem dienstspezifischem Fehler beendet: %%0. Error: (04/21/2014 00:44:34 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst VSSERV erreicht. Error: (04/21/2014 00:44:02 AM) (Source: DCOM) (User: ) Description: {B8FB4AD7-EA4A-4B47-BFDC-BFC94160A8EA} Error: (04/21/2014 00:42:20 AM) (Source: DCOM) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (04/20/2014 07:08:17 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "devolo Network Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (04/19/2014 04:16:20 PM) (Source: DCOM) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Error: (04/19/2014 00:53:55 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (04/19/2014 01:04:52 AM) (Source: DCOM) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Microsoft Office Sessions: ========================= Error: (03/26/2014 02:24:41 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6690.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 11873 seconds with 2040 seconds of active time. This session ended with a crash. Error: (02/17/2014 03:42:10 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 48 seconds with 0 seconds of active time. This session ended with a crash. Error: (01/17/2014 10:45:27 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 22 seconds with 0 seconds of active time. This session ended with a crash. Error: (03/16/2013 06:37:47 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash. Error: (03/08/2013 07:40:22 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 2, Application Name: Microsoft Office Access, Application Version: 12.0.6606.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 32 seconds with 0 seconds of active time. This session ended with a crash. Error: (02/09/2013 02:57:01 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 0 seconds with 0 seconds of active time. This session ended with a crash. Error: (12/17/2012 04:29:40 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 752 seconds with 180 seconds of active time. This session ended with a crash. Error: (12/16/2012 06:56:15 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 957 seconds with 780 seconds of active time. This session ended with a crash. Error: (12/05/2012 09:10:51 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 505 seconds with 60 seconds of active time. This session ended with a crash. Error: (06/26/2012 10:35:19 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 56 seconds with 0 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2013-09-07 17:27:43.015 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Program Files (x86)\Emsisoft Anti-Malware\a2hooks64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-06 11:42:09.286 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-06 11:42:09.286 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-06 11:42:09.286 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-06 11:42:09.270 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-06 11:42:09.270 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-06 11:42:09.270 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-05 01:34:42.303 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-05 01:34:42.302 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-03-05 01:34:42.300 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 43% Total physical RAM: 8175.11 MB Available physical RAM: 4596.18 MB Total Pagefile: 20173.29 MB Available Pagefile: 16062.32 MB Total Virtual: 8192 MB Available Virtual: 8191.78 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:119.14 GB) (Free:62.83 GB) NTFS Drive d: (Win-7 Reserve) (Fixed) (Total:100 GB) (Free:93.3 GB) NTFS Drive e: (Win7-Games) (Fixed) (Total:100.01 GB) (Free:17.7 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive f: (Wissenschaft Sicherheit) (Fixed) (Total:200 GB) (Free:90.11 GB) NTFS Drive g: (Big One 2) (Fixed) (Total:1563.01 GB) (Free:1160.91 GB) NTFS Drive j: (Wissenschaft ) (Fixed) (Total:200.02 GB) (Free:86.85 GB) NTFS Drive k: (Big One) (Fixed) (Total:1562.99 GB) (Free:892.63 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 17563A89) Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=200 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=-520780513280) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119 GB) (Disk ID: A85B2270) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=119 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 