| |
| |||||||
Log-Analyse und Auswertung: Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich MalwareWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.05.2014, 00:40
| #1 |
| |  Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware Hallo TB-Team, ich hab hier ein verseuchtes Notebook und brauch beim reinigen eure Hilfe. Eigentlich ist nur ein Problem mit dem Mauscursor aufgetreten, der von alleine immer nach oben oder nach unten gedriftet ist. Man konnte mit dem Touchpad auch nicht wirklich gegensteuern. Habe vorhin MWB laufen lassen und da hat sich schon ein bisschen angesammelt. FRST und GMER Log files sind auch anbei. Vielen Dank schonmal! Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 04.05.2014 Scan Time: 00:02:15 Logfile: log.txt Administrator: Yes Version: 2.00.1.1004 Malware Database: v2014.05.03.06 Rootkit Database: v2014.03.27.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Chameleon: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: ***** Scan Type: Threat Scan Result: Completed Objects Scanned: 331617 Time Elapsed: 32 min, 6 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Shuriken: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 5 Malware.Trace, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DC3_FEXEC, , [b250c18ce497d165e059101f2cd7916f], PUP.Optional.PriceGong.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [c04275d86b10f145df38e0a7ca386898], PUP.Optional.Softonic.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [25dde7660d6e25110dfda3d8778b18e8], PUP.Optional.PriceGong.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [f60c6ae3601b74c2e1366324bb479f61], PUP.Optional.PriceGong.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [6a98212c2b507abc888fb1d6ba48c23e], Registry Values: 1 Backdoor.Agent.DCEGen, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|HP Notebook Management, C:\Windows\system32\MSDCSC\hpnbmgmt.exe, , [a55d430ad7a4c76f905705889072728e] Registry Data: 2 Hijack.UserInit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|Userinit, C:\Windows\system32\userinit.exe,C:\Windows\system32\MSDCSC\hpnbmgmt.exe, Good: (userinit.exe), Bad: (C:\Windows\system32\userinit.exe,C:\Windows\system32\MSDCSC\hpnbmgmt.exe),,[c33fc687f78464d265e11f13c63e3fc1] PUP.Optional.Conduit, HKU\S-1-5-21-1313351843-3303109176-4145949557-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050, Good: (hxxp://www.google.com), Bad: (hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050),,[04fe64e9c7b47abcd7c1083022e2966a] Folders: 3 Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs, , [5fa3ff4e6a119a9c7a835a03a55ea35d], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\xpi, , [b0521637accf6cca67c6d79106fcf709], Files: 13 Trojan.Delf, C:\Users\*****\AppData\Roaming\install\winupdater.exe, , [3ac868e575060f27fa7c207f04fc4cb4], PUP.Optional.OpenCandy, C:\Users\*****\AppData\Local\Temp\is-O8N12.tmp\OCSetupHlp.dll, , [966c301d1d5edc5a3fa15309a163dc24], PUP.Optional.Conduit, C:\Users\*****\AppData\Local\Temp\ct2269050\ieLogic.exe, , [c43e61ece893b87e96e84ee129d7e41c], Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs\2013-08-14-4.dc, , [5fa3ff4e6a119a9c7a835a03a55ea35d], Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs\2013-08-15-5.dc, , [5fa3ff4e6a119a9c7a835a03a55ea35d], Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs\2013-08-20-3.dc, , [5fa3ff4e6a119a9c7a835a03a55ea35d], Trojan.Agent.Gen, C:\Users\*****\AppData\Roaming\*****-wchelper.dll, , [ca381d303447072f29f99ae747bc09f7], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\CT2269050.xpi, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\ffLogic.exe, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\statisticsStub.exe, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\xpi\install.rdf, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\prefs.js, Good: (), Bad: (user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}");), ,[3bc7004d9ddecf67561aec79a361dc24] PUP.Optional.Conduit.A, C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\prefs.js, Good: (), Bad: (user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=");), ,[33cf87c6007b9e98dd948ed7976df50b] Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:01-05-2014
Ran by ***** (administrator) on ***** on 04-05-2014 00:38:03
Running from C:\Users\***** \Downloads
Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AEstSrv.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
() C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
( ) C:\Windows\System32\dkabcoms.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.EXE
(Motorola Mobility LLC) C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Motorola) C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe
() C:\Program Files\MTN Internet\AssistantServices.exe
() C:\Program Files\Verbindungsassistent\WTGService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMON.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Motorola Mobility LLC) C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.EXE
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1578280 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [NPSStartup] => [X]
