|
Plagegeister aller Art und deren Bekämpfung: Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
26.04.2014, 22:25 | #1 |
| Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Hallo zusammen, ich habe folgendes Problem: Ich wollte heute auf meinem Laptop Office 2013 prof plus installieren. Dies sollte über eine ISO-Datei erfolgen. Soweit, so gut. Ich komme bis zur Installation. Dann sagt mir Office irgendwann, dass bei der Installation leider ein Fehler aufgetreten sei. Im Anschluss daran öffnet sich folgendes Fenster "Microsoft Setup Bootstrapper funktioniert nicht mehr". Ich habe in anderen Foren gelesen, dass man eventuell probieren soll, seine Firewall zu deaktivieren und den Vorgang zu wiederholen. Genau das funktioniert bei mir leider nicht. Ich habe auch schon %temp% geleert und es half auch nichts. Zu guter Letzt habe ich malwarebytes über meinen Rechner laufen lassen. Dabei wurden einige Dateien gefunden und entfernt. Und jetzt würde ich mich erstmal gerne der Firewall widmen. Ich habe gelesen, dass meine Probleme wohl auf einen Virus hindeuten....aber von sowas habe ich keine Ahnung Was kann ich nun tun? Vielen Dank für die Hilfe!! |
26.04.2014, 22:33 | #2 |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Bitte auch das Log von Malwarebytes posten. Danke!
__________________Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...
Hinweise: Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden. Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert. Adware & Co. können wir sehr gut entfernen. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist. Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Das dauert dann zwar ein paar Stunden länger, garantiert aber, dass Du kompetente Hilfe und geprüfte Antworten bekommst. Siehe hier... Ich bedanke mich für Deine Geduld! Schritt 1 (Scan mit FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
Lesestoff Posten in CODE-Tags: So gehts... Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
26.04.2014, 23:02 | #3 |
| Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Hallo Jürgen,
__________________vielen Dank für deine schnelle Antwort. Es wäre toll, wenn wir das wirklich schaffen ich habe deine Anweisungen befolgt: hier nun die zwei .txt Dateien: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2014 03 Ran by Lena (administrator) on LENA-VAIO on 26-04-2014 23:57:37 Running from C:\Users\Lena\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE (Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\HDD Password Tool\TosExtSvc.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe (Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe (Smartbar) C:\Users\Lena\AppData\Local\Smartbar\Application\SnapDo.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\HDD Password Tool\TosExtCtrl.exe (Dropbox, Inc.) C:\Users\Lena\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe (ALPS) C:\Program Files\Apoint\Apvfb.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [518784 2011-03-29] (Conexant Systems, Inc.) HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [790688 2011-04-29] (Atheros Communications) HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [657568 2011-04-29] (Atheros Commnucations) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [226672 2011-02-17] (Alps Electric Co., Ltd.) HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation) HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [2757312 2011-02-15] (Sony Corporation) HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-27] (Sony Corporation) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2249352 2013-06-27] (Microsoft Corp.) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [ApnTBMon] => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.) HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282632 2013-04-02] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKLM\...\InprocServer32: [Default-wbemess] \\.\globalroot\systemroot\Installer\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56}\n. ATTENTION! ====> ZeroAccess? HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...\Run: [OfficeSyncProcess] => "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.) HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...\Run: [Browser Infrastructure Helper] => C:\Users\Lena\AppData\Local\Smartbar\Application\SnapDo.exe [28192 2014-03-30] (Smartbar) HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...\MountPoints2: {d6c074ed-cd58-11e3-97b2-78843cf2681d} - E:\SETUP.EXE HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...\MountPoints2: {da0d8f01-3e0f-11e3-8791-78843cf2681d} - "F:\WD SmartWare.exe" autoplay=true HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...\MountPoints2: {e5fa286d-275f-11e3-946f-78843cf2681d} - E:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-2584018587-2600382852-1638487148-1001\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Lena\AppData\Local\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56}\n. ATTENTION! ====> ZeroAccess/Alureon? Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HDD Password Tool.lnk ShortcutTarget: HDD Password Tool.lnk -> C:\Program Files (x86)\TOSHIBA\HDD Password Tool\TosExtCtrl.exe (TOSHIBA CORPORATION) Startup: C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Lena\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== ProxyEnable: Internet Explorer proxy is enabled. HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0Bo4l1hEFa9XxPHVWv2HS1EWxhpe9InnQGgNGyRUiCiMCw7rCFlDqbMJ4jWoCmezJ7YLti8KiCoDMUqUYoZhSayd3V4AzIW5cpuDsoh7yqeUDXMuSe6n7mYTtHvhdN3bK&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M85EB8D7D-A4F8-4267-8731-ADEF973F9750&SearchSource=55&CUI=&UM=5&UP=SP0D62B6E7-6EAF-4587-B3E9-A78559082197&SSPV= HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0Bo4l1hEFa9XxPHVWv2HS1EWxhpe9InnQGgNGyRUiCiMCw7rCFlDqbMJ4jWoCmezJ7YLti8KiCoDMUqUYoZhSayd3V4AzIW5cpuDsoh7yqeUDXMuSe6n7mYTtHvhdN3bK&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0Bo4l1hEFa9XxPHVWv2HS1EWxhpe9InnQGgNGyRUiCiMCw7rCFlDqbMJ4jWoCmezJ7YLti8KiCoDMUqUYoZhSayd3V4AzIW5cpuDsoh7yqeUDXMuSe6n7mYTtHvhdN3bJ&q={searchTerms} SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0Bo4l1hEFa9XxPHVWv2HS1EWxhpe9InnQGgNGyRUiCiMCw7rCFlDqbMJ4jWoCmezJ7YLti8KiCoDMUqUYoZhSayd3V4AzIW5cpuDsoh7yqeUDXMuSe6n7mYTtHvhdN3bJ&q={searchTerms} SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0Bo4l1hEFa9XxPHVWv2HS1EWxhpe9InnQGgNGyRUiCiMCw7rCFlDqbMJ4jWoCmezJ7YLti8KiCoDMUqUYoZhSayd3V4AzIW5cpuDsoh7yqeUDXMuSe6n7mYTtHvhdN3bK&q={searchTerms} SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtCjyXXnQme9oxsQRSyyp0Bo4l1hEFa9XxPHVWv2HS1EWxhpe9InnQGgNGyRUiCiMCw7rCFlDqbMJ4jWoCmezJ7YLti8KiCoDMUqUYoZhSayd3V4AzIW5cpuDsoh7yqeUDXMuSe6n7mYTtHvhdN3bK&q={searchTerms} BHO: SmartbarInternetExplorerBHOEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll" No File BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: SmartbarInternetExplorerBHOEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Program Files (x86)\IDM\QUICKfind\PlugIns\IEHelp.dll () BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll" No File Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" No File Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671 FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M85EB8D7D-A4F8-4267-8731-ADEF973F9750&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP0D62B6E7-6EAF-4587-B3E9-A78559082197 FF SearchEngineOrder.1: Ask Search FF SelectedSearchEngine: Google FF Homepage: hxxp://search.conduit.