4DCC9182) Partition 1: (Not Active) - (Size=100 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=200 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=-520750104576) - (Type=07 NTFS) ==================== End Of Log ============================ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02 Ran by Moonchild (administrator) on MOONCHILD-PC on 21-04-2014 14:20:02 Running from K:\Windows_SSD\Downloads\Antivirenaktion Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe (Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (AMD) C:\Windows\system32\atiesrxx.exe (Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe (AMD) C:\Windows\system32\atieclxx.exe (SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (devolo AG) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe (Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe (Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe (Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe (Secure Banking) C:\Program Files (x86)\Secure Banking\SecureBanking.exe (Mozy, Inc.) K:\Windows_SSD\MOZY\mozystat.exe (Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE () C:\Program Files (x86)\Secure Banking\sbservice.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Portrait Displays, Inc) C:\Program Files (x86)\Portrait Displays\DisplayView Click\DTHtml.exe (Mozy, Inc.) C:\Program Files\Mozy Sync\mozysync.exe (Microsoft Corporation) C:\Program Files (x86)\EMET 4.1\EMET_Agent.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Portrait Displays Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\HookManager.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe () C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe (Crystal Dew World) C:\Program Files (x86)\CrystalDiskInfo\DiskInfo.exe () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe () C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Mozy, Inc.) K:\Windows_SSD\MOZY\mozybackup.exe (Mozy, Inc.) K:\Windows_SSD\MOZY\mozybackup.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.) HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe [1575192 2013-10-24] (Bitdefender) HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-08] (Realtek Semiconductor) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation) HKLM-x32\...\Run: [DT FUS] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [123248 2012-09-26] (Portrait Displays, Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2092032 2014-02-03] (Dominik Reichl) HKLM-x32\...\Run: [NPSStartup] => [X] HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [110192 2010-05-13] () HKLM-x32\...\Run: [EMET 4.1 Agent] => C:\Program Files (x86)\EMET 4.1\EMET_agent.exe [78992 2013-11-21] (Microsoft Corporation) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-365492360-3355046920-2098280994-1000\...\Run: [Allway Sync] => C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe [94416 2013-02-05] () HKU\S-1-5-21-365492360-3355046920-2098280994-1000\...\Run: [SecureBanking] => C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-06-30] (Secure Banking) HKU\S-1-5-21-365492360-3355046920-2098280994-1000\...\Policies\Explorer: [NoRecentDocsMenu] 1 HKU\S-1-5-21-365492360-3355046920-2098280994-1000\...\MountPoints2: {05dabfe1-3f6e-11e1-a3c3-806e6f6e6963} - L:\Run.exe Startup: C:\Users\Moonchild\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mozy Sync.lnk ShortcutTarget: Mozy Sync.lnk -> C:\Program Files\Mozy Sync\mozysync.exe (Mozy, Inc.) SSODL: EldosMountNotificator-cbfs4 - {F9FF334C-5B00-4CBA-8B28-A3D6A9A46476} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation) SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - No File SSODL-x32: EldosMountNotificator-cbfs4 - {F9FF334C-5B00-4CBA-8B28-A3D6A9A46476} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x888E1C11E9EFCC01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3321902&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPC42C8A9A-A66F-40F4-8428-CE69ED7F0D5B&q={searchTerms}&SSPV= SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms} BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: FlashCatchBHO Class - {88618A96-6D8A-42E7-B932-9073D5B2080F} - C:\Program Files (x86)\FlashCatch\flashcatch.dll (Level 9 Technology, Inc.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Toolbar: HKLM-x32 - FlashCatch - {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - C:\Program Files (x86)\FlashCatch\flashcatch.dll (Level 9 Technology, Inc.) Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File Toolbar: HKCU - No Name - {10CECF4F-A96E-4803-8AC2-F565FB29FF47} - No File DPF: HKLM {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Axonic\click.to\skype4com.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Tcpip\..\Interfaces\{A25C9FE1-77F9-4C49-B32A-8665F4273309}: [NameServer]192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Moonchild\AppData\Roaming\Mozilla\Firefox\C:\ProgramData\Kaspersky Lab\SafeBrowser\S-1-5-21-365492360-3355046920-2098280994-1000\FireFox FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - K:\Windows_SSD\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Moonchild\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Moonchild\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll () FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-15] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-15] FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext FF Extension: bdToolbar - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013-03-07] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-03-24] FF HKLM-x32\...\Firefox\Extensions: [flashcatch@flashcatch.com] - C:\Program Files (x86)\FlashCatch\firefox FF Extension: FlashCatch - C:\Program Files (x86)\FlashCatch\firefox [2013-07-15] FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext FF Extension: bdToolbar - C:\Program Files\Bitdefender\Bitdefender 2013\bdtbext [2013-03-07] ==================== Services (Whitelisted) ================= R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4163584 2014-02-24] (Emsisoft GmbH) S4 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe [69392 2013-10-24] (Bitdefender) R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [3611128 2014-02-11] (devolo AG) R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [139632 2012-09-26] (Portrait Displays, Inc.) R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-04-10] (SurfRight B.V.) R2 mozybackup; K:\Windows_SSD\MOZY\mozybackup.exe [54040 2011-09-29] (Mozy, Inc.) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2013-07-24] () R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [187592 2014-01-17] (Sandboxie Holdings, LLC) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe [67320 2013-10-24] (Bitdefender) R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe [1645256 2013-10-24] (Bitdefender) ==================== Drivers (Whitelisted) ==================== S3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-04-20] (Emsisoft GmbH) R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2014-02-24] (Emsisoft GmbH) R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2014-02-24] (Emsisoft GmbH) R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2014-02-24] (Emsisoft GmbH) R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [727592 2013-10-24] (BitDefender) R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender) R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [601360 2013-10-24] (BitDefender) R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-04-30] (BitDefender LLC) R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC) S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-10-24] (BitDefender SRL) R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [385728 2013-03-01] (EldoS Corporation) S3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2014-02-24] (Emsisoft GmbH) R3 GEARAspiWDM; C:\Windows\SysWOW64\DRIVERS\GEARAspiWDM.sys [15664 2011-07-15] (GEAR Software Inc.) R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-10-24] (BitDefender LLC) R1 mozyFilter; C:\Windows\System32\DRIVERS\mozy.sys [67808 2013-05-02] (Mozy, Inc.) R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2013-03-04] (CACE Technologies) S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [926824 2012-10-25] (Realtek Semiconductor Corporation ) R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202600 2014-01-17] (Sandboxie Holdings, LLC) R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2013-10-24] (BitDefender S.R.L.) S3 7ByteIo; \??\c:\program files (x86)\hot cpu tester pro 4\SysInfoX64.sys [X] S3 cpuz135; \??\K:\WINDOW~1\Temp\cpuz135\cpuz135_x64.sys [X] S3 DUMeterDrv; \??