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-28] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2010-09-08] (IDT, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKLM\...\Policies\Explorer\Run: [Updates] => C:\system32\SystemProtection.exe [141824 2013-10-12] ( (Microsoft Corporation))
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {03b61ceb-1ffd-11e0-8aa9-002713a6f0ec} - H:\pushinst.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {20d7571f-8d20-11e0-8c45-002713a6f0ec} - I:\LaunchU3.exe -a
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f33cbd1-e23a-11e1-9a89-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f33cbee-e23a-11e1-9a89-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f33cc04-e23a-11e1-9a89-002713a6f0ec} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd669-e2e3-11e1-99f2-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd66e-e2e3-11e1-99f2-002713a6f0ec} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd6ae-e2e3-11e1-99f2-705ab6a0d29b} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd6b2-e2e3-11e1-99f2-705ab6a0d29b} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {72494687-e2dd-11e1-89b8-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {732d4230-bdff-11e2-8700-002713a6f0ec} - H:\MotorolaDeviceManagerSetup.exe -a
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {7654d8bd-264d-11e0-a079-002713a6f0ec} - H:\pushinst.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {99e60995-5118-11e1-bcba-002713a6f0ec} - H:\LaunchU3.exe -a
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.search-results.com/?l=dis&o=41648036
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3338F3DED2B3CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {C7576B9D-B442-46bc-AF74-080A9E723E01} URL = hxxp://websearch.search-results.com/redirect?client=ie&tb=STC-SRS&o=41648033&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=96&apn_dtid=YYYYYYYYDE&apn_uid=9A2A31B8-7A41-4E8A-9DEE-494104803222&apn_sauid=2E84504C-3655-48A0-9FD2-B28BEAC9CCDD
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{5AF65354-03AE-46C4-817B-B72FDF84E827}: [NameServer]134.147.222.4,134.147.32.4
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default
FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\user.js
FF SearchEngineOrder.1: Search-Results
FF Homepage: hxxp://ard.de/
FF NetworkProxy: "no_proxies_on", "fritz.box"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @garmin.com/GpsControl - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoftTB Community Toolbar - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2012-01-07]
FF Extension: Free YouTube Download (Free Studio) Menu - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012-01-07]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-03-23]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-06-22]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-17]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-07-28]
Chrome:
=======
CHR HomePage: hxxp://internacional.elpais.com/
CHR StartupUrls: "hxxp://dict.leo.org/esde?lang=de&lp=esde", "hxxp://internacional.elpais.com/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RIM Handheld Application Loader) - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]
CHR Extension: (Adblock Plus) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-03]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2012-11-26]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\*****\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-19]
========================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-08-03] (LSI Corporation)
R2 ALDITALKVerbindungsassistent_Service; C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe [343024 2012-08-20] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-28] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [364544 2008-02-25] (AVM Berlin)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528624 2009-11-17] (Cisco Systems, Inc.)
R2 dkab_device; C:\Windows\system32\DKabcoms.exe [603376 2009-06-09] ( )
R2 Motorola Device Manager; C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PST Service; C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [254034 2010-09-08] (IDT, Inc.)
R2 UI Assistant Service; C:\Program Files\MTN Internet\AssistantServices.exe [271696 2012-03-06] ()
R2 vcsFPService; C:\Windows\system32\vcsFPService.exe [1639728 2009-10-21] (Validity Sensors, Inc.)
R2 WTGService; C:\Program Files\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-27] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-11-07] (AVM Berlin)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2009-11-17] (Cisco Systems, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [401920 2007-12-19] (AVM GmbH)
S3 GKUPRO2D; C:\Windows\System32\Drivers\GKUPRO2D.sys [71168 2005-02-18] (Gemplus)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-05-20] (MBB Incorporated)
S3 OXSDIDRV_x32; C:\Windows\System32\DRIVERS\OXSDIDRV_x32.sys [52656 2009-09-28] ()
S3 OXUDIDRV; C:\Windows\system32\Drivers\OXUDIDRV_X32.sys [24880 2010-05-25] ()
S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [47616 2009-10-28] (REDC)
R3 rismc32; C:\Windows\System32\DRIVERS\rismc32.sys [49152 2009-07-20] (RICOH Company, Ltd.)
