| |
| |||||||
Log-Analyse und Auswertung: Infektion mit TR/Rootkit.Gen und TR/Crypt.EPACK.4696 - Windows Update und Avira Echtzeitscan funktionieren nicht mehrWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
26.05.2014, 11:05
| #1 |
| |  Infektion mit TR/Rootkit.Gen und TR/Crypt.EPACK.4696 - Windows Update und Avira Echtzeitscan funktionieren nicht mehr Liebe Experten, schon einmal vorab ein grosses DANKESCHÖN für Eure Hilfe! Folgendes Problem ist auf einem meiner Windows-Rechner aufgetaucht: Ich bin am So, 18. Mai 2014 vom Telekom abuse Team darauf hingewiesen worden, das am Fr, 16. Mai 2014 mittags über meinen Internet-Zugang Spammails versendet wurden. Eine Überprüfung am Sonntagabend (18.5.) ergab, das tatsächlich auf einem Rechner eine Unregelmäßigkeit zu verzeichnen war: Avira Echtzeitscan und Windows-Update sind nicht mehr zu aktivieren. Avira Echtzeitscan lässt sich nicht "anklicken" und beim Versuch, nach Windows Updates zu suchen, erscheint die Meldung "Mit Windows Update kann derzeit nicht nach Updates gesucht werden, da der Dienst nicht ausgeführt wird. Möglicherweise müssen Sie den Computer neu starten." Klar, dass ein Neustart auch keine Änderung bringt... Ich habe den Rechner dann erst einmal ausgeschaltet und vom Internet getrennt, am Di, 20. Mai 2014 die Logfiles erstellt und den Rechner wieder isoliert. Heute morgen habe ich den Rechner wieder in Betrieb genommen, um - mit Eurer Unterstützung - die "Reparatur" zu starten. Die Reports/Logfiles finden sich hier: Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:03 on 20/05/2014 (ClaudiaBM)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by ClaudiaBM (administrator) on CLAUDIAPC on 20-05-2014 18:06:19
Running from C:\Users\ClaudiaBM\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Logitech, Inc.) C:\Program Files\Logitech\FlowScroll\KhalScroll.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(HP) C:\Program Files\hp\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
() C:\Windows\Installer\{BB370133-93EB-E645-1CA8-B942FC71C504}\syshost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_8_800_174_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [LogiScrollApp] => C:\Program Files\Logitech\FlowScroll\KhalScroll.exe [166680 2012-02-08] (Logitech, Inc.)
HKLM-x32\...\Run: [HP Software Update] => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [183376 2014-05-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-09] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1861946194-2543170919-165072490-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-04-21] (Google Inc.)
HKU\S-1-5-21-1861946194-2543170919-165072490-1000\...\MountPoints2: {f04db8c5-8bcc-11e1-8667-e8393546f056} - G:\pushinst.exe
HKU\S-1-5-21-1861946194-2543170919-165072490-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-04-21] (Google Inc.)
HKU\S-1-5-21-1861946194-2543170919-165072490-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {f04db8c5-8bcc-11e1-8667-e8393546f056} - G:\pushinst.exe
HKU\S-1-5-21-1861946194-2543170919-165072490-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-04-21] (Google Inc.)
HKU\S-1-5-21-1861946194-2543170919-165072490-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {f04db8c5-8bcc-11e1-8667-e8393546f056} - G:\pushinst.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
SearchScopes: HKLM - {1543BC56-56BE-4339-A384-5EE3EA9F968A} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {1543BC56-56BE-4339-A384-5EE3EA9F968A} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {1543BC56-56BE-4339-A384-5EE3EA9F968A} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Logitech Flow Scroll - {E11DB59D-5008-42ff-9069-535843BC0BE1} - C:\Program Files\Logitech\FlowScroll\LogiSmooth.dll (Logitech, Inc.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Logitech Flow Scroll - {E11DB59D-5008-42ff-9069-535843BC0BE1} - C:\Program Files\Logitech\FlowScroll\32-bit\LogiSmooth.dll (Logitech, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2012-03-08] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{5D3F3872-91E9-4d59-AD9F-AA174A3145DD}] - C:\Program Files\Logitech\FlowScroll\LogiSmoothFirefoxExt
FF Extension: Logitech Flow Scroll - C:\Program Files\Logitech\FlowScroll\LogiSmoothFirefoxExt [2012-05-05]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-01-05]
==================== Services (Whitelisted) =================
Locked "b8b28b5013136215" service could not be unlocked. <===== ATTENTION
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [123984 2014-05-14] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin)
R2 HPM1210RcvFaxSrvc; C:\Program Files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [362296 2010-05-11] (HP)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 syshost32; C:\Windows\Installer\{BB370133-93EB-E645-1CA8-B942FC71C504}\syshost.exe [87552 2014-05-02] ()
==================== Drivers (Whitelisted) ====================
S3 1394ohci; C:\Windows\system32\drivers\1394ohci.sys [229888 2010-11-21] ()
R0 ACPI; C:\Windows\System32\drivers\ACPI.sys [334208 2010-11-21] ()
S3 AcpiPmi; C:\Windows\system32\drivers\acpipmi.sys [12800 2010-11-21] ()
S3 adp94xx; C:\Windows\system32\drivers\adp94xx.sys [491088 2009-07-14] ()
S3 adpahci; C:\Windows\system32\drivers\adpahci.sys [339536 2009-07-14] ()
S3 adpu320; C:\Windows\system32\drivers\adpu320.sys [182864 2009-07-14] ()
R1 AFD; C:\Windows\system32\drivers\afd.sys [497152 2013-09-28] ()
S3 agp440; C:\Windows\system32\drivers\agp440.sys [61008 2009-07-14] ()
S3 aliide; C:\Windows\system32\drivers\aliide.sys [15440 2009-07-14] ()
S3 amdide; C:\Windows\system32\drivers\amdide.sys [15440 2009-07-14] ()
S3 AmdK8; C:\Windows\system32\drivers\amdk8.sys [64512 2009-07-14] ()
S3 AmdPPM; C:\Windows\system32\drivers\amdppm.sys [60928 2009-07-14] ()
S3 amdsata; C:\Windows\system32\drivers\amdsata.sys [107904 2012-03-08] ()
S3 amdsbs; C:\Windows\system32\drivers\amdsbs.sys [194128 2009-07-14] ()
R0 amdxata; C:\Windows\System32\drivers\amdxata.sys [27008 2012-03-08] ()
S3 AppID; C:\Windows\system32\drivers\appid.sys [61440 2010-11-21] ()
S3 arc; C:\Windows\system32\drivers\arc.sys [87632 2009-07-14] ()
S3 arcsas; C:\Windows\system32\drivers\arcsas.sys [97856 2009-07-14] ()
R3 AsyncMac; C:\Windows\System32\DRIVERS\asyncmac.sys [23040 2009-07-14] ()
S3 atapi; C:\Windows\system32\drivers\atapi.sys [24128 2009-07-14] ()
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-09] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-09] ()
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-05-09] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] ()
S3 b06bdrv; C:\Windows\system32\drivers\bxvbda.sys [468480 2009-06-10] ()
S3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] ()
U5 b8b28b5013136215; C:\Windows\System32\Drivers\b8b28b5013136215.sys [61400 2014-05-02] () <===== ATTENTION Necurs Rootkit?