\C:\Program Files (x86)\DU Meter\DUMETR64.SYS [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-21 14:19 - 2014-04-21 14:20 - 00000000 ____D () C:\FRST 2014-04-21 13:19 - 2014-04-21 14:20 - 00000000 ____D () C:\Users\Moonchild\Downloads\Antivirenaktion 2014-04-21 01:32 - 2014-04-21 01:28 - 00450639 ____R () C:\Windows\system32\Drivers\etc\hosts.20140421-013210.backup 2014-04-21 01:28 - 2009-06-10 23:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20140421-012816.backup 2014-04-21 01:16 - 2014-04-21 09:38 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-04-21 01:16 - 2014-04-21 01:16 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-04-21 01:16 - 2014-04-21 01:16 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-04-21 01:16 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2014-04-21 01:15 - 2014-04-21 01:24 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-04-21 01:14 - 2014-04-21 01:15 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Moonchild\Downloads\spybot-2.2.25.exe 2014-04-21 00:51 - 2014-04-21 00:52 - 10971424 _____ (SurfRight B.V.) C:\Users\Moonchild\Downloads\HitmanPro_x64.exe 2014-04-21 00:31 - 2014-04-21 00:31 - 00002030 _____ () C:\Windows\system32\.crusader 2014-04-20 19:12 - 2014-04-20 19:12 - 01920536 _____ (devolo AG) C:\Users\Moonchild\Downloads\firmware-dlan-200-av-windows-4-4-0-5.exe 2014-04-20 19:08 - 2014-04-20 19:08 - 00002103 _____ () C:\Users\Public\Desktop\devolo Cockpit.lnk 2014-04-20 19:08 - 2014-04-20 19:08 - 00000000 ____D () C:\Users\Moonchild\AppData\Roaming\de.devolo.dLAN.Cockpit 2014-04-20 19:08 - 2014-04-20 19:08 - 00000000 ____D () C:\Program Files (x86)\devolo 2014-04-20 19:06 - 2014-04-20 19:07 - 23114232 _____ (devolo AG) C:\Users\Moonchild\Downloads\software-dlan-cockpit-windows-4-2-1.exe 2014-04-20 14:59 - 2014-04-20 15:07 - 492922872 _____ () C:\Users\Moonchild\Downloads\Kommissar_Stolberg_14.04.19_21-45_zdf_60_TVOON_DE.mpg.avi.otrkey 2014-04-18 00:51 - 2014-04-18 00:51 - 518517640 _____ () C:\Users\Moonchild\Downloads\Kommissar_Stolberg_14.04.12_21-45_zdf_60_TVOON_DE.mpg.avi 2014-04-17 21:36 - 2014-04-17 21:37 - 567585974 _____ () C:\Users\Moonchild\Downloads\Wild_Target_Sein_schaerfstes_Ziel_13.09.30_00-05_ndr_90_TVOON_DE.mpg.avi 2014-04-17 21:27 - 2014-04-17 21:27 - 643657290 _____ () C:\Users\Moonchild\Downloads\Tatort_14.03.07_23-50_Keppler, Saalf.mpg.avi 2014-04-17 13:34 - 2014-04-17 13:34 - 397386410 _____ () C:\Users\Moonchild\Downloads\Kommissar_Stolberg_14.03.29_21-45_zdf_60_TVOON_DE.mpg.avi 2014-04-17 00:27 - 2014-04-17 00:32 - 00000000 ____D () C:\Users\Moonchild\Downloads\Kindle Bücher 2014-04-14 20:48 - 2014-04-14 20:48 - 01382364 _____ () C:\Users\Moonchild\Downloads\VEVO_EMBED_IFRAME.mp2t 2014-04-14 18:36 - 2013-05-02 12:48 - 00067808 _____ (Mozy, Inc.) C:\Windows\system32\Drivers\mozy.sys 2014-04-14 14:02 - 2012-10-25 16:20 - 00926824 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\rtl8192cu.sys 2014-04-14 14:02 - 2012-10-25 16:20 - 00926824 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\Drivers\RTL8192cu.sys 2014-04-14 14:02 - 2012-10-25 16:20 - 00007540 _____ () C:\Windows\system32\net8192cu.cat 2014-04-14 14:00 - 2014-04-14 14:02 - 00000000 ____D () C:\ProgramData\TP-LINK 2014-04-11 21:39 - 2014-04-11 21:46 - 432639404 _____ () C:\Users\Moonchild\Downloads\Sechserpack_14.03.08_08-00_sat1_30_TVOON_DE.mpg.avi.otrkey 2014-04-11 15:25 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-11 15:25 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-11 15:25 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-04-11 15:25 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-11 15:25 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-04-11 15:25 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-04-11 15:25 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-04-11 15:25 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-04-11 15:25 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-04-11 15:25 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-04-11 15:25 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-11 15:25 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-04-11 15:25 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-04-11 15:25 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-04-11 15:25 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-04-11 15:25 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-04-11 15:25 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-04-11 15:25 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-04-11 15:25 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-04-11 