S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38912 2009-09-28] (REDC)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1765168 2009-09-17] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2010-04-27] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14848 2010-04-27] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [123648 2010-04-27] (MCCI Corporation)
U0 vhsps; C:\Windows\System32\drivers\ifnhodf.sys [52440 2014-05-04] (Malwarebytes Corporation)
S3 flpydisk; \SystemRoot\system32\DRIVERS\flpydisk.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-04 00:38 - 2014-05-04 00:38 - 00020512 _____ () C:\Users\*****\Downloads\FRST.txt
2014-05-04 00:37 - 2014-05-04 00:38 - 00000000 ____D () C:\FRST
2014-05-04 00:37 - 2014-05-04 00:37 - 00000466 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-05-04 00:37 - 2014-05-04 00:37 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-05-04 00:36 - 2014-05-04 00:36 - 01050624 _____ (Farbar) C:\Users\*****\Downloads\FRST.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00380416 _____ () C:\Users\*****\Downloads\vdolc97y.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00009850 _____ () C:\Users\*****\Desktop\Mappe1.xlsx
2014-05-04 00:35 - 2014-05-04 00:35 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-05-04 00:05 - 2014-05-04 00:05 - 00052440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\ifnhodf.sys
2014-05-03 23:28 - 2014-05-03 23:29 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-03 23:27 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-03 23:27 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-03 23:22 - 2014-05-03 23:22 - 00613200 _____ (Chip Digital GmbH) C:\Users\*****\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-04-16 22:48 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-16 22:48 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-16 22:48 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-16 22:48 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-16 22:48 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-16 22:48 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-16 22:48 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-16 22:48 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-16 22:48 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-16 22:48 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-16 22:48 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-16 22:48 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-16 22:48 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-16 22:48 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-16 22:48 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-16 22:48 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-16 22:48 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-16 22:48 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-16 22:48 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-16 22:48 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-16 22:48 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-16 22:48 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-16 22:48 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-16 22:48 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-16 22:48 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-16 22:48 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-16 22:28 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
==================== One Month Modified Files and Folders =======
2014-05-04 00:38 - 2014-05-04 00:38 - 00020512 _____ () C:\Users\*****\Downloads\FRST.txt
2014-05-04 00:38 - 2014-05-04 00:37 - 00000000 ____D () C:\FRST
2014-05-04 00:37 - 2014-05-04 00:37 - 00000466 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-05-04 00:37 - 2014-05-04 00:37 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-05-04 00:36 - 2014-05-04 00:36 - 01050624 _____ (Farbar) C:\Users\*****\Downloads\FRST.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00380416 _____ () C:\Users\*****\Downloads\vdolc97y.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00009850 _____ () C:\Users\*****\Desktop\Mappe1.xlsx
2014-05-04 00:35 - 2014-05-04 00:35 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-05-04 00:33 - 2011-01-14 20:20 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-04 00:32 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2014-05-04 00:14 - 2011-01-13 21:31 - 01158297 _____ () C:\Windows\WindowsUpdate.log