U5 BattC; C:\Windows\System32\Drivers\BattC.sys [28240 2009-07-14] ()
R1 Beep; C:\Windows\System32\Drivers\Beep.sys [6656 2009-07-14] ()
R1 blbdrive; C:\Windows\system32\drivers\blbdrive.sys [45056 2009-07-14] ()
R3 bowser; C:\Windows\System32\DRIVERS\bowser.sys [90624 2011-02-23] ()
S3 BrFiltLo; C:\Windows\system32\drivers\BrFiltLo.sys [18432 2009-06-10] ()
S3 BrFiltUp; C:\Windows\system32\drivers\BrFiltUp.sys [8704 2009-06-10] ()
S3 Brserid; C:\Windows\System32\Drivers\Brserid.sys [286720 2009-07-14] ()
S3 BrSerWdm; C:\Windows\System32\Drivers\BrSerWdm.sys [47104 2009-06-10] ()
S3 BrUsbMdm; C:\Windows\System32\Drivers\BrUsbMdm.sys [14976 2009-06-10] ()
S3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [14720 2009-06-10] ()
S3 BTHMODEM; C:\Windows\system32\drivers\bthmodem.sys [72192 2009-07-14] ()
S4 cdfs; C:\Windows\System32\DRIVERS\cdfs.sys [92160 2009-07-14] ()
R1 cdrom; C:\Windows\System32\DRIVERS\cdrom.sys [147456 2010-11-21] ()
S3 circlass; C:\Windows\system32\drivers\circlass.sys [45568 2009-07-14] ()
R0 CLFS; C:\Windows\System32\CLFS.sys [367696 2009-07-14] ()
S3 CmBatt; C:\Windows\system32\drivers\CmBatt.sys [17664 2009-07-14] ()
S3 cmdide; C:\Windows\system32\drivers\cmdide.sys [17488 2009-07-14] ()
R0 CNG; C:\Windows\System32\Drivers\cng.sys [458712 2013-07-04] ()
S3 Compbatt; C:\Windows\system32\drivers\compbatt.sys [21584 2009-07-14] ()
R3 CompositeBus; C:\Windows\system32\drivers\CompositeBus.sys [38912 2010-11-21] ()
S4 crcdisk; C:\Windows\system32\drivers\crcdisk.sys [24144 2009-07-14] ()
R1 DfsC; C:\Windows\System32\Drivers\dfsc.sys [102400 2010-11-21] ()
R1 discache; C:\Windows\System32\drivers\discache.sys [40448 2009-07-14] ()
R0 Disk; C:\Windows\System32\drivers\disk.sys [73280 2009-07-14] ()
S3 drmkaud; C:\Windows\system32\drivers\drmkaud.sys [5632 2009-07-14] ()
R3 DXGKrnl; C:\Windows\System32\drivers\dxgkrnl.sys [983488 2013-08-01] ()
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] ()
S3 elxstor; C:\Windows\system32\drivers\elxstor.sys [530496 2009-07-14] ()
S3 ErrDev; C:\Windows\system32\drivers\errdev.sys [9728 2009-07-14] ()
S3 exfat; C:\Windows\System32\Drivers\exfat.sys [195072 2009-07-14] ()
S3 fastfat; C:\Windows\System32\Drivers\fastfat.sys [204800 2009-07-14] ()
S3 fdc; C:\Windows\system32\drivers\fdc.sys [29696 2009-07-14] ()
R0 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [70224 2009-07-14] ()
S3 Filetrace; C:\Windows\System32\drivers\filetrace.sys [34304 2009-07-14] ()
S3 flpydisk; C:\Windows\system32\drivers\flpydisk.sys [24576 2009-07-14] ()
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [289664 2010-11-21] ()
S3 FsDepends; C:\Windows\System32\drivers\FsDepends.sys [55376 2009-07-14] ()
S3 fssfltr; C:\Windows\System32\DRIVERS\fssfltr.sys [48488 2012-03-08] ()
U0 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [23408 2012-03-01] ()
R0 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [223752 2013-01-24] ()
R3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [714368 2010-10-22] ()
S3 gagp30kx; C:\Windows\system32\drivers\gagp30kx.sys [65088 2009-07-14] ()
S3 hcw85cir; C:\Windows\system32\drivers\hcw85cir.sys [31232 2009-06-10] ()
S3 HdAudAddService; C:\Windows\System32\drivers\HdAudio.sys [350208 2010-11-21] ()
R3 HDAudBus; C:\Windows\system32\drivers\HDAudBus.sys [122368 2010-11-21] ()
S3 HidBatt; C:\Windows\system32\drivers\HidBatt.sys [26624 2009-07-14] ()
S3 HidBth; C:\Windows\system32\drivers\hidbth.sys [100864 2009-07-14] ()
S3 HidIr; C:\Windows\system32\drivers\hidir.sys [46592 2009-07-14] ()
R3 HidUsb; C:\Windows\System32\DRIVERS\hidusb.sys [30208 2010-11-21] ()
S3 HpSAMD; C:\Windows\system32\drivers\HpSAMD.sys [78720 2010-11-21] ()
R3 HTTP; C:\Windows\System32\drivers\HTTP.sys [753664 2010-11-21] ()
R0 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [14720 2010-11-21] ()
S3 i8042prt; C:\Windows\system32\drivers\i8042prt.sys [105472 2009-07-14] ()
R0 iaStor; C:\Windows\System32\drivers\iaStor.sys [568600 2011-11-30] ()
S3 iaStorV; C:\Windows\system32\drivers\iaStorV.sys [410496 2012-03-08] ()
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [6108416 2009-06-10] ()
S3 iirsp; C:\Windows\system32\drivers\iirsp.sys [44112 2009-07-14] ()
R3 IntcAzAudAddService; C:\Windows\System32\drivers\RTKVHD64.sys [3074664 2011-09-20] ()
S3 intelide; C:\Windows\system32\drivers\intelide.sys [16960 2009-07-14] ()
R3 intelppm; C:\Windows\system32\drivers\intelppm.sys [62464 2009-07-14] ()
S3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [82944 2010-11-21] ()
S3 IPMIDRV; C:\Windows\system32\drivers\IPMIDrv.sys [78848 2010-11-21] ()
S3 IPNAT; C:\Windows\System32\drivers\ipnat.sys [116224 2009-07-14] ()
S3 IRENUM; C:\Windows\System32\drivers\irenum.sys [17920 2009-07-14] ()
S3 isapnp; C:\Windows\system32\drivers\isapnp.sys [20544 2009-07-14] ()
S3 iScsiPrt; C:\Windows\system32\drivers\msiscsi.sys [274880 2014-02-04] ()
R3 kbdclass; C:\Windows\System32\DRIVERS\kbdclass.sys [50768 2009-07-14] ()
R3 kbdhid; C:\Windows\System32\DRIVERS\kbdhid.sys [33280 2010-11-21] ()
R0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [95680 2013-09-25] ()
R0 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [154560 2013-09-25] ()
R3 ksthunk; C:\Windows\system32\drivers\ksthunk.sys [20992 2009-07-14] ()
R3 LEqdUsb; C:\Windows\System32\DRIVERS\LEqdUsb.Sys [76056 2011-09-02] ()
R3 LHidEqd; C:\Windows\System32\DRIVERS\LHidEqd.Sys [15128 2011-09-02] ()
R3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [66840 2011-09-02] ()
R2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [60928 2009-07-14] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [60696 2011-09-02] ()
S3 LSI_FC; C:\Windows\system32\drivers\lsi_fc.sys [114752 2009-07-14] ()
S3 LSI_SAS; C:\Windows\system32\drivers\lsi_sas.sys [106560 2009-07-14] ()
S3 LSI_SAS2; C:\Windows\system32\drivers\lsi_sas2.sys [65600 2009-07-14] ()
S3 LSI_SCSI; C:\Windows\system32\drivers\lsi_scsi.sys [115776 2009-07-14] ()
R2 luafv; C:\Windows\system32\drivers\luafv.sys [113152 2009-07-14] ()
S3 megasas; C:\Windows\system32\drivers\megasas.sys [35392 2009-07-14] ()
S3 MegaSR; C:\Windows\system32\drivers\MegaSR.sys [284736 2009-07-14] ()
R3 MEIx64; C:\Windows\system32\drivers\HECIx64.sys [56344 2010-10-19] ()
S3 Modem; C:\Windows\System32\drivers\modem.sys [40448 2009-07-14] ()
R3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [30208 2009-07-14] ()
R3 mouclass; C:\Windows\System32\DRIVERS\mouclass.sys [49216 2009-07-14] ()
