| |
| |||||||
Log-Analyse und Auswertung: Win7 Flashplayer-Virus LogWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
22.04.2014, 12:42
| #1 |
 |  Win7 Flashplayer-Virus Log Hallo ich hoffe jemand kann meine Logs auswerten . Ich bedanke mich im Vorraus Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-04-2014
Ran by Atasak (administrator) on ATASAK-PC on 22-04-2014 13:03:43
Running from C:\Users\Atasak\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(MICRO-STAR INTERNATIONAL CO., LTD.) C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Sitecom\WiFi USB adapter N300 Driver and Utility\RtlService.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Sitecom\WiFi USB adapter N300 Driver and Utility\RtWlan.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hauppauge Computer Works, Inc.) C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hauppauge Computer Works, Inc.) C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDevCentralService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Atasak\Downloads\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7188552 2013-05-27] (Realtek Semiconductor)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1726662431-3061907204-3187821089-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
Startup: C:\Users\Atasak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hauppauge Device Central Tray Tool.lnk
ShortcutTarget: Hauppauge Device Central Tray Tool.lnk -> C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe (Hauppauge Computer Works, Inc.)
Startup: C:\Users\Atasak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hauppauge Device Properties.lnk
ShortcutTarget: Hauppauge Device Properties.lnk -> C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe (Hauppauge Computer Works, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8E61B7A15740CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5189qpQ4c4_38306foHFv3A1AOXyRfjb5YJZsu7WbqYZtKPwZv2cWen06uGBbKoXvRF0LQlMEch4YDZn32QiqzuLPjK-GBlmj2vrIu7n5XYqtcEPe3X-EoLAaplJhNHw,&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5189qpQ4c4_38306foHFv3A1AOXyRfjb5YJZsu7WbqYZtKPwZv2cWen06uGBbKoXvRF0LQlMEch4YDZn32QiqzuLPjK-GBlmj2vrIu7n5XYqtcEPe3X-EoLAaplJhNHw,&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5189qpQ4c4_38306foHFv3A1AOXyRfjb5YJZsu7WbqYZtKPwZv2cWen06uGBbKoXvRF0LQlMEch4YDZn32QiqzuLPjK-GBlmj2vrIu7n5XYqtcEPe3X-EoLAaplJhNH8,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5189qpQ4c4_38306foHFv3A1AOXyRfjb5YJZsu7WbqYZtKPwZv2cWen06uGBbKoXvRF0LQlMEch4YDZn32QiqzuLPjK-GBlmj2vrIu7n5XYqtcEPe3X-EoLAaplJhNH8,&q={searchTerms}
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Avira Savings Advisor BHO - {A18A516C-AA41-46A9-92DB-60208917E442} - C:\Program Files (x86)\avira\Internet Explorer\avira32.dll ()
Toolbar: HKLM - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
Chrome:
=======
CHR Extension: (Google Docs) - C:\Users\Atasak\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-10]
CHR Extension: (Google Drive) - C:\Users\Atasak\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-10]
CHR Extension: (YouTube) - C:\Users\Atasak\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-10]
CHR Extension: (McAfee Security Scan+) - C:\Users\Atasak\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-04-10]
CHR Extension: (Google-Suche) - C:\Users\Atasak\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-10]
CHR Extension: (Google Wallet) - C:\Users\Atasak\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-10]
CHR Extension: (Google Mail) - C:\Users\Atasak\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-10]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 HcwDevCentralService; C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDevCentralService.exe [401232 2013-02-07] (Hauppauge Computer Works, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 MSI_Trigger_Service; C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe [29728 2013-05-28] (MICRO-STAR INTERNATIONAL CO., LTD.)
R2 RealtekCU; C:\Program Files (x86)\Sitecom\WiFi USB adapter N300 Driver and Utility\RtlService.exe [36864 2012-05-10] (Realtek Semiconductor Corp.)
S2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2014-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 hcwE5bda; C:\Windows\System32\drivers\hcwE5bda.sys [945136 2013-02-12] (Hauppauge Computer Work, Inc.)