15:25 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-04-11 15:25 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-04-11 15:25 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-04-11 15:25 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-04-11 15:25 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-04-11 15:25 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-04-11 15:25 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-04-11 15:25 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-04-11 15:25 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-04-11 15:25 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-04-11 15:25 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-04-11 15:25 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-04-11 15:25 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-04-11 15:25 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-04-11 15:25 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-04-11 15:25 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-04-11 15:25 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-04-11 15:25 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-04-11 15:25 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-04-11 15:25 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-04-11 15:25 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-04-11 15:25 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-04-11 15:25 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-04-11 15:25 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-04-11 15:25 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-04-11 15:25 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-04-11 15:25 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-04-11 15:25 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-04-11 15:25 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-04-10 00:21 - 2014-04-20 19:03 - 00000000 ____D () C:\Program Files\HitmanPro 2014-04-10 00:21 - 2014-04-10 00:21 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk 2014-04-10 00:20 - 2014-04-21 00:52 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-04-09 00:51 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-04-09 00:51 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2014-04-09 00:51 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2014-04-09 00:51 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2014-04-09 00:51 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2014-04-09 00:51 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2014-04-09 00:51 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-04-09 00:51 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2014-04-09 00:51 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2014-04-09 00:51 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2014-04-09 00:51 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2014-04-09 00:51 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys 2014-04-09 00:51 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys 2014-04-09 00:51 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys 2014-04-09 00:51 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll 2014-04-09 00:51 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll 2014-04-09 00:51 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-04-08 23:39 - 2014-04-08 23:39 - 00001845 _____ () C:\Users\Moonchild\Downloads\Hier weiter.lnk 2014-04-04 00:41 - 2014-04-04 00:43 - 00000000 ___RD () C:\Users\Moonchild\Downloads\Aktuell gucken 2014-04-04 00:22 - 2014-04-10 14:44 - 00000000 ____D () C:\Users\Moonchild\Downloads\Homeland 2014-03-26 19:33 - 2014-03-26 19:33 - 00000000 ____D () C:\Program Files (x86)\EMET 4.1 2014-03-26 19:31 - 2014-03-26 19:31 - 00000000 ____D () C:\Users\Moonchild\Downloads\Enhanced Migitation Experience 2014-03-24 22:19 - 2014-04-14 21:20 - 00000000 ____D () C:\Users\Moonchild\Downloads\Sechserpack 2014-03-24 21:26 - 2014-03-24 21:26 - 00000000 ____D () C:\Program Files\Mozy Sync ==================== One Month Modified Files and Folders ======= 2014-04-21 14:20 - 2014-04-21 14:19 - 00000000 ____D () C:\FRST 2014-04-21 14:20 - 2014-04-21 13:19 - 00000000 ____D () C:\Users\Moonchild\Downloads\Antivirenaktion 2014-04-21 14:19 - 2012-01-15 13:56 - 00000000 ____D () C:\Users\Moonchild 2014-04-21 14:09 - 2013-03-03 11:40 - 00000000 ____D () C:\Users\Moonchild\AppData\Roaming\KeePass 