2014-05-04 00:05 - 2014-05-04 00:05 - 00052440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\ifnhodf.sys
2014-05-04 00:05 - 2009-07-14 09:50 - 00000000 ____D () C:\Windows\CSC
2014-05-04 00:05 - 2005-07-03 22:15 - 00000000 ____D () C:\Users\*****\AppData\Roaming\install
2014-05-03 23:29 - 2014-05-03 23:28 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2012-12-19 19:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-03 23:25 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-03 23:25 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-03 23:22 - 2014-05-03 23:22 - 00613200 _____ (Chip Digital GmbH) C:\Users\*****\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-05-03 23:22 - 2011-01-12 12:32 - 00005144 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-03 23:18 - 2013-12-11 00:14 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202.job
2014-05-03 23:17 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-03 23:17 - 2009-07-14 06:39 - 00192266 _____ () C:\Windows\setupact.log
2014-05-03 21:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-16 22:50 - 2011-01-14 00:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-16 22:47 - 2013-08-10 21:42 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-16 22:45 - 2011-04-17 15:33 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT
Some content of TEMP:
====================
C:\Users\kefi\AppData\Local\Temp\AskSLib.dll
C:\Users\*****\AppData\Local\Temp\AskSLib.dll
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\contentDATs.exe
C:\Users\*****\AppData\Local\Temp\DelayInst.exe
C:\Users\*****\AppData\Local\Temp\FileSystemView.dll
C:\Users\*****\AppData\Local\Temp\GoogleChromeInstaller.exe
C:\Users\*****\AppData\Local\Temp\installservice.exe
C:\Users\*****\AppData\Local\Temp\instmsi.exe
C:\Users\*****\AppData\Local\Temp\instmsiw.exe
C:\Users\*****\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\*****\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\*****\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\*****\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\*****\AppData\Local\Temp\mfc80.dll
C:\Users\*****\AppData\Local\Temp\mfc80u.dll
C:\Users\*****\AppData\Local\Temp\mfcm80.dll
C:\Users\*****\AppData\Local\Temp\mfcm80u.dll
C:\Users\*****\AppData\Local\Temp\MotoCast_Installer_2.0309.exe
C:\Users\*****\AppData\Local\Temp\MotorolaDeviceManager_2.0405.exe
C:\Users\*****\AppData\Local\Temp\msvcm80.dll
C:\Users\*****\AppData\Local\Temp\msvcp80.dll
C:\Users\*****\AppData\Local\Temp\msvcr80.dll
C:\Users\*****\AppData\Local\Temp\ose00000.exe
C:\Users\*****\AppData\Local\Temp\OSU.exe
C:\Users\*****\AppData\Local\Temp\search-resultsToolbarInstaller-1.9.1.0.exe
C:\Users\*****\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\*****\AppData\Local\Temp\setup.exe
C:\Users\*****\AppData\Local\Temp\SkypeSetup.exe
C:\Users\*****\AppData\Local\Temp\tbDVDV.dll
C:\Users\*****\AppData\Local\Temp\Uninstaller.exe
C:\Users\*****\AppData\Local\Temp\VersionUpdater.exe
C:\Users\*****\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\*****\AppData\Local\Temp\WtgDriverInstallX.dll
C:\Users\*****\AppData\Local\Temp\WTGXMLUtil.dll
C:\Users\*****\AppData\Local\Temp\WtgZip.dll
C:\Users\*****\AppData\Local\Temp\ytb.exe
C:\Users\*****\AppData\Local\Temp\{8667B502-27D6-4215-A728-376BECFDAE90}-21.0.1180.79_21.0.1180.77_chrome_updater.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-15 14:45
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:01-05-2014
Ran by ****** at 2014-05-04 00:39:03
Running from C:\Users\******\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Reader X (10.1.3) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)
ALDI TALK Verbindungsassistent (HKLM\...\ALDITALKVerbindungsassistent) (Version: - ALDI TALK Verbindungsassistent)
ArcSoft Panorama Maker 5 (HKLM\...\{F18046C5-1C4E-4BE1-A3D6-A6F970E2E8E8}) (Version: 5.0.1.71 - ArcSoft)
ASTERICS 3.3 (HKLM\...\{F66B9ED8-DB45-4A0C-BE7B-513BE9E28226}) (Version: 3.3.0 - University Duisburg-Essen, Germany)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
AVM FRITZ!WLAN (HKLM\...\AVMWLANCLI) (Version: - AVM Berlin)
BioEdit (HKLM\...\{AF6D9313-E338-48F0-9B0C-7DE20EDB99CF}) (Version: 7.0.9 - Tom Hall)
BlackBerry Desktop Software 6.1 (HKLM\...\BlackBerry_Desktop) (Version: 6.1.0.35 - Research in Motion Ltd.)