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-02-13] ()
R3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [1525904 2012-12-18] (Realtek Semiconductor Corporation )
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-22 13:03 - 2014-04-22 13:03 - 00009877 _____ () C:\Users\Atasak\Downloads\FRST.txt
2014-04-22 13:03 - 2014-04-22 13:03 - 00000000 ____D () C:\FRST
2014-04-22 13:00 - 2014-04-22 13:00 - 02061312 _____ (Farbar) C:\Users\Atasak\Downloads\FRST64.exe
2014-04-22 13:00 - 2014-04-22 13:00 - 00000474 _____ () C:\Users\Atasak\Downloads\defogger_disable.log
2014-04-22 13:00 - 2014-04-22 13:00 - 00000000 _____ () C:\Users\Atasak\defogger_reenable
2014-04-22 12:59 - 2014-04-22 12:59 - 00050477 _____ () C:\Users\Atasak\Downloads\Defogger.exe
2014-04-22 01:26 - 2014-04-22 12:31 - 00000336 _____ () C:\Windows\setupact.log
2014-04-22 01:26 - 2014-04-22 01:26 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-21 23:34 - 2014-04-21 23:34 - 00003266 _____ () C:\Windows\System32\Tasks\{7DE12672-1F0A-4003-8C51-154C1D037920}
2014-04-21 23:29 - 2014-04-21 23:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Atasak\Downloads\revosetup95.exe
2014-04-21 23:29 - 2014-04-21 23:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Atasak\Downloads\revosetup95 (1).exe
2014-04-21 23:29 - 2014-04-21 23:29 - 00001268 _____ () C:\Users\Atasak\Desktop\Revo Uninstaller.lnk
2014-04-21 23:29 - 2014-04-21 23:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-21 16:55 - 2014-04-21 17:08 - 170752109 _____ () C:\Users\Atasak\Downloads\20140421_144255.mp4
2014-04-21 16:55 - 2014-04-21 17:07 - 140429433 _____ () C:\Users\Atasak\Downloads\20140421_141936.mp4
2014-04-17 18:27 - 2014-04-17 18:27 - 25032080 _____ (Mozilla) C:\Users\Atasak\Downloads\Firefox_Setup_de28.0.exe
2014-04-15 17:30 - 2014-04-15 17:36 - 174156421 _____ () C:\Users\Atasak\Downloads\20140415_163248.mp4
2014-04-10 22:30 - 2014-04-10 22:30 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-10 22:29 - 2014-04-22 12:40 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-10 22:29 - 2014-04-22 12:31 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-10 22:29 - 2014-04-10 22:35 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-10 22:29 - 2014-04-10 22:35 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-10 22:28 - 2014-04-10 22:29 - 00000000 ____D () C:\Users\Atasak\AppData\Local\Deployment
2014-04-10 22:28 - 2014-04-10 22:28 - 00000000 ____D () C:\Users\Atasak\AppData\Local\Apps\2.0
2014-04-10 21:39 - 2014-04-22 00:24 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-10 21:39 - 2014-04-10 21:39 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-10 21:39 - 2014-04-10 21:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-10 21:39 - 2014-04-10 21:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-10 21:39 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-10 21:39 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-10 21:39 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-10 21:38 - 2014-04-10 21:38 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Atasak\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-04-10 21:37 - 2014-04-10 21:37 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Atasak\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-10 21:35 - 2014-04-10 21:35 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-10 21:26 - 2014-04-10 21:26 - 00000000 _____ () C:\autoexec.bat
2014-04-10 21:25 - 2014-04-10 21:56 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-04-10 21:25 - 2014-04-10 21:25 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 11:49 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 11:49 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 11:49 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 11:49 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 11:49 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 11:49 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 11:49 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 11:49 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 11:49 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 11:49 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 11:49 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 11:49 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 11:49 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 11:49 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 11:49 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 11:49 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 11:49 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 11:49 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 11:49 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 11:49 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 11:49 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-07 21:39 - 2014-04-08 18:10 - 00014489 _____ () C:\Users\Atasak\Documents\Facharbeit.odt