2014-04-21 14:09 - 2011-04-12 09:43 - 00702942 _____ () C:\Windows\system32\perfh007.dat 2014-04-21 14:09 - 2011-04-12 09:43 - 00150582 _____ () C:\Windows\system32\perfc007.dat 2014-04-21 14:09 - 2009-07-14 07:13 - 01629284 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-21 13:58 - 2012-01-16 09:46 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000UA.job 2014-04-21 13:40 - 2013-02-08 13:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-21 13:39 - 2012-01-15 13:46 - 01522469 _____ () C:\Windows\WindowsUpdate.log 2014-04-21 13:39 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-21 13:39 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-21 13:32 - 2013-02-10 14:24 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-21 13:32 - 2012-01-24 20:08 - 00661146 _____ () C:\Windows\setupact.log 2014-04-21 13:32 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-21 13:31 - 2012-04-03 17:18 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2014-04-21 13:25 - 2013-02-10 14:24 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-21 13:25 - 2013-02-02 12:38 - 00002742 _____ () C:\Windows\Sandboxie.ini 2014-04-21 12:18 - 2014-02-24 21:33 - 00000032 _____ () C:\Windows\SysWOW64\thxcfg.ini 2014-04-21 12:18 - 2013-04-07 13:16 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.5 2014-04-21 10:32 - 2012-01-15 18:33 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{330A11D1-DDF4-4F3D-9779-05555AECB1C3} 2014-04-21 09:38 - 2014-04-21 01:16 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-04-21 01:28 - 2014-04-21 01:32 - 00450639 ____R () C:\Windows\system32\Drivers\etc\hosts.20140421-013210.backup 2014-04-21 01:24 - 2014-04-21 01:15 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-04-21 01:16 - 2014-04-21 01:16 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2014-04-21 01:16 - 2014-04-21 01:16 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking 2014-04-21 01:15 - 2014-04-21 01:14 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\Moonchild\Downloads\spybot-2.2.25.exe 2014-04-21 00:52 - 2014-04-21 00:51 - 10971424 _____ (SurfRight B.V.) C:\Users\Moonchild\Downloads\HitmanPro_x64.exe 2014-04-21 00:52 - 2014-04-10 00:20 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-04-21 00:31 - 2014-04-21 00:31 - 00002030 _____ () C:\Windows\system32\.crusader 2014-04-20 19:12 - 2014-04-20 19:12 - 01920536 _____ (devolo AG) C:\Users\Moonchild\Downloads\firmware-dlan-200-av-windows-4-4-0-5.exe 2014-04-20 19:08 - 2014-04-20 19:08 - 00002103 _____ () C:\Users\Public\Desktop\devolo Cockpit.lnk 2014-04-20 19:08 - 2014-04-20 19:08 - 00000000 ____D () C:\Users\Moonchild\AppData\Roaming\de.devolo.dLAN.Cockpit 2014-04-20 19:08 - 2014-04-20 19:08 - 00000000 ____D () C:\Program Files (x86)\devolo 2014-04-20 19:07 - 2014-04-20 19:06 - 23114232 _____ (devolo AG) C:\Users\Moonchild\Downloads\software-dlan-cockpit-windows-4-2-1.exe 2014-04-20 19:03 - 2014-04-10 00:21 - 00000000 ____D () C:\Program Files\HitmanPro 2014-04-20 18:10 - 2012-02-07 11:42 - 00010150 _____ () C:\Windows\mozy.blk 2014-04-20 18:10 - 2012-02-07 11:42 - 00006290 _____ () C:\Windows\mozy.flt 2014-04-20 15:07 - 2014-04-20 14:59 - 492922872 _____ () C:\Users\Moonchild\Downloads\Kommissar_Stolberg_14.04.19_21-45_zdf_60_TVOON_DE.mpg.avi.otrkey 2014-04-20 14:58 - 2012-01-16 09:46 - 00001084 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000Core.job 2014-04-19 16:22 - 2012-01-15 16:38 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-04-19 14:53 - 2013-03-06 18:09 - 00000000 ____D () C:\Users\Moonchild\AppData\Roaming\Dropbox 2014-04-19 14:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-04-18 01:10 - 2013-04-29 15:30 - 00000000 ____D () C:\Users\Moonchild\AppData\Roaming\vlc 2014-04-18 00:51 - 2014-04-18 00:51 - 518517640 _____ () C:\Users\Moonchild\Downloads\Kommissar_Stolberg_14.04.12_21-45_zdf_60_TVOON_DE.mpg.avi 2014-04-17 21:37 - 2014-04-17 21:36 - 567585974 _____ () C:\Users\Moonchild\Downloads\Wild_Target_Sein_schaerfstes_Ziel_13.09.30_00-05_ndr_90_TVOON_DE.mpg.avi 2014-04-17 21:27 - 2014-04-17 21:27 - 643657290 _____ () C:\Users\Moonchild\Downloads\Tatort_14.03.07_23-50_Keppler, Saalf.mpg.avi 2014-04-17 13:34 - 2014-04-17 13:34 - 397386410 _____ () C:\Users\Moonchild\Downloads\Kommissar_Stolberg_14.03.29_21-45_zdf_60_TVOON_DE.mpg.avi 2014-04-17 00:32 - 2014-04-17 00:27 - 00000000 ____D () C:\Users\Moonchild\Downloads\Kindle Bücher 