R3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [31232 2009-07-14] ()
R0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [94592 2010-11-21] ()
S3 mpio; C:\Windows\system32\drivers\mpio.sys [155008 2010-11-21] ()
R3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [77312 2009-07-14] ()
S3 MRxDAV; C:\Windows\system32\drivers\mrxdav.sys [140800 2013-07-04] ()
R3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [158208 2012-03-08] ()
R3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [288768 2011-07-09] ()
R3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [128000 2012-03-08] ()
S3 msahci; C:\Windows\system32\drivers\msahci.sys [31104 2010-11-21] ()
S3 msdsm; C:\Windows\system32\drivers\msdsm.sys [140672 2010-11-21] ()
R1 Msfs; C:\Windows\System32\Drivers\Msfs.sys [26112 2009-07-14] ()
S3 mshidkmdf; C:\Windows\System32\drivers\mshidkmdf.sys [8192 2009-07-14] ()
R0 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [15424 2009-07-14] ()
S3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [11136 2009-07-14] ()
S3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [7168 2009-07-14] ()
S3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [6784 2009-07-14] ()
S3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [366976 2010-11-21] ()
R1 mssmbios; C:\Windows\system32\drivers\mssmbios.sys [32320 2009-07-14] ()
S3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [8064 2009-07-14] ()
S3 MTConfig; C:\Windows\system32\drivers\MTConfig.sys [15360 2009-07-14] ()
R0 Mup; C:\Windows\System32\Drivers\mup.sys [60496 2009-07-14] ()
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2011-04-04] ()
R3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [318976 2009-07-14] ()
R0 NDIS; C:\Windows\System32\drivers\ndis.sys [950128 2012-08-22] ()
S3 NdisCap; C:\Windows\System32\DRIVERS\ndiscap.sys [35328 2009-07-14] ()
R3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [24064 2009-07-14] ()
R3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [56832 2010-11-21] ()
R3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [164352 2010-11-21] ()
R3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [57856 2010-11-21] ()
R1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [44544 2009-07-14] ()
R1 NetBT; C:\Windows\System32\DRIVERS\netbt.sys [261632 2010-11-21] ()
S3 nfrd960; C:\Windows\system32\drivers\nfrd960.sys [51264 2009-07-14] ()
R1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [44032 2009-07-14] ()
R1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [24576 2009-07-14] ()
R3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1684928 2014-01-24] ()
R1 Null; C:\Windows\System32\Drivers\Null.sys [6144 2009-07-14] ()
R3 NVHDA; C:\Windows\System32\drivers\nvhda64v.sys [174184 2011-03-03] ()
R3 nvlddmkm; C:\Windows\System32\DRIVERS\nvlddmkm.sys [14349632 2012-03-15] ()
S3 nvraid; C:\Windows\system32\drivers\nvraid.sys [148352 2012-03-08] ()
S3 nvstor; C:\Windows\system32\drivers\nvstor.sys [166272 2012-03-08] ()
S3 nv_agp; C:\Windows\system32\drivers\nv_agp.sys [122960 2009-07-14] ()
S3 ohci1394; C:\Windows\system32\drivers\ohci1394.sys [72832 2009-07-14] ()
S3 Parport; C:\Windows\system32\drivers\parport.sys [97280 2009-07-14] ()
R0 partmgr; C:\Windows\System32\drivers\partmgr.sys [75120 2012-03-17] ()
R0 pci; C:\Windows\System32\drivers\pci.sys [184704 2010-11-21] ()
S3 pciide; C:\Windows\system32\drivers\pciide.sys [12352 2009-07-14] ()
S3 pcmcia; C:\Windows\system32\drivers\pcmcia.sys [220752 2009-07-14] ()
R0 pcw; C:\Windows\System32\drivers\pcw.sys [50768 2009-07-14] ()
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [651264 2009-07-14] ()
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2012-03-08] ()
R3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [111104 2010-11-21] ()
S3 Processor; C:\Windows\system32\drivers\processr.sys [60416 2009-07-14] ()
R1 Psched; C:\Windows\System32\DRIVERS\pacer.sys [131584 2010-11-21] ()
S3 ql2300; C:\Windows\system32\drivers\ql2300.sys [1524816 2009-07-14] ()
S3 ql40xx; C:\Windows\system32\drivers\ql40xx.sys [128592 2009-07-14] ()
S3 QWAVEdrv; C:\Windows\system32\drivers\qwavedrv.sys [46592 2009-07-14] ()
S3 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [14848 2009-07-14] ()
R3 RasAgileVpn; C:\Windows\System32\DRIVERS\AgileVpn.sys [60416 2009-07-14] ()
R3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [129536 2010-11-21] ()
R3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [92672 2009-07-14] ()
R3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [83968 2009-07-14] ()
R1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [309248 2010-11-21] ()
S3 rdpbus; C:\Windows\system32\drivers\rdpbus.sys [24064 2009-07-14] ()
R1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [7680 2009-07-14] ()
R1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [7680 2009-07-14] ()
R1 RDPREFMP; C:\Windows\System32\drivers\rdprefmp.sys [8192 2009-07-14] ()
S3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [210944 2012-04-28] ()
R0 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [213888 2010-11-21] ()
R2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [76800 2009-07-14] ()
R3 RTL8167; C:\Windows\System32\DRIVERS\Rt64win7.sys [676968 2012-02-16] ()
S3 sbp2port; C:\Windows\system32\drivers\sbp2port.sys [103808 2010-11-21] ()
S3 scfilter; C:\Windows\System32\DRIVERS\scfilter.sys [29696 2010-11-21] ()
R2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [23040 2009-06-10] ()
S3 Serenum; C:\Windows\system32\drivers\serenum.sys [23552 2009-07-14] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] ()
S3 sermouse; C:\Windows\system32\drivers\sermouse.sys [26624 2009-07-14] ()
S3 sffdisk; C:\Windows\system32\drivers\sffdisk.sys [14336 2009-07-14] ()
S3 sffp_mmc; C:\Windows\system32\drivers\sffp_mmc.sys [13824 2009-07-14] ()
S3 sffp_sd; C:\Windows\system32\drivers\sffp_sd.sys [14336 2010-11-21] ()
S3 sfloppy; C:\Windows\system32\drivers\sfloppy.sys [16896 2009-07-14] ()
S3 SiSRaid2; C:\Windows\system32\drivers\SiSRaid2.sys [43584 2009-07-14] ()
S3 SiSRaid4; C:\Windows\system32\drivers\sisraid4.sys [80464 2009-07-14] ()
S3 Smb; C:\Windows\System32\DRIVERS\smb.sys [93184 2009-07-14] ()
R0 spldr; C:\Windows\System32\Drivers\spldr.sys [19008 2009-07-14] ()
R3 srv; C:\Windows\System32\DRIVERS\srv.sys [467456 2012-03-08] ()
R3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [410112 2012-03-08] ()
R3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [168448 2012-03-08] ()