2014-04-07 20:08 - 2014-04-07 20:08 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-04-07 20:08 - 2014-04-07 20:08 - 00000000 ____D () C:\Users\Atasak\AppData\Roaming\OpenOffice
2014-04-07 20:07 - 2014-04-07 20:07 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-04-07 19:59 - 2014-04-07 20:01 - 163606685 _____ () C:\Users\Atasak\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2014-04-07 19:26 - 2014-04-10 12:40 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-03 16:55 - 2014-04-10 12:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-02 21:54 - 2014-04-21 17:23 - 00000000 ____D () C:\Users\Atasak\AppData\Roaming\vlc
2014-04-02 21:54 - 2014-04-10 21:08 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-04-02 21:54 - 2014-04-07 20:21 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-04-02 21:47 - 2014-04-02 21:47 - 25531584 _____ () C:\Users\Atasak\Downloads\vlc-2.1.3-win32.exe
==================== One Month Modified Files and Folders =======
2014-04-22 13:03 - 2014-04-22 13:03 - 00009877 _____ () C:\Users\Atasak\Downloads\FRST.txt
2014-04-22 13:03 - 2014-04-22 13:03 - 00000000 ____D () C:\FRST
2014-04-22 13:00 - 2014-04-22 13:00 - 02061312 _____ (Farbar) C:\Users\Atasak\Downloads\FRST64.exe
2014-04-22 13:00 - 2014-04-22 13:00 - 00000474 _____ () C:\Users\Atasak\Downloads\defogger_disable.log
2014-04-22 13:00 - 2014-04-22 13:00 - 00000000 _____ () C:\Users\Atasak\defogger_reenable
2014-04-22 13:00 - 2014-03-05 15:14 - 00000000 ____D () C:\Users\Atasak
2014-04-22 13:00 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-22 13:00 - 2009-07-14 06:45 - 00021856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-22 12:59 - 2014-04-22 12:59 - 00050477 _____ () C:\Users\Atasak\Downloads\Defogger.exe
2014-04-22 12:40 - 2014-04-10 22:29 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-22 12:36 - 2014-03-05 15:15 - 01163597 _____ () C:\Windows\WindowsUpdate.log
2014-04-22 12:35 - 2011-04-12 09:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-04-22 12:35 - 2011-04-12 09:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-04-22 12:35 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-22 12:31 - 2014-04-22 01:26 - 00000336 _____ () C:\Windows\setupact.log
2014-04-22 12:31 - 2014-04-10 22:29 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-22 12:31 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-22 01:26 - 2014-04-22 01:26 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-22 00:24 - 2014-04-10 21:39 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-22 00:09 - 2014-03-15 16:00 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-21 23:51 - 2014-03-05 15:07 - 00000000 ____D () C:\Windows\Panther
2014-04-21 23:34 - 2014-04-21 23:34 - 00003266 _____ () C:\Windows\System32\Tasks\{7DE12672-1F0A-4003-8C51-154C1D037920}
2014-04-21 23:29 - 2014-04-21 23:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Atasak\Downloads\revosetup95.exe
2014-04-21 23:29 - 2014-04-21 23:29 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Atasak\Downloads\revosetup95 (1).exe
2014-04-21 23:29 - 2014-04-21 23:29 - 00001268 _____ () C:\Users\Atasak\Desktop\Revo Uninstaller.lnk
2014-04-21 23:29 - 2014-04-21 23:29 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-21 17:23 - 2014-04-02 21:54 - 00000000 ____D () C:\Users\Atasak\AppData\Roaming\vlc
2014-04-21 17:08 - 2014-04-21 16:55 - 170752109 _____ () C:\Users\Atasak\Downloads\20140421_144255.mp4
2014-04-21 17:07 - 2014-04-21 16:55 - 140429433 _____ () C:\Users\Atasak\Downloads\20140421_141936.mp4
2014-04-17 18:27 - 2014-04-17 18:27 - 25032080 _____ (Mozilla) C:\Users\Atasak\Downloads\Firefox_Setup_de28.0.exe
2014-04-15 17:36 - 2014-04-15 17:30 - 174156421 _____ () C:\Users\Atasak\Downloads\20140415_163248.mp4
2014-04-15 17:23 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 22:35 - 2014-04-10 22:29 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-10 22:35 - 2014-04-10 22:29 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-10 22:30 - 2014-04-10 22:30 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-10 22:30 - 2014-03-15 18:04 - 00000000 ____D () C:\Users\Atasak\AppData\Local\Google