BlackBerry Desktop Software 6.1 (Version: 6.1.0.35 - Research in Motion Ltd.) Hidden
Cisco Systems VPN Client 5.0.06.0160 (HKLM\...\{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}) (Version: 5.0.6 - Cisco Systems, Inc.)
Corel Graphics - Windows Shell Extension (HKLM\...\_{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}) (Version: 15.2.0.686 - Corel Corporation)
Corel Graphics - Windows Shell Extension (Version: 15.2.686 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - BR (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Capture (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Common (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Connect (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Custom Data (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - DE (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Draw (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - EN (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - ES (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Filters (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FontNav (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FR (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IPM (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IT (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - NL (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - PHOTO-PAINT (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Photozoom Plugin (Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Redist (Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Setup Files (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VBA (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VideoBrowser (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VSTA (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - WT (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW(R) Graphics Suite X5 (HKLM\...\_{CE54DCE1-E00A-4D91-ACB9-A2D916C24051}) (Version: 15.2.0.686 - Corel Corporation)
Dell Druckersoftware-Deinstallation (HKLM\...\Dell_HostCD) (Version: - Dell, Inc.)
Dropbox (HKCU\...\Dropbox) (Version: 2.0.22 - Dropbox, Inc.)
Duden Korrektor kompakt (HKLM\...\{D5B8CDB6-0F63-49BB-9E32-D0246BE90C8F}) (Version: 6.00.00 - Bibliographisches Institut & F.A. Brockhaus AG)
Duden-Bibliothek (HKLM\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.1.0 - Bibliographisches Institut AG)
Free YouTube to MP3 Converter version 3.11.35.1031 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.35.1031 - DVDVideoSoft Ltd.)
Garmin BaseCamp (HKLM\...\{74E69F8A-BCBB-4A0A-9361-32225755D8C3}) (Version: 3.2.2 - Garmin Ltd or its subsidiaries)
Garmin Topo España v4 (HKLM\...\{9F9E90E8-E0BD-45DF-AE19-C2B51FAAE692}) (Version: 4.0.0.0 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)
Geneious 5.4.4 (HKLM\...\4435-7533-6274-7601) (Version: 5.4.4 - Biomatters Ltd)
Ghostscript GPL 8.64 (Msi Setup) (HKLM\...\_{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}) (Version: 8.64 - Corel Corporation)
Ghostscript GPL 8.64 (Msi Setup) (Version: 8.64 - Corel Corporation) Hidden
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM\...\{8E87B944-4815-3C5E-947F-5035C9F64362}.KB947789) (Version: 1 - Microsoft Corporation)
HP 3D DriveGuard (HKLM\...\{9B6079F8-EBA2-4C55-96A6-325E8E22DF0C}) (Version: 4.0.4.1 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM\...\{1C47EEFD-ADC8-4B7C-9979-C550573B4C42}) (Version: 1.0.5.1 - Hewlett-Packard Company)
HP Integrated Module with Bluetooth wireless technology (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)
HP Quick Launch Buttons (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.12.1 - Hewlett-Packard)
HP Webcam Driver (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50009.1 - Sonix)
ICQ7.2 (HKLM\...\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}) (Version: 7.2 - ICQ)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6300.0 - IDT)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 14.8 - Intel)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Iomega Encryption (HKLM\...\{B8A37E68-5AC8-45A6-A037-753EF47836C5}) (Version: 1.03.0001 - Iomega an EMC Company)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Langenscheidt Vokabeltrainer 6.0 Spanisch (HKLM\...\{249556BD-ABA8-4510-84A3-8B30B402B07C}) (Version: 6.0.0 - Langenscheidt)
Linder BIOLOGIE Genetik (HKLM\...\{BF2BC602-AE11-4C5B-91A9-B57CDB905314}) (Version: - )
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.96 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 1.1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2007 (HKLM\...\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM\...\{8E87B944-4815-3C5E-947F-5035C9F64362}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (HKLM\...\{76DAEC83-AF7B-333C-8A53-83D7C7D39199}) (Version: 9.0.30729 - Microsoft Corporation)
Motorola Device Manager (HKLM\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.4.5 - Motorola Mobility)
Motorola Device Software Update (Version: 13.09.3001 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.3.0 (HKLM\...\{A55747C1-4651-433D-B082-478874FF7516}) (Version: 6.3.0 - Motorola Mobility LLC)
Mozilla Firefox (3.6.23) (HKLM\...\Mozilla Firefox (3.6.23)) (Version: 3.6.23 (de) - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MTN Internet (HKLM\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.1 - ZTE)
Nikon Message Center 2 (HKLM\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
No23 Recorder (HKLM\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 6.80.5.1 - )
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)
Picture Control Utility (HKLM\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.2 - Nikon)
QLBCASL (Version: 6.40.17.2 - Hewlett-Packard) Hidden
RemoteComms External Disk Access (HKLM\...\{04FCD5DE-1662-4F99-BDA9-C57212113EF2}) (Version: 1.25.0003 - PLX Technology)
RICOH Media Driver (HKLM\...\{F5CC2EF8-20A4-4366-A681-3FE849E65809}) (Version: 2.13.00.05 - RICOH)
RUBICon (HKLM\...\{5A1084A3-79B7-480C-9275-D8AA0CCEFA52}) (Version: 2.0.24 - RUB)
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.650.0 - SAMSUNG Electronics Co., Ltd.)