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M85EB8D7D-A4F8-4267-8731-ADEF973F9750&SearchSource=55&CUI=&UM=5&UP=SP0D62B6E7-6EAF-4587-B3E9-A78559082197&SSPV= FF NetworkProxy: "http", "91.228.53.28" FF NetworkProxy: "http_port", 8080 FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\searchplugins\conduit-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Battlefield Play4Free - C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\Extensions\battlefieldplay4free@ea.com [2013-08-05] FF Extension: Flashblock - C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013-04-16] FF Extension: Adblock Plus Pop-up Addon - C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\Extensions\adblockpopups@jessehakanen.net.xpi [2012-10-04] FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\Extensions\admin@proxy-listen.de.xpi [2013-01-19] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-21] FF Extension: Adblock Plus - C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-04] FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2012-08-22] ==================== Services (Whitelisted) ================= S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG) R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.) R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-04-29] (Atheros) R2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173192 2013-06-27] (Microsoft Corp.) R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] () R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.) S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.) R2 TosExtSvc; C:\Program Files (x86)\TOSHIBA\HDD Password Tool\TosExtSvc.exe [1629560 2012-08-20] (TOSHIBA CORPORATION) R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.) S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation) S3 VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [1021112 2011-03-30] (Sony Corporation) ==================== Drivers (Whitelisted) ==================== R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-26] (Disc Soft Ltd) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-26] (Malwarebytes Corporation) S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited) R0 TosExt; C:\Windows\System32\Drivers\TosExt.sys [25976 2012-08-20] (TOSHIBA Corporation) R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2014-02-26] (WinISO.com) S3 vpnva; system32\DRIVERS\vpnva64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-26 23:57 - 2014-04-26 23:58 - 00023505 _____ () C:\Users\Lena\Desktop\FRST.txt 2014-04-26 23:57 - 2014-04-26 23:57 - 00000000 ____D () C:\FRST 2014-04-26 23:56 - 2014-04-26 23:56 - 02061824 _____ (Farbar) C:\Users\Lena\Desktop\FRST64.exe 2014-04-26 23:01 - 2014-04-26 23:01 - 00212564 _____ () C:\Users\Lena\Documents\verlaufsprotokoll.txt 2014-04-26 23:00 - 2014-04-26 23:00 - 00599578 _____ () C:\Users\Lena\Documents\log.xml 2014-04-26 22:41 - 2014-04-26 22:41 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-26 22:41 - 2014-04-26 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-26 22:41 - 2014-04-26 22:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-26 22:41 - 2014-04-26 22:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-26 22:41 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-26 22:41 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-26 22:41 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-26 22:40 - 2014-04-26 22:40 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Lena\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-26 22:26 - 2014-04-26 22:26 - 02947139 _____ () C:\Users\Lena\Downloads\O15CTRRemove(1).diagcab 2014-04-26 21:46 - 2014-04-26 21:46 - 00000000 __RHD () C:\MSOCache 2014-04-26 21:40 - 2014-04-26 21:40 - 02947139 _____ () C:\Users\Lena\Downloads\O15CTRRemove.diagcab 2014-04-26 17:47 - 2014-04-26 17:47 - 00001954 _____ () C:\Users\Public\Desktop\DAEMON Tools Lite.lnk 2014-04-26 17:46 - 2014-04-26 17:47 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\DAEMON Tools Lite 2014-04-26 17:46 - 2014-04-26 17:46 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys 2014-04-26 17:46 - 2014-04-26 17:46 - 00000000 ____D () C:\Users\Lena\AppData\Local\SearchProtect 2014-04-26 17:46 - 2014-04-26 17:46 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-04-26 17:46 - 2014-04-26 17:46 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite 2014-04-26 17:45 - 2014-04-26 17:48 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite 2014-04-26 17:44 - 2014-04-26 17:44 - 13429504 _____ (Disc Soft Ltd) C:\Users\Lena\Downloads\DTLite4491-0356.exe 2014-04-24 20:30 - 2014-04-24 20:30 - 00001252 _____ () C:\Users\Lena\Desktop\WinISO.lnk 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\WinISO Computing 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinISO 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Users\Lena\AppData\Local\WinISO Computing 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Program Files (x86)\WinISO Computing 2014-04-24 20:30 - 2014-02-26 12:09 - 00204032 _____ (WinISO.com) C:\Windows\system32\Drivers\WinisoCDBus.sys 2014-04-24 20:29 - 2014-04-24 20:30 - 07043816 _____ (WinISO Computing Inc.) C:\Users\Lena\Downloads\winiso.exe 2014-04-24 17:57 - 2014-04-24 17:57 - 00000000 ____D () C:\Users\Lena\Documents\Ashampoo Burning Studio FREE 2014-04-24 17:55 - 2014-04-24 17:55 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Ashampoo 2014-04-24 17:55 - 2014-04-24 17:55 - 00000000 ____D () C:\Users\Lena\AppData\Local\ashampoo 2014-04-24 17:55 - 2014-04-24 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo 2014-04-24 17:54 - 2014-04-24 17:55 - 00000000 ____D () C:\ProgramData\Ashampoo 2014-04-24 17:54 - 2014-04-24 17:54 - 00000000 ____D () C:\Program Files (x86)\Ashampoo 2014-04-24 17:52 - 2014-04-24 17:53 - 33649640 _____ (Ashampoo GmbH & Co. KG ) C:\Users\Lena\Downloads\ashampoo_burning_studio_free_1.14.5_sm.exe 2014-04-24 17:51 - 2014-04-24 17:51 - 00386904 _____ (Softonic ) C:\Users\Lena\Downloads\SoftonicDownloader_fuer_infrarecorder.exe 2014-04-24 17:50 - 2014-04-24 17:50 - 00386904 _____ (Softonic ) C:\Users\Lena\Downloads\SoftonicDownloader_fuer_burnaware-free(1).exe 2014-04-24 17:43 - 2014-04-24 17:44 - 00386904 _____ (Softonic ) C:\Users\Lena\Downloads\SoftonicDownloader_fuer_burnaware-free.exe 2014-04-24 17:36 - 2014-04-24 17:36 - 00002444 _____ () C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2014-04-24 17:36 - 2014-04-24 17:36 - 00000000 ____D () C:\Users\Lena\AppData\Local\Smartbar 2014-04-24 17:36 - 2014-04-24 17:36 - 00000000 ____D () C:\Users\Lena\AppData\Local\LPT 2014-04-24 17:34 - 2014-04-24 17:35 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-04-24 17:34 - 2014-04-24 17:34 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-04-24 17:34 - 2014-04-24 17:34 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\TuneUp Software 2014-04-24 17:34 - 2014-04-24 17:34 - 00000000 ____D () C:\Users\Lena\AppData\Local\TuneUp Software 2014-04-24 17:33 - 2014-04-26 17:46 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\OpenCandy 2014-04-24 17:33 - 2014-04-24 17:37 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Nero 2014-04-24 17:25 - 2014-04-24 17:47 - 00000000 ____D () C:\ProgramData\Nero 2014-04-24 17:14 - 2014-04-24 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\Lena\Downloads\Nero 2014 - CHIP-Downloader.exe 2014-04-24 15:30 - 2014-04-24 15:41 - 00000000 ____D () C:\Users\Lena\Downloads\office2013-prof-plus-32bit-de-RZUWb 2014-04-24 15:14 - 2014-04-24 15:29 - 662454996 _____ () C:\Users\Lena\Downloads\office2013-prof-plus-32bit-de-RZUWb.zip 2014-04-24 15:13 - 2014-04-24 15:13 - 00010056 _____ () C:\Users\Lena\Downloads\free_download_sw.htm 2014-04-13 22:30 - 2014-04-13 22:30 - 00000000 ____D () C:\Users\Lena\Documents\Benutzerdefinierte Office-Vorlagen 2014-04-13 22:06 - 2014-04-13 22:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 15 2014-04-13 22:04 - 2014-04-13 22:04 - 00966336 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X86.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_(2).exe 2014-04-13 21:53 - 2014-04-13 21:53 - 01319104 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X64.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_.exe 2014-04-13 21:51 - 2014-04-13 21:51 - 00966336 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X86.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_(1).exe 2014-04-13 21:00 - 2014-04-13 21:00 - 00966336 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X86.