S3 stexstor; C:\Windows\system32\drivers\stexstor.sys [24656 2009-07-14] ()
R3 StillCam; C:\Windows\system32\drivers\serscan.sys [12288 2009-07-14] ()
R3 swenum; C:\Windows\system32\drivers\swenum.sys [12496 2009-07-14] ()
R0 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1903552 2013-09-08] ()
S3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1903552 2013-09-08] ()
R2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [45568 2012-10-03] ()
S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [15872 2009-07-14] ()
S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [23552 2012-02-17] ()
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [119296 2010-11-21] ()
R1 TermDD; C:\Windows\system32\drivers\termdd.sys [63360 2010-11-21] ()
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [39936 2013-06-15] ()
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [59392 2010-11-21] ()
S3 TsUsbGD; C:\Windows\system32\drivers\TsUsbGD.sys [31232 2010-11-21] ()
R3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [125440 2010-11-21] ()
S3 uagp35; C:\Windows\system32\drivers\uagp35.sys [64080 2009-07-14] ()
S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [328192 2010-11-21] ()
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [64592 2009-07-14] ()
R3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [48640 2010-11-21] ()
S3 UmPass; C:\Windows\system32\drivers\umpass.sys [9728 2009-07-14] ()
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [99840 2013-11-27] ()
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [100864 2013-07-12] ()
R3 usbehci; C:\Windows\system32\drivers\usbehci.sys [53248 2013-11-27] ()
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [343040 2013-11-27] ()
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2013-11-27] ()
S3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [25088 2009-07-14] ()
R3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [91648 2012-03-08] ()
S3 usbuhci; C:\Windows\system32\drivers\usbuhci.sys [30720 2013-11-27] ()
R0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [36432 2009-07-14] ()
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [29184 2009-07-14] ()
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [29184 2009-07-14] ()
S3 vhdmp; C:\Windows\system32\drivers\vhdmp.sys [215936 2010-11-21] ()
S3 viaide; C:\Windows\system32\drivers\viaide.sys [17488 2009-07-14] ()
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [71552 2010-11-21] ()
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363392 2010-11-21] ()
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [296320 2012-03-08] ()
S3 vsmraid; C:\Windows\system32\drivers\vsmraid.sys [161872 2009-07-14] ()
S3 vwifibus; C:\Windows\System32\drivers\vwifibus.sys [24576 2009-07-14] ()
S3 WacomPen; C:\Windows\system32\drivers\wacompen.sys [27776 2009-07-14] ()
S3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] ()
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] ()
S3 Wd; C:\Windows\system32\drivers\wd.sys [21056 2009-07-14] ()
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [785624 2013-06-26] ()
R1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [12800 2009-07-14] ()
S3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [22096 2009-07-14] ()
S3 WmiAcpi; C:\Windows\system32\drivers\wmiacpi.sys [14336 2009-07-14] ()
S4 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [21504 2009-07-14] ()
R3 WSDPrintDevice; C:\Windows\System32\DRIVERS\WSDPrint.sys [23040 2009-07-14] ()
R3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [87040 2012-07-26] ()
R3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [198656 2012-07-26] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-20 18:06 - 2014-05-20 18:06 - 00034910 _____ () C:\Users\ClaudiaBM\Desktop\FRST.txt
2014-05-20 18:06 - 2014-05-20 18:06 - 00000000 ____D () C:\FRST
2014-05-20 18:04 - 2014-05-20 18:04 - 02067456 _____ (Farbar) C:\Users\ClaudiaBM\Desktop\FRST64.exe
2014-05-20 18:02 - 2014-05-20 18:02 - 00050477 _____ () C:\Users\ClaudiaBM\Desktop\Defogger.exe
2014-05-20 18:01 - 2014-05-20 18:01 - 00050477 _____ () C:\Users\ClaudiaBM\Downloads\Defogger.exe
2014-05-20 17:58 - 2014-05-20 17:58 - 00000000 _____ () C:\Users\ClaudiaBM\defogger_reenable
2014-05-20 16:57 - 2014-05-20 16:57 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-20 16:56 - 2014-05-20 16:56 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-20 16:56 - 2014-05-20 16:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-20 16:56 - 2014-05-20 16:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-20 16:56 - 2014-05-20 16:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-20 16:56 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-20 16:56 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-20 16:56 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-20 15:31 - 2014-05-20 18:03 - 00000000 ____D () C:\Users\ClaudiaBM\Desktop\Scan Reports
2014-05-19 20:15 - 2014-05-19 20:15 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Roaming\Avira
2014-05-19 20:12 - 2014-05-19 20:12 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-05-19 20:12 - 2014-05-19 20:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-05-19 20:12 - 2014-05-09 11:16 - 00130584 _____ () C:\Windows\system32\Drivers\avipbb.sys
2014-05-19 20:12 - 2014-05-09 11:16 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-19 20:12 - 2014-05-09 11:16 - 00028600 _____ () C:\Windows\system32\Drivers\avkmgr.sys
2014-05-19 20:11 - 2014-05-19 20:12 - 00000000 ____D () C:\ProgramData\Avira
2014-05-19 20:11 - 2014-05-19 20:12 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-05-19 20:11 - 2014-05-19 20:11 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-19 20:10 - 2014-05-19 20:10 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\maikxiyn.sys
2014-05-19 20:10 - 2014-05-19 20:10 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-05-19 15:05 - 2014-05-19 15:05 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DCD4C2B6-B74C-42FF-BE00-B6E15FCF2942}
2014-05-16 13:48 - 2014-05-16 13:48 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{6B63A15F-5B86-446B-BBC1-13A9905A547B}
2014-05-16 11:50 - 2014-05-16 11:51 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{38A6281A-CE4D-49AB-8EB1-6B92C7934E11}
2014-05-16 11:44 - 2014-05-16 11:44 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{726CAC8B-7CD2-4474-A811-B7DE2D928F8A}