2014-04-10 22:30 - 2014-03-15 18:04 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-10 22:29 - 2014-04-10 22:28 - 00000000 ____D () C:\Users\Atasak\AppData\Local\Deployment
2014-04-10 22:28 - 2014-04-10 22:28 - 00000000 ____D () C:\Users\Atasak\AppData\Local\Apps\2.0
2014-04-10 21:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system
2014-04-10 21:56 - 2014-04-10 21:25 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-04-10 21:39 - 2014-04-10 21:39 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-10 21:39 - 2014-04-10 21:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-10 21:39 - 2014-04-10 21:39 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-04-10 21:38 - 2014-04-10 21:38 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Atasak\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-04-10 21:37 - 2014-04-10 21:37 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Atasak\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-10 21:35 - 2014-04-10 21:35 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-10 21:26 - 2014-04-10 21:26 - 00000000 _____ () C:\autoexec.bat
2014-04-10 21:25 - 2014-04-10 21:25 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 21:13 - 2014-03-05 15:14 - 00000000 ___RD () C:\Users\Atasak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-10 21:08 - 2014-04-02 21:54 - 00001070 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-04-10 12:40 - 2014-04-07 19:26 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-10 12:40 - 2014-04-03 16:55 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-08 18:41 - 2014-03-05 15:41 - 00064024 _____ () C:\Users\Atasak\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-08 18:10 - 2014-04-07 21:39 - 00014489 _____ () C:\Users\Atasak\Documents\Facharbeit.odt
2014-04-08 09:26 - 2009-07-14 06:45 - 00294712 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-07 20:21 - 2014-04-02 21:54 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-04-07 20:21 - 2014-03-08 20:31 - 00000000 ____D () C:\Users\Atasak\AppData\Roaming\ArcSoft
2014-04-07 20:21 - 2014-03-08 01:23 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-04-07 20:21 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-04-07 20:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-04-07 20:08 - 2014-04-07 20:08 - 00001116 _____ () C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2014-04-07 20:08 - 2014-04-07 20:08 - 00000000 ____D () C:\Users\Atasak\AppData\Roaming\OpenOffice
2014-04-07 20:07 - 2014-04-07 20:07 - 00000000 ____D () C:\Program Files (x86)\OpenOffice 4
2014-04-07 20:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-07 20:01 - 2014-04-07 19:59 - 163606685 _____ () C:\Users\Atasak\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2014-04-03 09:51 - 2014-04-10 21:39 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-10 21:39 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-10 21:39 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-02 21:47 - 2014-04-02 21:47 - 25531584 _____ () C:\Users\Atasak\Downloads\vlc-2.1.3-win32.exe
2014-03-31 03:16 - 2014-04-10 11:49 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-10 11:49 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-10 11:49 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-10 11:49 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-30 12:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
Some content of TEMP:
====================
C:\Users\Atasak\AppData\Local\Temp\6_Offer_10.exe
C:\Users\Atasak\AppData\Local\Temp\avgnt.exe
C:\Users\Atasak\AppData\Local\Temp\BackupSetup.exe
C:\Users\Atasak\AppData\Local\Temp\devcon64.exe
C:\Users\Atasak\AppData\Local\Temp\DeviceCentralSetup.exe
C:\Users\Atasak\AppData\Local\Temp\instruct.exe
C:\Users\Atasak\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Atasak\AppData\Local\Temp\sdapskill.exe
C:\Users\Atasak\AppData\Local\Temp\sdaspwn.exe
C:\Users\Atasak\AppData\Local\Temp\SHSetup.exe
C:\Users\Atasak\AppData\Local\Temp\vcredist_x64.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-15 17:16
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-04-2014
Ran by Atasak at 2014-04-22 13:03:59
Running from C:\Users\Atasak\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
ArcSoft ShowBiz (HKLM-x32\...\{4653DA78-3DB2-4F38-A35D-675CA0AF49CA}) (Version: - ArcSoft)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
CCleaner (HKLM\...\CCleaner) (Version: 4.11 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Hauppauge Device Central (HKLM-x32\...\Hauppauge Device Central) (Version: 1.1.31038 - Hauppauge Computer Works, Inc.)