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_.exe 2014-03-31 11:56 - 2014-04-26 23:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2014-04-26 23:58 - 2014-04-26 23:57 - 00023505 _____ () C:\Users\Lena\Desktop\FRST.txt 2014-04-26 23:57 - 2014-04-26 23:57 - 00000000 ____D () C:\FRST 2014-04-26 23:56 - 2014-04-26 23:56 - 02061824 _____ (Farbar) C:\Users\Lena\Desktop\FRST64.exe 2014-04-26 23:56 - 2011-12-01 13:36 - 01833461 _____ () C:\Windows\WindowsUpdate.log 2014-04-26 23:54 - 2012-10-14 00:49 - 00000000 ___RD () C:\Users\Lena\Dropbox 2014-04-26 23:54 - 2012-10-14 00:48 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Dropbox 2014-04-26 23:54 - 2011-12-01 13:50 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Skype 2014-04-26 23:54 - 2009-07-14 06:45 - 00492392 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-04-26 23:52 - 2012-12-21 17:58 - 00098871 _____ () C:\Windows\setupact.log 2014-04-26 23:52 - 2012-06-03 23:59 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-26 23:52 - 2011-08-08 05:50 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-04-26 23:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-26 23:51 - 2013-01-29 12:39 - 00055186 _____ () C:\Windows\PFRO.log 2014-04-26 23:30 - 2011-12-01 13:36 - 00129544 _____ () C:\Users\Lena\AppData\Local\GDIPFONTCACHEV1.DAT 2014-04-26 23:15 - 2012-06-03 23:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-26 23:15 - 2012-05-04 09:02 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-26 23:15 - 2011-12-03 23:29 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-04-26 23:15 - 2011-07-13 04:58 - 00000000 ____D () C:\Windows\ShellNew 2014-04-26 23:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-04-26 23:14 - 2014-03-31 11:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-04-26 23:14 - 2009-07-14 04:34 - 00000387 _____ () C:\Windows\win.ini 2014-04-26 23:12 - 2009-07-14 06:45 - 00020928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-26 23:12 - 2009-07-14 06:45 - 00020928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-26 23:01 - 2014-04-26 23:01 - 00212564 _____ () C:\Users\Lena\Documents\verlaufsprotokoll.txt 2014-04-26 23:00 - 2014-04-26 23:00 - 00599578 _____ () C:\Users\Lena\Documents\log.xml 2014-04-26 22:41 - 2014-04-26 22:41 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-26 22:41 - 2014-04-26 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-04-26 22:41 - 2014-04-26 22:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-26 22:41 - 2014-04-26 22:41 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-04-26 22:40 - 2014-04-26 22:40 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Lena\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-26 22:26 - 2014-04-26 22:26 - 02947139 _____ () C:\Users\Lena\Downloads\O15CTRRemove(1).diagcab 2014-04-26 22:04 - 2012-03-30 16:24 - 00000000 ____D () C:\Users\Lena\AppData\Local\CrashDumps 2014-04-26 21:46 - 2014-04-26 21:46 - 00000000 __RHD () C:\MSOCache 2014-04-26 21:40 - 2014-04-26 21:40 - 02947139 _____ () C:\Users\Lena\Downloads\O15CTRRemove.diagcab 2014-04-26 18:45 - 2012-02-13 17:23 - 00248144 _____ () C:\test.xml 2014-04-26 17:48 - 2014-04-26 17:45 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite 2014-04-26 17:47 - 2014-04-26 17:47 - 00001954 _____ () C:\Users\Public\Desktop\DAEMON Tools Lite.lnk 2014-04-26 17:47 - 2014-04-26 17:46 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\DAEMON Tools Lite 2014-04-26 17:46 - 2014-04-26 17:46 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys 2014-04-26 17:46 - 2014-04-26 17:46 - 00000000 ____D () C:\Users\Lena\AppData\Local\SearchProtect 2014-04-26 17:46 - 2014-04-26 17:46 - 00000000 ____D () C:\Program Files (x86)\SearchProtect 2014-04-26 17:46 - 2014-04-26 17:46 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite 2014-04-26 17:46 - 2014-04-24 17:33 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\OpenCandy 2014-04-26 17:44 - 2014-04-26 17:44 - 13429504 _____ (Disc Soft Ltd) C:\Users\Lena\Downloads\DTLite4491-0356.exe 2014-04-26 08:22 - 2011-12-01 13:38 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{F5E40832-3334-40DB-9F43-758FD6532A4F} 2014-04-24 20:30 - 2014-04-24 20:30 - 00001252 _____ () C:\Users\Lena\Desktop\WinISO.lnk 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\WinISO Computing 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinISO 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Users\Lena\AppData\Local\WinISO Computing 2014-04-24 20:30 - 2014-04-24 20:30 - 00000000 ____D () C:\Program Files (x86)\WinISO Computing 2014-04-24 20:30 - 2014-04-24 20:29 - 07043816 _____ (WinISO Computing Inc.) C:\Users\Lena\Downloads\winiso.exe 2014-04-24 17:57 - 2014-04-24 17:57 - 00000000 ____D () C:\Users\Lena\Documents\Ashampoo Burning Studio FREE 2014-04-24 17:55 - 2014-04-24 17:55 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Ashampoo 2014-04-24 17:55 - 2014-04-24 17:55 - 00000000 ____D () C:\Users\Lena\AppData\Local\ashampoo 2014-04-24 17:55 - 2014-04-24 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo 2014-04-24 17:55 - 2014-04-24 17:54 - 00000000 ____D () C:\ProgramData\Ashampoo 2014-04-24 17:54 - 2014-04-24 17:54 - 00000000 ____D () C:\Program Files (x86)\Ashampoo 2014-04-24 17:53 - 2014-04-24 17:52 - 33649640 _____ (Ashampoo GmbH & Co. KG ) C:\Users\Lena\Downloads\ashampoo_burning_studio_free_1.14.5_sm.exe 2014-04-24 17:51 - 2014-04-24 17:51 - 00386904 _____ (Softonic ) C:\Users\Lena\Downloads\SoftonicDownloader_fuer_infrarecorder.exe 2014-04-24 17:50 - 2014-04-24 17:50 - 00386904 _____ (Softonic ) C:\Users\Lena\Downloads\SoftonicDownloader_fuer_burnaware-free(1).exe 2014-04-24 17:47 - 2014-04-24 17:25 - 00000000 ____D () C:\ProgramData\Nero 2014-04-24 17:44 - 2014-04-24 17:43 - 00386904 _____ (Softonic ) C:\Users\Lena\Downloads\SoftonicDownloader_fuer_burnaware-free.exe 2014-04-24 17:37 - 2014-04-24 17:33 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\Nero 2014-04-24 17:36 - 2014-04-24 17:36 - 00002444 _____ () C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk 2014-04-24 17:36 - 2014-04-24 17:36 - 00000000 ____D () C:\Users\Lena\AppData\Local\Smartbar 2014-04-24 17:36 - 2014-04-24 17:36 - 00000000 ____D () C:\Users\Lena\AppData\Local\LPT 2014-04-24 17:35 - 2014-04-24 17:34 - 00000000 ____D () C:\ProgramData\TuneUp Software 2014-04-24 17:34 - 2014-04-24 17:34 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-04-24 17:34 - 2014-04-24 17:34 - 00000000 ____D () C:\Users\Lena\AppData\Roaming\TuneUp Software 2014-04-24 17:34 - 2014-04-24 17:34 - 00000000 ____D () C:\Users\Lena\AppData\Local\TuneUp Software 2014-04-24 17:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Cursors 2014-04-24 17:14 - 2014-04-24 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\Lena\Downloads\Nero 2014 - CHIP-Downloader.exe 2014-04-24 15:41 - 2014-04-24 15:30 - 00000000 ____D () C:\Users\Lena\Downloads\office2013-prof-plus-32bit-de-RZUWb 2014-04-24 15:29 - 2014-04-24 15:14 - 662454996 _____ () C:\Users\Lena\Downloads\office2013-prof-plus-32bit-de-RZUWb.zip 2014-04-24 15:13 - 2014-04-24 15:13 - 00010056 _____ () C:\Users\Lena\Downloads\free_download_sw.htm 2014-04-14 19:46 - 2011-12-03 13:19 - 00000000 ____D () C:\Users\Lena\Documents\Studium 2014-04-13 22:30 - 2014-04-13 22:30 - 00000000 ____D () C:\Users\Lena\Documents\Benutzerdefinierte Office-Vorlagen 2014-04-13 22:06 - 2014-04-13 22:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 15 2014-04-13 22:04 - 2014-04-13 22:04 - 00966336 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X86.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_(2).exe 2014-04-13 21:53 - 2014-04-13 21:53 - 01319104 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X64.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_.exe 2014-04-13 21:51 - 2014-04-13 21:51 - 00966336 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X86.