2014-05-16 10:43 - 2014-05-16 10:43 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DEE49C21-495E-4C5D-AD08-89CCF24D9233}
2014-05-15 22:03 - 2014-05-15 22:03 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{306BA225-6894-411A-874F-9B7E03806C0C}
2014-05-15 21:49 - 2014-05-15 21:49 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{541F5826-7576-4E30-8EB9-9759BD4F8EB2}
2014-05-15 19:40 - 2014-05-19 17:40 - 15015585 _____ () C:\Users\ClaudiaBM\Desktop\BadSalzuflen-V1-CBM-22Mai2014.pptx
2014-05-15 09:18 - 2014-05-15 09:18 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{08E287C7-05FD-4804-BC24-21CF0FA07A93}
2014-05-14 19:11 - 2014-05-14 19:11 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{AD5D7DA7-B332-4CD4-A3F9-E00CEBB68A57}
2014-05-14 00:04 - 2014-05-14 00:04 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{258B0DA3-E398-4CB2-BEE7-C20DD3A77485}
2014-05-13 23:43 - 2014-05-13 23:43 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DC8D397C-DA80-45C6-BFA8-AE3042F5930E}
2014-05-13 08:47 - 2014-05-13 08:47 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{64BEA8B6-DBEB-44CB-B19F-87E123FCFD9A}
2014-05-12 15:45 - 2014-05-12 15:45 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{06E6A238-AE45-4D33-A24A-8292CC6D8629}
2014-05-11 12:07 - 2014-05-11 12:07 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{CDDB81A5-9B23-4A51-BFAE-2EA4F9F86515}
2014-05-10 15:26 - 2014-05-15 19:40 - 15186319 _____ () C:\Users\ClaudiaBM\Desktop\BadSalzuflen-CBM-22Mai2014.pptx
2014-05-10 10:19 - 2014-05-10 10:19 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{13AF6D6C-5312-4A51-8C14-040D1696D3D2}
2014-05-10 01:23 - 2014-05-10 01:23 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{9C44C75D-537C-4175-B349-BB753DFDD6ED}
2014-05-09 10:31 - 2014-05-09 10:32 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{4E8057A1-7822-42BC-8AA8-3A675B8B759C}
2014-05-09 09:15 - 2014-05-09 09:15 - 06103040 _____ () C:\Program Files (x86)\GUT75FB.tmp
2014-05-09 09:15 - 2014-05-09 09:15 - 00000000 ____D () C:\Program Files (x86)\GUM75FA.tmp
2014-05-08 21:26 - 2014-05-08 21:26 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{78D6C22F-A995-4D6E-8874-DC941F28717B}
2014-05-08 08:04 - 2014-05-08 08:04 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{3B5679BD-9819-4F90-A30D-6329EE90BE91}
2014-05-07 23:54 - 2014-05-07 23:54 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{28FDCCF2-506F-4F67-9388-4FED9E7BAB35}
2014-05-07 08:43 - 2014-05-07 08:43 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{E6048A28-D00B-43B5-B5E6-2DC9A6B211DC}
2014-05-07 08:01 - 2014-05-07 08:01 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{7FEE1F90-F0DF-4E5F-B15C-A2D1AD167DCD}
2014-05-06 12:56 - 2014-05-06 12:56 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{AE9DA068-5234-4213-92DE-2126EB951408}
2014-05-05 15:29 - 2014-05-05 15:30 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{8119EB14-1035-4703-951E-23685322776B}
2014-05-04 22:04 - 2014-05-04 22:05 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{E0F2A3EC-31EA-47DA-AD29-8F52EC2E8483}
2014-05-04 09:35 - 2014-05-04 09:35 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{F8D4DA8F-8710-4142-9764-D099B1C1567D}
2014-05-03 22:11 - 2014-05-03 22:11 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{4685CA8E-DBDE-471E-93F8-B9B620F19331}
2014-05-03 09:37 - 2014-05-03 09:38 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{FABD7B65-E763-41D4-A299-9E68BA3C77D4}
2014-05-02 23:11 - 2014-05-02 23:11 - 00061400 _____ () C:\Windows\system32\Drivers\b8b28b5013136215.sys
2014-05-02 21:05 - 2014-05-02 21:05 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{97A36883-DF6B-445B-8AE9-4DC3799E4DC4}
2014-05-02 08:29 - 2014-05-02 08:29 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{785E39B3-1B6F-412D-BA2E-7692E5B822EC}
2014-05-01 18:09 - 2014-05-01 18:09 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DF436DEF-5C0C-44C7-A595-1F71922D5F37}
2014-04-29 20:23 - 2014-04-29 20:23 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{8FA949D6-5805-413C-8D5F-99DCAFB5D771}
2014-04-29 08:36 - 2014-04-29 08:36 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{6A1792B7-1BB3-47BB-ABAA-5FBD350408B2}
2014-04-28 16:12 - 2014-04-28 16:12 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{374E3476-4095-4B60-B736-B6FBE1958713}
2014-04-27 17:06 - 2014-04-27 17:06 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{0D016069-5CA1-4305-A842-2D12CFEEBC0E}
2014-04-27 16:03 - 2014-04-27 16:03 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{3BA02B09-0147-46BA-A9A9-2A96026BD9FD}
2014-04-26 18:30 - 2014-04-26 18:30 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{8EC42371-76C6-468A-A5D8-134EF3150C3E}
2014-04-26 14:05 - 2014-04-26 14:05 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{6BC16C87-26BF-496E-AF00-6BD742AAB4E6}
==================== One Month Modified Files and Folders =======
2014-05-20 18:06 - 2014-05-20 18:06 - 00034910 _____ () C:\Users\ClaudiaBM\Desktop\FRST.txt
2014-05-20 18:06 - 2014-05-20 18:06 - 00000000 ____D () C:\FRST
2014-05-20 18:04 - 2014-05-20 18:04 - 02067456 _____ (Farbar) C:\Users\ClaudiaBM\Desktop\FRST64.exe
2014-05-20 18:03 - 2014-05-20 15:31 - 00000000 ____D () C:\Users\ClaudiaBM\Desktop\Scan Reports
2014-05-20 18:02 - 2014-05-20 18:02 - 00050477 _____ () C:\Users\ClaudiaBM\Desktop\Defogger.exe
2014-05-20 18:01 - 2014-05-20 18:01 - 00050477 _____ () C:\Users\ClaudiaBM\Downloads\Defogger.exe
2014-05-20 17:58 - 2014-05-20 17:58 - 00000000 _____ () C:\Users\ClaudiaBM\defogger_reenable
2014-05-20 17:58 - 2012-04-21 18:14 - 00000000 ____D () C:\Users\ClaudiaBM
2014-05-20 17:20 - 2012-04-21 19:15 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-20 16:57 - 2014-05-20 16:57 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-20 16:56 - 2014-05-20 16:56 - 00001104 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-05-20 16:56 - 2014-05-20 16:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-20 16:56 - 2014-05-20 16:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-20 16:56 - 2014-05-20 16:56 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-05-20 15:39 - 2013-03-22 18:38 - 00003950 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{78BAB05A-7040-4413-8834-B9F61C3A2970}
2014-05-20 10:59 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-20 10:59 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-20 10:51 - 2012-04-21 19:15 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-20 10:51 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-20 10:51 - 2009-07-14 06:51 - 00117869 _____ () C:\Windows\setupact.log