Hauppauge StreamEez (HKLM-x32\...\Hauppauge StreamEez) (Version: 1.0.31029 - Hauppauge Computer Works, Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3215 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{CA8A885F-E95B-3FC6-BB91-F4D9377C7686}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6923 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sitecom WiFi USB adapter N300 Driver and Utility (HKLM-x32\...\{9C049509-055C-4CFF-A116-1D12312225EB}) (Version: 1.00.0201 - Sitecom Europe BV)
VGA Boost (HKLM-x32\...\{809ACFAE-9A4D-4C60-9223-D8B615CD8CBA}}_is1) (Version: 1.0.0.5 - MSI)
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
==================== Restore Points =========================
03-04-2014 14:54:46 Windows Update
07-04-2014 17:26:08 Windows Update
07-04-2014 18:04:14 Installed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
07-04-2014 18:05:32 Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
07-04-2014 18:07:26 OpenOffice 4.0.1 wird installiert
10-04-2014 10:39:41 Windows Update
10-04-2014 19:25:29 Installed SpyHunter
10-04-2014 19:35:13 Removed SpyHunter
10-04-2014 19:35:38 Removed SpyHunter
10-04-2014 19:37:32 Removed SpyHunter
10-04-2014 19:50:46 Removed SpyHunter
10-04-2014 19:52:50 Removed SpyHunter
10-04-2014 19:56:05 Removed SpyHunter
21-04-2014 21:30:58 Revo Uninstaller's restore point - Shopping Helper Smartbar
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {04D3B077-4BC1-40AC-A296-9027160C8630} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-15] (Adobe Systems Incorporated)
Task: {0FCD985B-7885-4644-90FD-16D43DCDA626} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-10] (Google Inc.)
Task: {18134580-821E-498C-9C23-862FC5FB340F} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files (x86)\avira\Internet Explorer\swu.vbs"
Task: {4439AE9B-E90E-4C19-9FAF-4EFCFF89656F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-02-20] (Piriform Ltd)
Task: {C52AFCC8-8205-4646-B3E9-0AB8F84734EE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-10] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-04-22 12:59 - 2014-04-22 12:59 - 00050477 _____ () C:\Users\Atasak\Downloads\Defogger.exe
2014-03-08 00:45 - 2014-02-25 12:41 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-03-08 00:34 - 2012-11-06 10:47 - 00114688 _____ () C:\Program Files (x86)\Sitecom\WiFi USB adapter N300 Driver and Utility\EnumDevLib.dll
2014-04-10 22:30 - 2014-04-02 03:57 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\chrome_elf.dll
2014-04-10 22:30 - 2014-04-02 03:57 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\libglesv2.dll
2014-04-10 22:30 - 2014-04-02 03:57 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\libegl.dll
2014-04-10 22:30 - 2014-04-02 03:57 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll
2014-04-10 22:30 - 2014-04-02 03:58 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll
2014-04-10 22:30 - 2014-04-02 03:57 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ffmpegsumo.dll
2014-04-10 22:30 - 2014-04-02 03:58 - 13691720 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/22/2014 00:32:58 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/22/2014 01:28:13 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 11:14:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 08:21:03 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 04:52:25 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 01:06:14 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/20/2014 07:48:25 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/20/2014 03:02:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/19/2014 02:43:19 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/19/2014 01:04:19 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (04/21/2014 11:30:57 PM) (Source: Ntfs) (User: )
Description: Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen Sie auf dem Volume "\Device\HarddiskVolumeShadowCopy24" den Befehl "chkdsk" aus.