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_(1).exe 2014-04-13 21:21 - 2011-12-01 13:37 - 00000000 ____D () C:\Users\Lena\AppData\Local\VirtualStore 2014-04-13 21:16 - 2012-06-03 23:59 - 00000000 ____D () C:\Program Files (x86)\Google 2014-04-13 21:11 - 2009-07-14 07:32 - 00000000 ____D () C:\Program Files (x86)\MSBuild 2014-04-13 21:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\System 2014-04-13 21:00 - 2014-04-13 21:00 - 00966336 _____ (Microsoft Corporation) C:\Users\Lena\Downloads\Setup.X86.de-de_O365ProPlusRetail_97e7ffce-f364-470c-80e0-63a7470dda8c_TX_PR_.exe 2014-04-13 20:56 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-04-08 10:32 - 2012-08-17 14:55 - 00000000 ____D () C:\Users\Lena\Documents\Arbeit 2014-04-03 09:51 - 2014-04-26 22:41 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-26 22:41 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-26 22:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-01 06:37 - 2012-05-04 16:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-27 10:10 - 2012-06-03 23:59 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-27 10:10 - 2012-06-03 23:59 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore ZeroAccess: C:\Windows\Installer\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56} C:\Windows\Installer\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56}\@ ZeroAccess: C:\Users\Lena\AppData\Local\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56} C:\Users\Lena\AppData\Local\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56}\@ Some content of TEMP: ==================== C:\Users\Gast\AppData\Local\Temp\AskSLib.dll C:\Users\Lena\AppData\Local\Temp\avgnt.exe C:\Users\Lena\AppData\Local\Temp\ose00000.exe C:\Users\Lena\AppData\Local\Temp\ose00001.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-31 23:43 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-04-2014 03 Ran by Lena at 2014-04-26 23:58:59 Running from C:\Users\Lena\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== ==================== Installed Programs ====================== ActiveX контрола на Windows Live Mesh за отдалечени връзки (HKLM-x32\...\{B3BA4D1C-23EF-4859-9C11-1B2CCB7FADBB}) (Version: 15.4.5722.2 - Microsoft Corporation) ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (HKLM-x32\...\{376D59B1-42D9-4FA2-B6CC-E346B6BE14F5}) (Version: 15.4.5722.2 - Microsoft Corporation) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.) Adobe AIR (x32 Version: 2.5.1.17730 - Adobe Systems Inc.) Hidden Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated) ALDI Bestellsoftware 4.12.2 (HKLM-x32\...\ALDI Bestellsoftware) (Version: 4.12.2 - ORWO Net) Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - ALPS ELECTRIC CO., LTD.) Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{61438020-DDD4-42FA-99A2-50225441980A}) (Version: 2.0.1.142 - ArcSoft) ArcSoft WebCam Companion 4 (HKLM-x32\...\{C793AD32-2BB8-4CC4-ABD3-A1469C21593C}) (Version: 4.0.21.392 - ArcSoft) Ashampoo Burning Studio FREE v.1.14.5 (HKLM-x32\...\{91B33C97-91F8-FFB3-581B-BC952C901685}_is1) (Version: 1.14.5 - Ashampoo GmbH & Co. KG) Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira) Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4487 - APN, LLC) Battlefield Play4Free (HKLM-x32\...\{87686C21-8A15-4b4d-A3F1-11141D9BE094}) (Version: - EA Digital illusions) Bing Bar (HKLM-x32\...\{B4089055-D468-45A4-A6BA-5A138DD715FC}) (Version: 7.0.850.0 - Microsoft Corporation) Bing Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.174.0 - Microsoft Corporation) Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.3.0.100 - Atheros Communications) Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Cambridge English Pronouncing Dictionary - 17th Edition (HKLM-x32\...\cepd17) (Version: - ) Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: - ) Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - Canon Inc.) Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.) Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.) Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.) Canon MG3200 series Benutzerregistrierung (HKLM-x32\...\Canon MG3200 series Benutzerregistrierung) (Version: - Canon Inc.) Canon MG3200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3200_series) (Version: 1.01 - Canon Inc.) Canon MG3200 series On-screen Manual (HKLM-x32\...\Canon MG3200 series On-screen Manual) (Version: 7.5.0 - Canon Inc.) Canon MG3500 series Benutzerregistrierung (HKLM-x32\...\Canon MG3500 series Benutzerregistrierung) (Version: - *Canon Inc.) Canon MG3500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3500_series) (Version: 1.00 - Canon Inc.) Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 1.0.0 - Canon Inc.) Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 1.0.0 - Canon Inc.) Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.) Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.2.0 - Canon Inc.) CCleaner (HKLM\...\CCleaner) (Version: 3.18 - Piriform) Citavi (HKLM-x32\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.4.0.2 - Swiss Academic Software) Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.0.53 - Conexant) Control ActiveX Windows Live Mesh pentru conexiuni la distanță (HKLM-x32\...\{260E3D78-94E6-47EC-8E29-46301572BB1E}) (Version: 15.4.5722.2 - Microsoft Corporation) Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation) Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd) Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.) Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (HKLM-x32\...\{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}) (Version: 15.4.5722.2 - Microsoft Corporation) Free YouTube Download version 3.0.19.1206 (HKLM-x32\...\Free YouTube Download_is1) (Version: - DVDVideoSoft Ltd.) Free YouTube to MP3 Converter version 3.11.34.1015 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.34.1015 - DVDVideoSoft Ltd.) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden GeoGebra 4.2 (HKLM-x32\...\GeoGebra 4.2) (Version: 4.2.60.0 - International GeoGebra Institute) GEONExT 1.74 (HKLM-x32\...\GEONExT_is1) (Version: 1.74 - GEONExT Group) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden HDD Password Tool (HKLM-x32\...\{97CA1EE3-9477-4C3C-BFCF-89A84B6A222E}) (Version: 1.00.0820 - TOSHIBA CORPORATION.) HotPotatoes v 6.3.0.5 (HKLM-x32\...\hotpot_is1) (Version: - HalfBaked) Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.0.0.1046 - Intel Corporation) iTunes (HKLM\...\{F73A118B-8271-47E2-8790-0C636B2539C5}) (Version: 11.1.0.126 - Apple Inc.) Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.450 - Oracle) Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 22 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416022FF}) (Version: 6.0.220 - Oracle) Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.10411.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.3.3 - Notepad++ Team) NVIDIA 3D Vision Treiber 267.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 267.21 - NVIDIA Corporation) NVIDIA Grafiktreiber 267.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 267.21 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.2.19.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.19.0 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6721 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 267.21 (Version: 267.21 - NVIDIA Corporation) Hidden Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená připojení (HKLM-x32\...\{B6190387-0036-4BEB-8D74-A0AFC5F14706}) (Version: 15.4.5722.2 - Microsoft Corporation) Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (HKLM-x32\...\{C2FD7DB5-FE30-49B6-8A2F-C5652E053C31}) (Version: 15.4.5722.2 - Microsoft Corporation) PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.5.02.12220 - Sony Corporation) PMB VAIO Edition Guide (x32 Version: 1.6.00.06030 - Sony Corporation) Hidden PMB VAIO Edition Plug-in (Version: 1.5.10.05300 - Sony Corporation) Hidden PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06010 - Sony Corporation) Hidden PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06140 - Sony Corporation) Hidden Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden QUICKfind (HKLM-x32\...\{593AFFA4-D08E-4272-BABB-420949D32A10}) (Version: - ) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.) Remote Keyboard (x32 Version: 1.1.1.03020 - Sony Corporation) Hidden Remote Play with PlayStation 3 (x32 Version: 1.1.0.15070 - Sony Corporation) Hidden Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.12.20.154 - Conduit) <==== ATTENTION Secure Download Manager (HKLM-x32\...