2014-05-20 08:40 - 2012-03-08 05:56 - 00000000 ____D () C:\ProgramData\truesuite
2014-05-19 20:18 - 2010-11-21 05:47 - 01155728 _____ () C:\Windows\PFRO.log
2014-05-19 20:15 - 2014-05-19 20:15 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Roaming\Avira
2014-05-19 20:12 - 2014-05-19 20:12 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-05-19 20:12 - 2014-05-19 20:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-05-19 20:12 - 2014-05-19 20:11 - 00000000 ____D () C:\ProgramData\Avira
2014-05-19 20:12 - 2014-05-19 20:11 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-05-19 20:12 - 2012-04-21 18:13 - 01953296 _____ () C:\Windows\WindowsUpdate.log
2014-05-19 20:11 - 2014-05-19 20:11 - 00000000 ____D () C:\ProgramData\Package Cache
2014-05-19 20:10 - 2014-05-19 20:10 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\maikxiyn.sys
2014-05-19 20:10 - 2014-05-19 20:10 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-05-19 19:52 - 2012-04-21 19:15 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-19 18:39 - 2012-03-08 05:22 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2014-05-19 18:39 - 2012-03-08 05:22 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2014-05-19 18:39 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-19 17:40 - 2014-05-15 19:40 - 15015585 _____ () C:\Users\ClaudiaBM\Desktop\BadSalzuflen-V1-CBM-22Mai2014.pptx
2014-05-19 15:13 - 2012-04-22 19:26 - 00000166 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-19 15:05 - 2014-05-19 15:05 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DCD4C2B6-B74C-42FF-BE00-B6E15FCF2942}
2014-05-16 13:48 - 2014-05-16 13:48 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{6B63A15F-5B86-446B-BBC1-13A9905A547B}
2014-05-16 11:51 - 2014-05-16 11:50 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{38A6281A-CE4D-49AB-8EB1-6B92C7934E11}
2014-05-16 11:44 - 2014-05-16 11:44 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{726CAC8B-7CD2-4474-A811-B7DE2D928F8A}
2014-05-16 10:43 - 2014-05-16 10:43 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DEE49C21-495E-4C5D-AD08-89CCF24D9233}
2014-05-15 22:03 - 2014-05-15 22:03 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{306BA225-6894-411A-874F-9B7E03806C0C}
2014-05-15 21:49 - 2014-05-15 21:49 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{541F5826-7576-4E30-8EB9-9759BD4F8EB2}
2014-05-15 19:40 - 2014-05-10 15:26 - 15186319 _____ () C:\Users\ClaudiaBM\Desktop\BadSalzuflen-CBM-22Mai2014.pptx
2014-05-15 09:18 - 2014-05-15 09:18 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{08E287C7-05FD-4804-BC24-21CF0FA07A93}
2014-05-14 21:08 - 2012-04-21 19:08 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\CrashDumps
2014-05-14 19:11 - 2014-05-14 19:11 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{AD5D7DA7-B332-4CD4-A3F9-E00CEBB68A57}
2014-05-14 00:04 - 2014-05-14 00:04 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{258B0DA3-E398-4CB2-BEE7-C20DD3A77485}
2014-05-13 23:43 - 2014-05-13 23:43 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DC8D397C-DA80-45C6-BFA8-AE3042F5930E}
2014-05-13 08:47 - 2014-05-13 08:47 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{64BEA8B6-DBEB-44CB-B19F-87E123FCFD9A}
2014-05-12 15:45 - 2014-05-12 15:45 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{06E6A238-AE45-4D33-A24A-8292CC6D8629}
2014-05-11 12:07 - 2014-05-11 12:07 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{CDDB81A5-9B23-4A51-BFAE-2EA4F9F86515}
2014-05-10 18:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-10 17:33 - 2012-04-21 20:27 - 00000000 ____D () C:\Users\ClaudiaBM\Documents\Vortraege und Praesentationen
2014-05-10 10:19 - 2014-05-10 10:19 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{13AF6D6C-5312-4A51-8C14-040D1696D3D2}
2014-05-10 01:23 - 2014-05-10 01:23 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{9C44C75D-537C-4175-B349-BB753DFDD6ED}
2014-05-09 11:16 - 2014-05-19 20:12 - 00130584 _____ () C:\Windows\system32\Drivers\avipbb.sys
2014-05-09 11:16 - 2014-05-19 20:12 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-09 11:16 - 2014-05-19 20:12 - 00028600 _____ () C:\Windows\system32\Drivers\avkmgr.sys
2014-05-09 10:32 - 2014-05-09 10:31 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{4E8057A1-7822-42BC-8AA8-3A675B8B759C}
2014-05-09 09:15 - 2014-05-09 09:15 - 06103040 _____ () C:\Program Files (x86)\GUT75FB.tmp
2014-05-09 09:15 - 2014-05-09 09:15 - 00000000 ____D () C:\Program Files (x86)\GUM75FA.tmp
2014-05-09 09:15 - 2012-04-21 19:15 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-09 09:15 - 2012-04-21 19:15 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-08 21:26 - 2014-05-08 21:26 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{78D6C22F-A995-4D6E-8874-DC941F28717B}
2014-05-08 08:04 - 2014-05-08 08:04 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{3B5679BD-9819-4F90-A30D-6329EE90BE91}
2014-05-07 23:54 - 2014-05-07 23:54 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{28FDCCF2-506F-4F67-9388-4FED9E7BAB35}
2014-05-07 08:43 - 2014-05-07 08:43 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{E6048A28-D00B-43B5-B5E6-2DC9A6B211DC}
2014-05-07 08:01 - 2014-05-07 08:01 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{7FEE1F90-F0DF-4E5F-B15C-A2D1AD167DCD}
2014-05-06 12:56 - 2014-05-06 12:56 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{AE9DA068-5234-4213-92DE-2126EB951408}
2014-05-05 15:30 - 2014-05-05 15:29 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{8119EB14-1035-4703-951E-23685322776B}
2014-05-04 22:05 - 2014-05-04 22:04 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{E0F2A3EC-31EA-47DA-AD29-8F52EC2E8483}
2014-05-04 17:12 - 2012-05-05 16:22 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-04 09:35 - 2014-05-04 09:35 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{F8D4DA8F-8710-4142-9764-D099B1C1567D}
2014-05-03 22:11 - 2014-05-03 22:11 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{4685CA8E-DBDE-471E-93F8-B9B620F19331}
2014-05-03 09:38 - 2014-05-03 09:37 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{FABD7B65-E763-41D4-A299-9E68BA3C77D4}
2014-05-02 23:11 - 2014-05-02 23:11 - 00061400 _____ () C:\Windows\system32\Drivers\b8b28b5013136215.sys
2014-05-02 21:05 - 2014-05-02 21:05 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{97A36883-DF6B-445B-8AE9-4DC3799E4DC4}