2014-04-14 21:20 - 2014-03-24 22:19 - 00000000 ____D () C:\Users\Moonchild\Downloads\Sechserpack 2014-04-14 20:48 - 2014-04-14 20:48 - 01382364 _____ () C:\Users\Moonchild\Downloads\VEVO_EMBED_IFRAME.mp2t 2014-04-14 14:02 - 2014-04-14 14:00 - 00000000 ____D () C:\ProgramData\TP-LINK 2014-04-11 22:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-04-11 21:46 - 2014-04-11 21:39 - 432639404 _____ () C:\Users\Moonchild\Downloads\Sechserpack_14.03.08_08-00_sat1_30_TVOON_DE.mpg.avi.otrkey 2014-04-11 15:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-04-10 14:44 - 2014-04-04 00:22 - 00000000 ____D () C:\Users\Moonchild\Downloads\Homeland 2014-04-10 00:21 - 2014-04-10 00:21 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk 2014-04-09 08:18 - 2012-02-02 01:45 - 08222456 _____ () C:\Windows\PFRO.log 2014-04-09 01:00 - 2012-01-16 10:56 - 00000000 ____D () C:\Program Files (x86)\GMX 2014-04-09 00:55 - 2012-01-15 20:44 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-04-09 00:54 - 2013-07-12 08:26 - 00000000 ____D () C:\Windows\system32\MRT 2014-04-09 00:53 - 2012-01-16 12:57 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-04-08 23:39 - 2014-04-08 23:39 - 00001845 _____ () C:\Users\Moonchild\Downloads\Hier weiter.lnk 2014-04-08 23:31 - 2012-02-01 19:41 - 00000000 ____D () C:\Users\Moonchild\AppData\Roaming\MAXQDA10 2014-04-08 19:43 - 2013-03-03 15:29 - 00000000 ____D () C:\Users\Moonchild\Anti-Bot 2014-04-08 19:13 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-04-08 11:33 - 2012-01-25 01:31 - 00000515 _____ () C:\Users\Moonchild\AppData\Roaming\burnaware.ini 2014-04-06 14:41 - 2012-10-12 13:06 - 00000000 ____D () C:\Program Files (x86)\Amazon 2014-04-04 16:00 - 2012-02-03 18:06 - 00000000 ____D () C:\Users\Moonchild\AppData\Roaming\SumatraPDF 2014-04-04 00:43 - 2014-04-04 00:41 - 00000000 ___RD () C:\Users\Moonchild\Downloads\Aktuell gucken 2014-04-04 00:41 - 2012-01-21 17:34 - 00000000 ____D () C:\Users\Moonchild\Downloads\2009Decoder_2.0.0.14 2014-03-31 14:53 - 2012-01-16 09:46 - 00004118 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000UA 2014-03-31 14:53 - 2012-01-16 09:46 - 00003722 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-365492360-3355046920-2098280994-1000Core 2014-03-30 23:25 - 2013-09-16 15:25 - 00000501 _____ () C:\Windows\system32\checkdnsid.xml 2014-03-30 14:11 - 2013-04-09 08:45 - 00000000 ____D () C:\Users\Moonchild\.gimp-2.8 2014-03-29 15:07 - 2012-04-26 00:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-29 10:51 - 2014-02-15 10:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-03-28 20:20 - 2013-02-10 14:24 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-28 20:20 - 2013-02-10 14:24 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-26 19:50 - 2012-01-15 13:56 - 00000000 ___RD () C:\Users\Moonchild\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-03-26 19:33 - 2014-03-26 19:33 - 00000000 ____D () C:\Program Files (x86)\EMET 4.1 2014-03-26 19:31 - 2014-03-26 19:31 - 00000000 ____D () C:\Users\Moonchild\Downloads\Enhanced Migitation Experience 2014-03-26 09:41 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-24 21:26 - 2014-03-24 21:26 - 00000000 ____D () C:\Program Files\Mozy Sync Files to move or delete: ==================== C:\Users\Moonchild\AppData\Roaming\CamLayout.ini C:\Users\Moonchild\AppData\Roaming\CamShapes.ini ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-19 00:36 ==================== End Of Log ============================ --- --- --- |
22.04.2014, 13:54 | #4 |
/// the machine /// TB-Ausbilder | Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? Gmer brauche ich nicht, Rechner ist sauber
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
22.04.2014, 19:25 | #5 |
| Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? Moinsen, da fällt mir der sprichwörtliche Stein vom Herzen! Vielen Dank für die schnelle Hilfe Grüße |
23.04.2014, 08:52 | #6 |
/// the machine /// TB-Ausbilder | Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? Gern Geschehen
__________________ --> Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? |
Themen zu Bitdefender meldet Virus; Datei nicht auffindbar; Falschmeldung oder befallen? |
anleitung, benutzerkonto, bitdefender, computer, datei, defender, ebenfalls, erneut, fehlermeldung, gelöscht, gmer, internet, kurze, logfiles, löschen, meldet, namens, programme, scan, secure, security, spybot, variant, virus, windows |