\{47CED407-95BF-4EF5-AD14-89F979480E1A}) (Version: 3.0.2 - e-academy Inc.) Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.) Snap.Do (HKLM-x32\...\{D08D2971-64C8-43FA-B251-E0BBBE9E87E3}) (Version: 11.42.1.16270 - ReSoft Ltd.) <==== ATTENTION Sony Corporation (Version: 1.0.0 - Default Company Name) Hidden Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.1.19 - Safer-Networking Ltd.) SSLx64 (Version: 1.0.0 - Sony Corporation ) Hidden SSLx86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation) Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi (HKLM-x32\...\{241E7104-937A-4366-AD57-8FDDDB003939}) (Version: 15.4.5722.2 - Microsoft Corporation) VAIO - PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{66081CDD-C1FE-415F-BB3A-F2622BA27461}) (Version: 1.6.00.06030 - Sony Corporation) VAIO - PMB VAIO Edition Plug-in (HKLM-x32\...\InstallShield_{270380EB-8812-42E1-8289-53700DB840D2}) (Version: 1.6.00.06140 - Sony Corporation) VAIO - Remote Play mit PlayStation®3 (HKLM-x32\...\{07441A52-E208-478A-92B7-5C337CA8C131}) (Version: 1.1.0.15070 - Sony Corporation) VAIO - Remote-Tastatur (HKLM-x32\...\{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}) (Version: 1.0.1.03020 - Sony Corporation) VAIO Care (HKLM-x32\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 6.4.0.15030 - Sony Corporation) VAIO Care (x32 Version: 6.4.0.15030 - Sony Corporation) Hidden VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.5.0.03040 - Sony Corporation) VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.6.0.13140 - Sony Corporation) VAIO Data Restore Tool (x32 Version: 1.6.0.13140 - Sony Corporation) Hidden VAIO Easy Connect (HKLM-x32\...\{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}) (Version: 1.0.0.03050 - Sony Corporation) VAIO Event Service (HKLM-x32\...\{73D8886A-D416-4687-B609-0D3836BA410C}) (Version: 5.5.0.03040 - Sony Corporation) VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 2.3.0.11090 - Sony Corporation) VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 2.4.0.03240 - Sony Corporation) VAIO Hardware Diagnostics (x32 Version: 4.2.0.14280 - Sony Corporation) Hidden VAIO Hero Screensaver - Summer 2011 Screensaver (HKLM-x32\...\VAIO Hero Screensaver - Summer 2011 Screensaver) (Version: - ) VAIO Improvement (HKLM-x32\...\{3A26D9BD-0F73-432D-B522-2BA18138F7EF}) (Version: 1.0.0.14150 - Sony Corporation) VAIO Improvement Validation (HKLM\...\{75C95C84-264F-4CC7-8A7E-346444E6C7C1}) (Version: 1.0.4.01190 - Sony Corporation) VAIO Quick Web Access (HKLM-x32\...\splashtop) (Version: 1.4.5.3 - Sony Corporation) VAIO Quick Web Access (x32 Version: 1.4.5.3 - Sony Corporation) Hidden VAIO Sample Contents (HKLM-x32\...\{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}) (Version: 1.4.2.09010 - Sony Corporation) VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.5.0.02280 - Sony Corporation) VAIO Update (HKLM-x32\...\{5BEE8F1F-BD32-4553-8107-500439E43BD7}) (Version: 5.4.0.15300 - Sony Corporation) VAIO-Handbuch (HKLM-x32\...\{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}) (Version: 2.0.0.02250 - Sony Corporation) VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.4.0.14230 - Sony Corporation) VCCx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden VESx64 (Version: 1.0.0 - Sony Corporation) Hidden VESx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden VIx64 (Version: 1.0.0 - Sony Corporation) Hidden VIx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden VSNx64 (Version: 1.0.0 - Sony Corporation) Hidden VWSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Корпорація Майкрософт) Hidden Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (HKLM-x32\...\{09B7C7EB-3140-4B5E-842F-9C79A7137139}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX-objekt til fjernforbindelser (HKLM-x32\...\{57220148-3B2B-412A-A2E0-82B9DF423696}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (HKLM-x32\...\{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Meshin etäyhteyksien ActiveX-komponentti (HKLM-x32\...\{4CF6F287-5121-483C-A5A2-07BDE19D8B4E}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорація Майкрософт) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden WinISO (HKLM-x32\...\WinISO) (Version: 6.4.0.5170 - WinISO Computing Inc.) Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM-x32\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Елемент керування Windows Live Mesh ActiveX для віддалених підключень (HKLM-x32\...\{6756D5CA-3E31-4308-9BF0-79DFD1AF196E}) (Version: 15.4.5722.2 - Microsoft Corporation) Основи Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Фотоколекція Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Элемент управления Windows Live Mesh ActiveX для удаленных подключений (HKLM-x32\...\{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}) (Version: 15.4.5722.2 - Microsoft Corporation) ==================== Restore Points ========================= Could not list Restore Points. Check "winmgmt" service or repair WMI. ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {1414D482-1CAC-41E4-949C-182C2E30BFA1} - System32\Tasks\{00906BCA-FAE0-4F88-AECA-EEA75DC69419} => Firefox.exe Task: {28E4527C-1710-404E-8FA8-D5D5D9FAC471} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated) Task: {2EE7C66A-7782-4511-8287-C53F8BB67AF6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03] (Google Inc.) Task: {398C2296-55F8-47CF-9518-7482685BC52F} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-11-16] (Sony Corporation) Task: {3DCCF04C-DF4E-4C31-8EE5-678F22811BCE} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2584018587-2600382852-1638487148-1001 Task: {696A6324-2441-4B15-BFDD-1A452E2F5551} - System32\Tasks\Sony Corporation\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient Task: {70804D32-3257-488A-95B0-1EABC80DF1CF} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {7614E6F6-FDDB-45F1-9BC4-50B24E717CEA} - System32\Tasks\Sony Corporation\VAIO Improvement Validation\VAIO Improvement Validation => C:\Program Files\Sony\VAIO Improvement Validation\viv.exe [2011-01-20] (Sony Corporation) Task: {7A8B6C87-68E4-4A7C-998F-9EDBE9B5FAD9} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2011-02-16] (Sony Corporation) Task: {91E6593D-5A0D-4CCB-B258-E405C5334726} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2011-03-30] (Sony Corporation) Task: {939625EF-BBF1-4868-98FF-9EF17A4F60DC} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2011-02-15] (Sony Corporation) Task: {A287311A-BA85-42DA-A358-CB9BC9F6557A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {AA031AFF-A2A3-4C4A-9352-4DF21675B572} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {B49E9995-72E2-4494-9E00-050C60E3BE64} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe Task: {B9CE3BFF-60AA-4864-B8CC-3DCC7617BB73} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-11-16] (Sony Corporation) Task: {C2353867-8BDC-4400-AC5C-F437D6A1D056} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03] (Google Inc.) Task: {E5ACFD57-43B8-4BBC-A31E-3E6F47BA3087} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {FB5D8298-85B2-4DB2-B6FD-E45A161CFB20} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2011-02-16] (Sony Corporation) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2013-10-30 19:07 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE 2013-08-06 08:38 - 2013-08-05 14:47 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll 2011-09-27 08:23 - 2011-09-27 08:23 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2011-09-27 08:22 - 2011-09-27 08:22 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2013-07-20 20:25 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2013-07-20 20:25 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2013-07-20 20:25 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2013-07-20 20:25 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2013-07-20 20:25 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2011-08-08 05:57 - 2011-03-05 16:42 - 00013824 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00046624 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00069152 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\srau.