Error: (04/16/2014 04:38:37 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{344d70fa-a467-11e3-978d-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{3C016CF8-1E13-40F4-8749-E04B3A1F42E0}
Error: (04/16/2014 04:36:50 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{344d70fa-a467-11e3-978d-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{F6602CF3-1276-48CC-ACF5-1C5263DAF225}
Error: (04/16/2014 04:35:02 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{344d70fa-a467-11e3-978d-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{84F613D8-1E2E-4502-A4F9-CA18684933A5}
Error: (04/16/2014 04:33:07 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT)
Description: 0x8000002a171\??\Volume{344d70fa-a467-11e3-978d-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{91AF36AC-5A53-4E23-893D-FC8B894EECE7}
Error: (04/10/2014 11:25:08 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\Windows\system32\Rtlihvs.dll
Error: (04/10/2014 11:25:08 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\Windows\system32\Rtlihvs.dll
Error: (04/10/2014 11:25:04 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\Windows\system32\Rtlihvs.dll
Error: (04/10/2014 10:19:23 PM) (Source: Service Control Manager) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (04/10/2014 10:18:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
Error: (04/22/2014 00:32:58 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/22/2014 01:28:13 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 11:14:36 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 08:21:03 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 04:52:25 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/21/2014 01:06:14 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/20/2014 07:48:25 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/20/2014 03:02:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/19/2014 02:43:19 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/19/2014 01:04:19 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Percentage of memory in use: 21%
Total physical RAM: 8070.09 MB
Available physical RAM: 6316.31 MB
Total Pagefile: 16138.36 MB
Available Pagefile: 14299.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:425.33 GB) NTFS
Drive d: (CD-HDPVR2-V1.6-A) (CDROM) (Total:0.27 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 10B557D6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-22 13:35:31
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_DT01ACA050 rev.MS1OA750 465,76GB
Running: zw2264qe.exe; Driver: C:\Users\Atasak\AppData\Local\Temp\ufdiqpoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Users\Atasak\Downloads\Defogger.exe[908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075021465 2 bytes [02, 75]
.text C:\Users\Atasak\Downloads\Defogger.exe[908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750214bb 2 bytes [02, 75]
.text ... * 2
---- Devices - GMER 2.1 ----
Device \Driver\avipbb \Device\avipbb fffff8800632d8a0
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{E763F885-448C-4EE4-A64D-398E79B6AB7B}\Connection@Name isatap.{71AD11DA-15A4-4445-AECC-826B66020BCA}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{9F4232EB-8462-4945-B843-50599451FF08}?\Device\{E763F885-448C-4EE4-A64D-398E79B6AB7B}?\Device\{E21C11DE-FF6C-4242-9120-93E635D21FEB}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{9F4232EB-8462-4945-B843-50599451FF08}"?"{E763F885-448C-4EE4-A64D-398E79B6AB7B}"?"{E21C11DE-FF6C-4242-9120-93E635D21FEB}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{9F4232EB-8462-4945-B843-50599451FF08}?\Device\TCPIP6TUNNEL_{E763F885-448C-4EE4-A64D-398E79B6AB7B}?\Device\TCPIP6TUNNEL_{E21C11DE-FF6C-4242-9120-93E635D21FEB}?
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{E763F885-448C-4EE4-A64D-398E79B6AB7B}@InterfaceName isatap.{71AD11DA-15A4-4445-AECC-826B66020BCA}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{E763F885-448C-4EE4-A64D-398E79B6AB7B}@ReusableType 0
---- EOF - GMER 2.1 ----
|
|
22.04.2014, 13:01
| #2 |
| /// the machine /// TB-Ausbilder    | Win7 Flashplayer-Virus Log Ich hab dir in dem anderen Thema schon geantwortet.
__________________
__________________ |
|
| Themen zu Win7 Flashplayer-Virus Log |
| 4d36e972-e325-11ce-bfc1-08002be10318, administrator, antivir, antivirus, auswerten, avira, avira savings advisor, defender, desktop, explorer, fehler, flash player, google, helper, log auswerten, mozilla, neustart, realtek, registry, scan, security, services.exe, shopping helper smartbar, software, svchost.exe, system, temp, trojaner, tunnel, usb, vcredist, virus, winlogon.exe |
Linear-Darstellung