SamsungConnectivityCableDriver (HKLM\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung)
Sequencher 4.10.1 Demo (HKLM\...\{38B10B3D-CDBE-4560-BA5A-A6C33D1B6802}) (Version: 4.10.1 - Gene Codes Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.10.0 - Synaptics Incorporated)
Uninstall 1.0.0.1 (HKLM\...\Uninstall_is1) (Version: - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version: - Microsoft)
Validity Fingerprint Driver (HKLM\...\{DF553DE7-3F31-495D-904D-AFA89BD3739C}) (Version: 4.0.8.0 - Validity Sensors, Inc.)
Verbindungsassistent (HKLM\...\Verbindungsassistent) (Version: 2.1 - Verbindungsassistent)
ViewNX 2 (HKLM\...\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.1.2 - Nikon)
Visual Basic for Applications (R) Core - English (Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core - German (Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core (Version: 6.4.99.69 - Microsoft Corporation) Hidden
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
Vokabeltrainer-Update 6.0.18 (HKLM\...\{5BB72321-F9E7-42C2-9400-AFC195E4F8C6}) (Version: 6.0.18 - Langenscheidt)
Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (HKLM\...\B7541EC5F72AA713F557569278EB6273725F5607) (Version: 06/15/2009 6.2.0.9000 - Broadcom)
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (HKLM\...\A6A8668C0A13640CA28FE2A7D9654BE4AE478B13) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)
Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CC}) (Version: 16.0.9715 - WinZip Computing, S.L. )
==================== Restore Points =========================
14-03-2014 19:23:08 Windows Update
14-03-2014 19:32:39 Windows Update
18-03-2014 19:42:56 Windows Update
21-03-2014 19:35:57 Windows Update
22-03-2014 23:36:25 Installed Java 7 Update 51
16-04-2014 20:24:52 Windows Update
16-04-2014 20:45:01 Windows Update
03-05-2014 20:09:35 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0846BDC7-07F5-44EC-B6B0-23C4F6FABC8D} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {10FBA785-D0B6-407C-B799-BCD9153C858B} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {2B04E83F-D76D-4FF4-9FF3-1695729ED82A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {51CCC4F0-DC7A-4DD6-BA63-8D39F72AA42B} - System32\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202 => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-14] (Google Inc.)
Task: {5571C043-7280-4452-8107-5607E56AE6B3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-14] (Google Inc.)