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00165408 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 02283040 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00066592 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\spbl.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00154656 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00014368 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\siem.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00063520 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\sppsm.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00696864 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00014880 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00078880 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00027168 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll 2014-03-30 08:56 - 2014-03-30 08:56 - 00056352 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\srut.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00029216 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\srsbs.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00065568 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00030752 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\srom.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00030752 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\smtu.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00038944 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\smta.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00043552 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\srbu.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00024096 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\sgml.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00061472 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00024608 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\srpdm.dll 2014-03-30 08:54 - 2014-03-30 08:54 - 00043040 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\MACTrackBarLib.dll 2014-03-30 08:53 - 2014-03-30 08:53 - 00026656 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00035360 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00193056 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\sgmu.dll 2014-03-30 08:52 - 2014-03-30 08:52 - 00061440 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\AxInterop.WMPLib.dll 2014-03-30 08:55 - 2014-03-30 08:55 - 00255008 _____ () C:\Users\Lena\AppData\Local\Smartbar\Application\srns.dll 2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\Lena\AppData\Roaming\Dropbox\bin\libcef.dll 2014-03-31 11:56 - 2014-03-31 11:56 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2011-02-18 11:18 - 2011-02-18 11:18 - 00235112 _____ () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll 2013-01-18 13:39 - 2013-01-18 13:39 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9a6476e0725c79a5e8787d0d2f83c458\IsdiInterop.ni.dll 2011-08-08 05:42 - 2010-09-13 18:28 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" ==================== Faulty Device Manager Devices ============= Could not list Devices. Check "winmgmt" service or repair WMI. ==================== Event log errors: ========================= Application errors: ================== Error: (04/26/2014 11:52:45 PM) (Source: WinMgmt) (User: ) Description: 0x8007007e Error: (04/26/2014 11:15:22 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) Description: Fehler beim Beenden einer Windows Installer-Transaktion: PROPLUS. Fehler 1603 beim Beenden der Transaktion. Error: (04/26/2014 11:04:17 PM) (Source: WinMgmt) (User: ) Description: 0x8007007e Error: (04/26/2014 10:13:47 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) Description: Fehler beim Beenden einer Windows Installer-Transaktion: PROPLUS. Fehler 1603 beim Beenden der Transaktion. Error: (04/26/2014 10:04:01 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 28.0.0.5186, Zeitstempel: 0x53240e37 Name des fehlerhaften Moduls: xul.dll, Version: 28.0.0.5186, Zeitstempel: 0x53240e04 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00184729 ID des fehlerhaften Prozesses: 0x17fc Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0 Pfad der fehlerhaften Anwendung: firefox.exe1 Pfad des fehlerhaften Moduls: firefox.exe2 Berichtskennung: firefox.exe3 Error: (04/26/2014 09:55:34 PM) (Source: MsiInstaller) (User: NT-AUTORITÄT) Description: Fehler beim Beenden einer Windows Installer-Transaktion: PROPLUS. Fehler 1603 beim Beenden der Transaktion. Error: (04/26/2014 07:12:03 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 12090 Error: (04/26/2014 07:12:03 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 12090 Error: (04/26/2014 07:12:03 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (04/26/2014 07:12:02 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 11076 System errors: ============= Error: (04/26/2014 11:54:30 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2147024891 Error: (04/26/2014 11:54:30 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: %%-2147024891 Error: (04/26/2014 11:52:45 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist von folgendem Dienst abhängig: wscsvc. Dieser Dienst ist eventuell nicht installiert. Error: (04/26/2014 11:52:44 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet: %%-2147024891 Error: (04/26/2014 11:52:44 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert. Error: (04/26/2014 11:52:44 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert. Error: (04/26/2014 11:52:44 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060 Error: (04/26/2014 11:52:40 PM) (Source: BTHUSB) (User: ) Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen. Error: (04/26/2014 11:06:50 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Search Protect by Conduit Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1450 Error: (04/26/2014 11:05:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%-2147024891 Microsoft Office Sessions: ========================= Error: (04/26/2014 11:52:45 PM) (Source: WinMgmt)(User: ) Description: 0x8007007e Error: (04/26/2014 11:15:22 PM) (Source: MsiInstaller)(User: NT-AUTORITÄT) Description: PROPLUS1603(NULL)(NULL)(NULL)(NULL) Error: (04/26/2014 11:04:17 PM) (Source: WinMgmt)(User: ) Description: 0x8007007e Error: (04/26/2014 10:13:47 PM) (Source: MsiInstaller)(User: NT-AUTORITÄT) Description: PROPLUS1603(NULL)(NULL)(NULL)(NULL) Error: (04/26/2014 10:04:01 PM) (Source: Application Error)(User: ) Description: firefox.exe28.0.0.518653240e37xul.dll28.0.0.518653240e04c00000050018472917fc01cf616906b738feC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dlle8a95c4e-cd7d-11e3-97b2-78843cf2681d Error: (04/26/2014 09:55:34 PM) (Source: MsiInstaller)(User: NT-AUTORITÄT) Description: PROPLUS1603(NULL)(NULL)(NULL)(NULL) Error: (04/26/2014 07:12:03 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 12090 Error: (04/26/2014 07:12:03 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 12090 Error: (04/26/2014 07:12:03 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (04/26/2014 07:12:02 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 11076 ==================== Memory info =========================== Percentage of memory in use: 45% Total physical RAM: 4077.86 MB Available physical RAM: 2209.95 MB Total Pagefile: 8153.91 MB Available Pagefile: 5948.5 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:451.77 GB) (Free:359.79 GB) NTFS Drive e: (Office2013 Pro Pl. DE x32 RZUWb) (CDROM) (Total:0.71 GB) (Free:0 GB) UDF ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 68A796D5) Partition 1: (Not Active) - (Size=14 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=452 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Danke!! |
26.04.2014, 23:17 | #4 |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Ach...je später die User, desto schöner die Logs Hast Du gut gemacht. Bitte keine Veränderungen am Pc vornehmen. Melde mich morgen wieder. Muss ins Bett. Um 4:30h klingelt der Wecker zur Arbeit...