2014-05-02 08:29 - 2014-05-02 08:29 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{785E39B3-1B6F-412D-BA2E-7692E5B822EC}
2014-05-01 18:09 - 2014-05-01 18:09 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{DF436DEF-5C0C-44C7-A595-1F71922D5F37}
2014-04-29 20:23 - 2014-04-29 20:23 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{8FA949D6-5805-413C-8D5F-99DCAFB5D771}
2014-04-29 08:36 - 2014-04-29 08:36 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{6A1792B7-1BB3-47BB-ABAA-5FBD350408B2}
2014-04-28 16:12 - 2014-04-28 16:12 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{374E3476-4095-4B60-B736-B6FBE1958713}
2014-04-27 17:06 - 2014-04-27 17:06 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{0D016069-5CA1-4305-A842-2D12CFEEBC0E}
2014-04-27 16:03 - 2014-04-27 16:03 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{3BA02B09-0147-46BA-A9A9-2A96026BD9FD}
2014-04-26 18:30 - 2014-04-26 18:30 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{8EC42371-76C6-468A-A5D8-134EF3150C3E}
2014-04-26 14:05 - 2014-04-26 14:05 - 00000000 ____D () C:\Users\ClaudiaBM\AppData\Local\{6BC16C87-26BF-496E-AF00-6BD742AAB4E6}
Some content of TEMP:
====================
C:\Users\ClaudiaBM\AppData\Local\Temp\AskSLib.dll
C:\Users\ClaudiaBM\AppData\Local\Temp\avgnt.exe
C:\Users\ClaudiaBM\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\ClaudiaBM\AppData\Local\Temp\LMkRstPt.exe
C:\Users\ClaudiaBM\AppData\Local\Temp\siinst.exe
C:\Users\ClaudiaBM\AppData\Local\Temp\strings.dll
C:\Users\ClaudiaBM\AppData\Local\Temp\uninstall.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2012-03-08 05:26] - [2012-03-08 05:26] - 0296320 ____A () D41D8CD98F00B204E9800998ECF8427E
C:\Windows\System32\Drivers\volsnap.sys No Company Name <===== ATTENTION!
testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!
LastRegBack: 2014-05-19 19:26
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by ClaudiaBM at 2014-05-20 18:06:34
Running from C:\Users\ClaudiaBM\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.6.0.19120 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.8.800.174 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AuthenTec TrueAPI (Version: 1.3.0.116 - AuthenTec, Inc.) Hidden
Avira (HKLM-x32\...\{68e29fba-92b1-4f6f-a604-1d8679da3a9f}) (Version: 1.1.13.24161 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.13.24161 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: - AVM Berlin)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blasterball 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chronicles of Albian (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version: - Microsoft)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP LaserJet Professional M1130-M1210 MFP Series (HKLM\...\HP LaserJet Professional M1130-M1210 MFP Series) (Version: - )
HP LaserJet Professional M1210 MFP Series Fax Installer (HKLM\...\{E65099C4-9110-4C31-BD03-5C17EFB5FE92}) (Version: 1.1.0 - HP)
HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )
HP LinkUp (HKLM-x32\...\{DB3147AB-4024-4773-8EC0-A1FE5B44933D}) (Version: 2.01.028 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{D35B72B6-F0E4-462B-BDEB-E08032B3B681}) (Version: 8.7.4747.3786 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13880.3792 - Hewlett-Packard Company)
HP SimplePass PE 2011 (HKLM-x32\...\{00FF4EB6-6AAC-4E9D-A60A-8F388691BB27}) (Version: 5.3.0.194 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{34681D92-5958-406A-A654-1B57E7A7B3DC}) (Version: 6.0.4.1 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{7F2A11F4-EAE8-4325-83EC-E3E99F85169E}) (Version: 10.1.1000 - Hewlett-Packard)
HP Update (HKLM-x32\...\{DE77FE3F-A33D-499A-87AD-5FC406617B40}) (Version: 5.002.003.003 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.9.0.0 - Hewlett-Packard)
Intel(R) Identity Protection Technology 1.1.2.0 (HKLM-x32\...\{C01A86F5-56E7-101F-9BC9-E3F1025EB779}) (Version: 1.1.2.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3925 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.3925 - CyberLink Corp.) Hidden
Logitech Flow Scroll 4.0 (HKLM\...\Sn1) (Version: 4.00.33 - Logitech)
Logitech Unifying-Software 2.00 (HKLM\...\Logitech Unifying) (Version: 2.00.43 - Logitech)
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97 - WildTangent) Hidden
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
NVIDIA Grafiktreiber 296.28 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 296.28 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.62.312 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 296.28 (Version: 296.28 - NVIDIA Corporation) Hidden
NVIDIA Update 1.7.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.7.12 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.7.12 - NVIDIA Corporation) Hidden
PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5331 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.5331 - CyberLink Corp.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6463 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.4320 - CyberLink Corp.) Hidden
Remote Graphics Receiver (HKLM-x32\...\{16FC3056-90C0-4757-8A68-64D8DA846ADA}) (Version: 5.4.5 - Hewlett-Packard)
Scan To (HKLM\...\{E8A34AC8-0137-4515-A94B-0A0946DDC251}) (Version: 2.0.1 - HP)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97 - WildTangent) Hidden
VIP Access SDK (1.0.1.4) (HKLM-x32\...\VIP Access SDK) (Version: 1.0.1.4 - Symantec Inc.)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Restore Points =========================
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {23709A04-5952-41A3-A49E-E9752D9BD8B5} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-09] (Hewlett-Packard)
Task: {814EAFCB-C21F-4771-9D82-D8E3576D59E7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {937ED798-34CE-4C8C-950A-C4431D2E5367} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-21] (Google Inc.)
Task: {D2820FD8-D5FF-4369-A3C1-78EC6B9C5A76} - System32\Tasks\RMCreator => C:\Program Files (x86)\Hewlett-Packard\Recovery\Reminder.exe [2011-07-21] (CyberLink)
Task: {DEC69E51-9865-4ED9-A0BA-B7403602CC25} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-23] (Hewlett-Packard Company)
Task: {F2659E97-C28A-41BB-AF85-A992ED01E59E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-09] (Hewlett-Packard Company)
Task: {FC890021-582D-4BCC-ABE8-AA95C49F471E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-21] (Google Inc.)