Task: {72C4EEF9-D51D-4409-B2BC-51E851C1D0B8} - System32\Tasks\Motorola Device Manager Update => C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {A3713E6F-22ED-4048-8FD1-9122629E28C8} - System32\Tasks\{F5DDE321-A33E-4E37-98D4-108095D0CDCA} => C:\Program Files\Skype\\Phone\Skype.exe
Task: {D9CB0A38-9F14-4F3E-AB2D-1199F25A9B2B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-14] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-08-06 08:55 - 2013-08-05 10:07 - 00394824 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2012-08-20 19:25 - 2012-08-20 19:25 - 00343024 _____ () C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe
2009-11-17 13:08 - 2009-11-17 13:08 - 00197424 _____ () C:\Windows\system32\vpnapi.dll
2013-10-31 17:05 - 2013-10-31 17:05 - 00172032 _____ () C:\Program Files\Motorola Mobility\Motorola Device Manager\css_core.dll
2012-08-10 13:24 - 2012-03-06 15:44 - 00271696 _____ () C:\Program Files\MTN Internet\AssistantServices.exe
2012-08-20 20:33 - 2009-03-03 12:45 - 00296400 ____N () C:\Program Files\Verbindungsassistent\WTGService.exe
2014-05-03 21:59 - 2014-04-24 02:33 - 00065352 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 00674632 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\libglesv2.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 00093000 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\libegl.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 04081480 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 00390472 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 01647432 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 13692232 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Launcher.lnk => C:\Windows\pss\Launcher.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk => C:\Windows\pss\VPN Client.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: AutoStartNPSAgent => H:\NPSAgent.exe
MSCONFIG\startupreg: AVMWlanClient => C:\Program Files\avmwlanstick\wlangui.exe
MSCONFIG\startupreg: DKab1err => C:\Program Files\Dell\Printer Software\DKab1err.exe
MSCONFIG\startupreg: GoogleChromeAutoLaunch_0D73A4BF866AFC6952401D3F01412222 => "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: IAAnotif => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
MSCONFIG\startupreg: IMSS => "C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RIMBBLaunchAgent.exe => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
MSCONFIG\startupreg: UIExec => "C:\Program Files\MTN Internet\UIExec.exe"
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter
Description: Cisco Systems VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/03/2014 11:24:36 PM) (Source: Microsoft Office 12) (User: )
Description: Rejected Safe Mode action : Microsoft Office Word.
Error: (05/03/2014 11:22:40 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (05/03/2014 11:22:40 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/03/2014 11:22:40 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/03/2014 11:20:34 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 12.0.6695.5000, Zeitstempel: 0x5329c5d9
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0x1628
Startzeit der fehlerhaften Anwendung: 0xWINWORD.EXE0
Pfad der fehlerhaften Anwendung: WINWORD.EXE1
Pfad des fehlerhaften Moduls: WINWORD.EXE2
Berichtskennung: WINWORD.EXE3
Error: (05/03/2014 10:05:41 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
Error: (05/03/2014 09:59:33 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (05/03/2014 09:59:33 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/03/2014 09:59:33 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (04/16/2014 10:23:37 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
System errors:
=============
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Microsoft Office Sessions:
=========================
Error: (05/03/2014 11:20:33 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 26 seconds with 0 seconds of active time. This session ended with a crash.
Error: (06/24/2013 10:26:47 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 138100 seconds with 5700 seconds of active time. This session ended with a crash.
Error: (12/19/2012 09:54:57 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5858 seconds with 180 seconds of active time. This session ended with a crash.
Error: (06/28/2012 02:12:19 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 13209 seconds with 0 seconds of active time. This session ended with a crash.
Error: (06/14/2012 07:50:31 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28735 seconds with 840 seconds of active time. This session ended with a crash.
Error: (06/14/2012 07:49:23 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 21034 seconds with 600 seconds of active time. This session ended with a crash.
Error: (06/13/2012 01:20:53 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 63275 seconds with 3420 seconds of active time. This session ended with a crash.
Error: (06/12/2012 04:03:42 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3292 seconds with 1020 seconds of active time. This session ended with a crash.
Error: (06/12/2012 02:49:37 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2156 seconds with 1320 seconds of active time. This session ended with a crash.