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
26.04.2014, 23:21 | #5 |
| Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Das liegt wohl an der Verzweiflung, die sich bei mir in den letzten Stunden angesammelt hat^^ ok, alles klar. Dann freue ich mich auf morgen^^ gute nacht |
27.04.2014, 11:13 | #6 | |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424Zitat:
Kannst Du mir noch bitte das MBAM-Log posten? Danke Lesestoff MBAM-Funde posten: So gehts... Manchmal ist es wichtig zu wissen, welche Schadprogramme im Vorfeld ohne Anweisung der Helfer schon gelöscht wurden. Daher benötige ich den Inhalt der Logdatei, in welcher der Suchlauf protokolliert wurde.
__________________ --> Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 |
27.04.2014, 18:42 | #7 |
| Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Ok, ich hoffe die Datei im Anhang ist die Richtige |
27.04.2014, 18:46 | #8 |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424Ja, prima! Melde mich wieder mit weiteren Anweisungen...
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
27.04.2014, 18:52 | #9 |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Hi, so gehts weiter: Schritt 1 Bitte deinstalliere folgende Programme: Snap.Do Search Protect Java 6 Update 22 (das 32bit und 64bit) Versuche es bei Windows 7 zunächst über Systemsteuerung/Programme deinstallieren bzw. bei Windows 8 mit der Windowstaste + X über Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhier herunter, entpacke die zip-Datei auf den Desktop und starte die Revouninstaller.exe. Klicke auf Optionen und wähle als Sprache Deutsch. Suche dann im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus. Klicke jedesmal auf Uninstall. Wähle anschließend den Modus "Moderat" aus. Solltest Du ein Programm nicht finden oder nicht deinstallieren können, mache bitte mit dem nächsten Schritt weiter: Schritt 2 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 3 Scan mit Combofix
Bitte poste mir den Inhalt der Logdateien von Adwarecleaner und Combofix.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer Geändert von deeprybka (27.04.2014 um 18:58 Uhr) |
27.04.2014, 19:10 | #10 |
| Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.204 - Bericht erstellt am 27/04/2014 um 20:07:03 # Aktualisiert 26/04/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Lena - LENA-VAIO # Gestartet von : C:\Users\Lena\Downloads\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\Users\Lena\AppData\Local\Smartbar Ordner Gelöscht : C:\Users\Lena\AppData\Local\Temp\Smartbar Ordner Gelöscht : C:\Users\Lena\AppData\Roaming\dvdvideosoftiehelpers Ordner Gelöscht : C:\Users\Lena\AppData\Roaming\OpenCandy Datei Gelöscht : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\7bmlgxjg.default\searchplugins\ask-search.xml Datei Gelöscht : C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\searchplugins\conduit-search.xml ***** [ Verknüpfungen ] ***** Verknüpfung Desinfiziert : C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_burnaware-free(1)_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_burnaware-free(1)_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_burnaware-free_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_burnaware-free_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_infrarecorder_RASAPI32 Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_infrarecorder_RASMANCS Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\SmartBar Schlüssel Gelöscht : HKCU\Software\Softonic Schlüssel Gelöscht : HKLM\Software\DeviceVM Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM ***** [ Browser ] ***** -\\ Internet Explorer v9.0.8112.16457 -\\ Mozilla Firefox v28.0 (de) [ Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\7bmlgxjg.default\prefs.js ] [ Datei : C:\Users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\prefs.js ] ************************* AdwCleaner[R0].txt - [4600 octets] - [27/04/2014 20:06:28] AdwCleaner[S0].txt - [4067 octets] - [27/04/2014 20:07:03] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4127 octets] ########## |
27.04.2014, 19:12 | #11 |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Jup, weiter mit Combofix!
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
27.04.2014, 19:33 | #12 |
| Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Combofix Logfile: Code:
ATTFilter ComboFix 14-04-26.01 - Lena 27/04/2014 20:16:00.1.4 - x64 Running from: c:\users\Lena\Downloads\ComboFix.exe * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Lena\4.0 c:\users\Lena\AppData\Local\assembly\tmp . . ((((((((((((((((((((((((( Files Created from 2014-03-27 to 2014-04-27 ))))))))))))))))))))))))))))))) . . 2014-04-27 18:06 . 2014-04-27 18:07 -------- d-----w- C:\AdwCleaner 2014-04-27 17:33 . 2014-04-27 17:33 -------- d-----w- c:\program files (x86)\7-Zip 2014-04-26 21:57 . 2014-04-26 21:59 -------- d-----w- C:\FRST 2014-04-26 20:41 . 2014-04-27 17:23 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-04-26 20:41 . 2014-04-26 20:41 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware 2014-04-26 20:41 . 2014-04-26 20:41 -------- d-----w- c:\programdata\Malwarebytes 2014-04-26 20:41 . 2014-04-03 07:51 63192 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-04-26 20:41 . 2014-04-03 07:51 88280 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-04-26 20:41 . 2014-04-03 07:50 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-04-26 19:46 . 2014-04-26 19:46 -------- d-----r- C:\MSOCache 2014-04-26 15:46 . 2014-04-26 15:46 283064 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys 2014-04-26 15:46 . 2014-04-26 15:47 -------- d-----w- c:\users\Lena\AppData\Roaming\DAEMON Tools Lite 2014-04-26 15:46 . 2014-04-26 15:46 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite 2014-04-26 15:45 . 2014-04-26 15:48 -------- d-----w- c:\programdata\DAEMON Tools Lite 2014-04-24 18:30 . 2014-04-24 18:30 -------- d-----w- c:\users\Lena\AppData\Roaming\WinISO Computing 2014-04-24 18:30 . 2014-04-24 18:30 -------- d-----w- c:\users\Lena\AppData\Local\WinISO Computing 2014-04-24 18:30 . 2014-02-26 10:09 204032 ----a-w- c:\windows\system32\drivers\WinisoCDBus.sys 2014-04-24 18:30 . 2014-04-24 18:30 -------- d-----w- c:\program files (x86)\WinISO Computing 2014-04-24 15:55 . 2014-04-24 15:55 -------- d-----w- c:\users\Lena\AppData\Roaming\Ashampoo 2014-04-24 15:55 . 2014-04-24 15:55 -------- d-----w- c:\users\Lena\AppData\Local\ashampoo 2014-04-24 15:54 . 2014-04-24 15:55 -------- d-----w- c:\programdata\Ashampoo 2014-04-24 15:54 . 2014-04-24 15:54 -------- d-----w- c:\program files (x86)\Ashampoo 2014-04-24 15:34 . 2014-04-24 15:34 -------- d-----w- c:\users\Lena\AppData\Roaming\TuneUp Software 2014-04-24 15:34 . 2014-04-24 15:34 -------- d-----w- c:\users\Lena\AppData\Local\TuneUp Software 2014-04-24 15:34 . 2014-04-24 15:35 -------- d-----w- c:\programdata\TuneUp Software 2014-04-24 15:34 . 2014-04-24 15:34 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2014-04-24 15:34 . 2014-04-24 15:34 -------- d--h--w- c:\programdata\Common Files 2014-04-24 15:33 . 2014-04-24 15:37 -------- d-----w- c:\users\Lena\AppData\Roaming\Nero 2014-04-24 15:25 . 2014-04-24 15:47 -------- d-----w- c:\programdata\Nero 2014-04-13 20:06 . 2014-04-13 20:06 -------- d-----w- c:\program files (x86)\Microsoft Office 15 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-03-12 16:15 . 2012-05-04 07:02 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-03-12 16:15 . 2012-01-21 18:06 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2003-03-21 12:45 . 2013-02-28 21:36 250544 ----a-w- c:\program files (x86)\Common Files\keyhelp.ocx . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Lena\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Lena\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Lena\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20922016] "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2014-03-04 3696912] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-09-13 283160] "ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-02-15 2757312] "PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720] "BingDesktop"="c:\program files (x86)\Microsoft\BingDesktop\BingDesktop.exe" [2013-06-27 2249352] "SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-09-17 152392] "CanonQuickMenu"="c:\program files (x86)\Canon\Quick Menu\CNQMMAIN.EXE" [2013-04-02 1282632] "IJNetworkScannerSelectorEX"="c:\program files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2013-02-19 453736] . c:\users\Lena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Lena\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HDD Password Tool.lnk - c:\program files (x86)\TOSHIBA\HDD Password Tool\TosExtCtrl.exe [2012-12-25 1750904] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="userinit.exe" . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys;c:\windows\SYSNATIVE\DRIVERS\acsock64.sys [x] R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x] R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x] R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x] R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x] R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x] R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x] R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x] R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x] R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x] R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x] R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x] R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x] R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe;c:\program files\Sony\VAIO Update 5\VUAgent.exe [x] R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 TosExt;Filter Driver; [x] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x] S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x] S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x] S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x] S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x] S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x] S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x] S2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x] S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x] S2 BingDesktopUpdate;Bing Desktop Update service;c:\program files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe;c:\program files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [x] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x] S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x] S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x] S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x] S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x] S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S2 TosExtSvc;TOSHIBA HDD Password Tool Service;c:\program files (x86)\TOSHIBA\HDD Password Tool\TosExtSvc.exe;c:\program files (x86)\TOSHIBA\HDD Password Tool\TosExtSvc.exe [x] S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x] S2 WinisoCDBus;WinISO Virtual CD Drive;c:\windows\system32\drivers\WinisoCDBus.sys;c:\windows\SYSNATIVE\drivers\WinisoCDBus.sys [x] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x] S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x] S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2014-04-27 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 16:15] . 2014-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 21:59] . 2014-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 21:59] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lena\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lena\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lena\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lena\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2011-03-29 518784] "AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-04-29 790688] "AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-04-29 657568] "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;<local> uSearchAssistant = hxxp://www.bing.com/search?q={searchTerms} IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000 IE: Free YouTube Download - c:\users\Lena\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm IE: Free YouTube to MP3 Converter - c:\users\Lena\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Lena\AppData\Roaming\Mozilla\Firefox\Profiles\x3ze5ktz.default-1349367259671\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - prefs.js: keyword.URL - hxxp://www.google.com/search?rls=org.mozilla:en-US:official&client=firefox-a&q= FF - prefs.js: network.proxy.http - 91.228.53.28 FF - prefs.js: network.proxy.http_port - 8080 FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . BHO-{41564952-412D-5637-00A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll Toolbar-{41564952-412D-5637-00A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll Wow6432Node-HKCU-Run-OfficeSyncProcess - c:\program files\Microsoft Office\Office14\MSOSYNC.EXE Wow6432Node-HKLM-Run-ApnTBMon - c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe Notify-SDWinLogon - SDWinLogon.dll BHO-{41564952-412D-5637-00A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll Toolbar-{41564952-412D-5637-00A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe AddRemove-{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{EDFF1086-6DA8-461D-AFC0-BEA0076A1B5F} - c:\program files (x86)\Common Files\Microsoft Shared\OFFICE15\Oarpmany.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\SampleCollector] "ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\"" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.12" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE c:\program files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe c:\windows\SysWOW64\DllHost.exe c:\windows\SysWOW64\DllHost.exe c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe c:\program files\Sony\VAIO Care\listener.exe . ************************************************************************** . Completion time: 2014-04-27 20:31:59 - machine was rebooted ComboFix-quarantined-files.txt 2014-04-27 18:31 . Pre-Run: 13 Verzeichnis(se), 395,721,367,552 Bytes frei Post-Run: 20 Verzeichnis(se), 397,952,364,544 Bytes frei . - - End Of File - - 973A11F76B68B852488BEFFB7D119C0E |
27.04.2014, 19:46 | #13 |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Ok, melde mich so schnell wie möglich wieder mit weiteren Anweisungen. (heute noch...oder dann morgen)
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
27.04.2014, 21:26 | #14 |
/// TB-Ausbilder /// Anleitungs-Guru | Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 So, weiter gehts! Schritt 1 Scan mit Malwarebytes Antimalware Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits". Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten". Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...) Poste mir den Inhalt der Logdatei. Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle. Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread. Schritt 2 ESET Online Scanner
Schritt 3 Bitte starte FRST erneut, setze den Haken auch bei Addition.txt und drücke auf Scan. Schritt 4 Downloade dir bitte Farbar Service Scanner
Poste bitte den Inhalt hier. Bitte poste mir den Inhalt der Logdateien von MBAM, ESET, FRST, FSS.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
27.04.2014, 22:16 | #15 |
| Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 Hallo Jürgen, also ich poste dir die sachen hier jetzt nacheinander. sonst komme ich durcheinander Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 27/04/2014 Suchlauf-Zeit: 23:09:09 Logdatei: Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.04.27.05 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Lena Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 300263 Verstrichene Zeit: 26 Min, 33 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 2 Backdoor.0Access, C:\Windows\Installer\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56}\L, In Quarantäne, [55ab53add12f7090407243bd6c94e51b], Backdoor.0Access, C:\Windows\Installer\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56}\U, In Quarantäne, [52aece32cb35768a298a90708080e11f], Dateien: 5 PUP.Optional.OpenCandy, C:\Users\Lena\Downloads\DTLite4491-0356.exe, In Quarantäne, [9f610cf46f9145bb74f324315ea6f20e], PUP.Optional.Softonic.A, C:\Users\Lena\Downloads\SoftonicDownloader_fuer_burnaware-free(1).exe, In Quarantäne, [b24ee020f9076b955fd89c807889da26], PUP.Optional.Softonic.A, C:\Users\Lena\Downloads\SoftonicDownloader_fuer_burnaware-free.exe, In Quarantäne, [05fbca363ac6b64a3007c15bf809be42], PUP.Optional.Softonic.A, C:\Users\Lena\Downloads\SoftonicDownloader_fuer_infrarecorder.exe, In Quarantäne, [4eb2619f0cf4956bb68157c5798817e9], Backdoor.0Access, C:\Windows\Installer\{0a9f6865-dc7a-7a66-8c39-f4933acdfb56}\@, In Quarantäne, [a9579f615fa1bb451a57e41c14ec738d], Physische Sektoren: 0 (No malicious items detected) (end) |
Themen zu Firewall kann nicht aktiviert/deaktiviert werden. Fehlercode 0x80070424 |
0x8007042, anschluss, dateien, deaktivieren, fehler, fehlercode, firewall, folge, foren, funktioniert, funktioniert nicht, funktioniert nicht mehr, hallo zusammen, hilfe!, iso-datei, laptop, malwarebytes, microsoft, nicht mehr, office, problem, probleme, rechner, setup, temp, virus, öffnet |