Error: (06/12/2012 02:45:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2701 seconds with 1020 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 57%
Total physical RAM: 2991.38 MB
Available physical RAM: 1281.25 MB
Total Pagefile: 5981.05 MB
Available Pagefile: 3741.17 MB
Total Virtual: 2047.88 MB
Available Virtual: 1913.91 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:215.59 GB) (Free:53.86 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.23 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:4.49 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.99 GB) FAT32
Drive i: () (Removable) (Total:7.51 GB) (Free:3.31 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 202D2354)
Partition 1: (Not Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=216 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
========================================================
Disk: 1 (Size: 8 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-04 01:10:15
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST925041 rev.0006 232,89GB
Running: vdolc97y.exe; Driver: C:\Users\NICOLA~1\AppData\Local\Temp\pwldqpog.sys
---- System - GMER 2.1 ----
SSDT 92AE8866 ZwCreateSection
SSDT 92AE8870 ZwRequestWaitReplyPort
SSDT 92AE886B ZwSetContextThread
SSDT 92AE8875 ZwSetSecurityObject
SSDT 92AE887A ZwSystemDebugControl
SSDT 92AE8807 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83493A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 834CD212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 834D458C 4 Bytes [66, 88, AE, 92]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 834D48E8 4 Bytes [70, 88, AE, 92] {JO 0xffffff8a; SCASB ; XCHG EDX, EAX}
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 834D492C 4 Bytes [6B, 88, AE, 92]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 834D49A8 1 Byte [75]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 834D49A8 4 Bytes [75, 88, AE, 92] {JNZ 0xffffff8a; SCASB ; XCHG EDX, EAX}
.text ...
---- Devices - GMER 2.1 ----
Device \Driver\BTHUSB \Device\0000009b bthport.sys
Device \Driver\BTHUSB \Device\0000009d bthport.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713a6f0ec
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713a6f0ec (not active ControlSet)
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@VideoMemoryBandwidth 3384410
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@VideoMemorySize 1370423296
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@SharedVideoMemory 1303314432
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@GraphicsFPS 63957
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@DiskScore 58
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@CpuUPExpressCompressThroughput 202
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@RandomReadDiskScore 1341
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@TimeLastFormalAssessment 0xD5 0x23 0x1C 0x0F ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_10mbps_h264.mp4@DateTime 0x40 0xF1 0xC1 0xBD ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_10mbps_h264.mp4\GpuEngineUsage\A1/N1/E1@VP 7019
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_10mbps_h264.mp4\GpuEngineUsage\Total@VP 7019
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg@DateTime 0xB0 0xB4 0x3B 0xAC ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg@FramesRendered 0x27 0x01 0x00 0x00 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\A1/N1/E1@Decode 1379
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\A1/N1/E1@VP 4361
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\Total@Decode 1379
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\Total@VP 4361
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv@DateTime 0x10 0x3C 0xF0 0xB0 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\A1/N1/E1@Decode 5007
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\A1/N1/E1@VP 6700
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\Total@Decode 5007
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\Total@VP 6700
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg@DateTime 0xC0 0xD7 0x59 0xB5 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@Decode 291
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@VP 1794
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\Total@Decode 291
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\Total@VP 1794
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg@DateTime 0x50 0xA4 0x99 0xB9 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@Decode 570
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@VP 2471
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@DwmRedir 34
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\Total@Decode 570
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\Total@VP 2471
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\Total@DwmRedir 34
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480_5sec_6mbps_h264.mp4@DateTime 0x90 0x84 0x2F 0xC2 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480_5sec_6mbps_h264.mp4\GpuEngineUsage\A1/N1/E1@VP 2562
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480_5sec_6mbps_h264.mp4\GpuEngineUsage\Total@VP 2562
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSATAPI@IdleWinSATRunCount 6
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSATAPI@IdleAssessmentCompletionCount 6
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSATAPI@IdleWinSATRunAfterCount 5
Reg HKLM\SOFTWARE\Classes\.b64\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.b64\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.bz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.bz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.lha\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.lha\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.lzh\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.lzh\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.mim\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.mim\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.mime\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.mime\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.rar\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.rar\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.tbz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.tbz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.tz\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.tz\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.uu\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.uu\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.uue\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.uue\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
---- EOF - GMER 2.1 ----
|
| Themen zu Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivirus, appdatalow, backdoor.agent.dcegen, desktop, device driver, downloader, dvdvideosoft ltd., flash player, hijack.userinit, internet explorer, malware, malware.trace, problem, pup.optional.conduit, pup.optional.conduit.a, pup.optional.opencandy, pup.optional.pricegong.a, pup.optional.softonic.a, software, stolen.data, svchost.exe, system, trojan.agent.gen, trojan.delf |
Baum-Darstellung