Task: {FD3627B3-B593-4380-A53D-F3E17C0CDE85} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-09] (Hewlett-Packard Company)
Task: {FE9CB6B5-6FCE-4668-906E-06EA881B0518} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-09] (Hewlett-Packard Company)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-09-12 08:57 - 2013-08-02 04:12 - 00043520 _____ () C:\Windows\system32\CSRSRV.dll
2009-07-14 01:19 - 2009-07-14 03:41 - 00036864 _____ () C:\Windows\system32\pcwum.dll
2009-07-14 01:19 - 2009-07-14 03:41 - 00036864 _____ () C:\Windows\system32\pcwum.DLL
2009-07-14 01:19 - 2009-07-14 03:41 - 00036864 _____ () c:\windows\system32\pcwum.dll
2013-01-05 15:00 - 2012-08-31 16:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL
2013-01-27 15:41 - 2010-03-31 12:51 - 00407040 _____ () C:\Windows\System32\HPM1210LM.DLL
2012-04-21 20:48 - 2012-08-31 16:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL
2013-01-27 15:41 - 2010-03-31 12:51 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HPM1210PP.dll
2012-04-21 20:48 - 2012-08-31 16:02 - 01038336 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\HP1100GC.dll
2009-07-14 01:19 - 2009-07-14 03:41 - 00036864 _____ () C:\Windows\System32\pcwum.dll
2013-01-27 15:41 - 2010-03-31 12:51 - 03087872 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hpm1210su.dll
2013-01-27 15:41 - 2010-03-31 13:17 - 01038336 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\HPM1210GC.dll
2013-01-27 15:40 - 2010-04-28 17:49 - 00222720 _____ () C:\Windows\system32\m1210nwia.dll
2014-05-14 14:27 - 2014-05-14 14:27 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-05-19 17:54 - 2014-05-14 14:27 - 00049744 _____ () C:\Users\ClaudiaBM\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-05-14 14:27 - 2014-05-14 14:27 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/20/2014 06:04:16 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: Fehler beim Starten des Softwareschutzdiensts. 0xD0000022
6.1.7601.17514
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963} - 00000000000000FC,0x0053c008,00000000003CFFA0,0,00000000003D0FB0,4096,[0])". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
Ein Vergleichsbereichvolume wird automatisch ausgewählt
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
Ein Vergleichsbereichvolume wird automatisch ausgewählt
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
Ein Vergleichsbereichvolume wird automatisch ausgewählt
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
BeginPrepareSnapshot wird verarbeitet
Snapshotkontext
Kontext:
Ausführungskontext: System Provider
Volumename: \\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963}\
Snapshot-ID: {7b017393-a80c-4a30-9a8d-484cb3097c7d}
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
Überprüfen, ob das Volume vom Anbieter unterstützt wird
Kontext:
Ausführungskontext: System Provider
Volumename: \\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963}\
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)". hr = 0x80070005, Zugriff verweigert
.
Vorgang:
Überprüfen, ob das Volume vom Anbieter unterstützt wird
Kontext:
Ausführungskontext: System Provider
Volumename: \\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963}\
System errors:
=============
Error: (05/20/2014 06:04:16 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Software Protection" wurde mit folgendem Fehler beendet:
%%5
Error: (05/20/2014 04:57:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMSwissArmy" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (05/20/2014 04:57:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMSwissArmy" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (05/20/2014 10:56:49 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avipbb" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (05/20/2014 10:52:15 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/20/2014 10:52:13 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
avipbb
Error: (05/20/2014 10:51:12 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "avgntflt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%31
Error: (05/20/2014 10:51:14 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 20.05.2014 um 09:38:32 unerwartet heruntergefahren.
Error: (05/20/2014 08:46:52 AM) (Source: volsnap) (EventID: 3) (User: )
Description: \Device\HarddiskVolumeShadowCopy44C:C:
Error: (05/20/2014 08:45:46 AM) (Source: volsnap) (EventID: 3) (User: )
Description: \Device\HarddiskVolumeShadowCopy43C:C:
Microsoft Office Sessions:
=========================
Error: (05/20/2014 06:04:16 PM) (Source: Software Protection Platform Service) (EventID: 1001) (User: )
Description: 0xD00000226.1.7601.17514
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: DeviceIoControl(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963} - 00000000000000FC,0x0053c008,00000000003CFFA0,0,00000000003D0FB0,4096,[0])0x80070005, Zugriff verweigert
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
Ein Vergleichsbereichvolume wird automatisch ausgewählt
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
Ein Vergleichsbereichvolume wird automatisch ausgewählt
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
Ein Vergleichsbereichvolume wird automatisch ausgewählt
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
EndPrepareSnapshots wird verarbeitet
Kontext:
Ausführungskontext: System Provider
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
BeginPrepareSnapshot wird verarbeitet
Snapshotkontext
Kontext:
Ausführungskontext: System Provider
Volumename: \\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963}\
Snapshot-ID: {7b017393-a80c-4a30-9a8d-484cb3097c7d}
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
Überprüfen, ob das Volume vom Anbieter unterstützt wird
Kontext:
Ausführungskontext: System Provider
Volumename: \\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963}\
Error: (05/20/2014 08:46:52 AM) (Source: VSS) (EventID: 12289) (User: )
Description: CreateFileW(\\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963},0x80000000,0x00000003,...)0x80070005, Zugriff verweigert
Vorgang:
Überprüfen, ob das Volume vom Anbieter unterstützt wird
Kontext:
Ausführungskontext: System Provider
Volumename: \\?\Volume{fe80e65d-68d6-11e1-91ec-806e6f6e6963}\
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 6124.83 MB
Available physical RAM: 3592.64 MB
Total Pagefile: 12247.84 MB
Available Pagefile: 9649.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:918.4 GB) (Free:857.07 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:13.01 GB) (Free:1.6 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (Backup HDD) (Fixed) (Total:465.76 GB) (Free:371.66 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 6A2AE697)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=918 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=13 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 0124F00E)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-20 18:27:52
Windows 6.1.7601 Service Pack 1 x64
Running: Gmer-19357.exe
---- Services - GMER 2.1 ----
Service System32\Drivers\b8b28b5013136215.sys (*** hidden *** ) [BOOT] b8b28b5013136215 <-- ROOTKIT !!!
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215@ImagePath \SystemRoot\System32\Drivers\b8b28b5013136215.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215@Group Boot Bus Extender
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215@Tag 1
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215@DisplayName syshost.exe
Reg HKLM\SYSTEM\CurrentControlSet\services\b8b28b5013136215
Reg HKLM\SYSTEM\ControlSet002\services\b8b28b5013136215@ImagePath \SystemRoot\System32\Drivers\b8b28b5013136215.sys
Reg HKLM\SYSTEM\ControlSet002\services\b8b28b5013136215@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\services\b8b28b5013136215@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\services\b8b28b5013136215@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\b8b28b5013136215@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\b8b28b5013136215@Tag 1
Reg HKLM\SYSTEM\ControlSet002\services\b8b28b5013136215@DisplayName syshost.exe
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 20.05.2014 Suchlauf-Zeit: 17:49:08 Logdatei: Malware-Log-20Mai2014-17h30.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.05.20.05 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: ClaudiaBM Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 316416 Verstrichene Zeit: 48 Min, 55 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 1 Trojan.Agent, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSHOST32, , [7f261043f48765d15edc2a62ea19827e], Registrierungswerte: 1 Trojan.Agent, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SYSHOST32|ImagePath, "C:\Windows\Installer\{BB370133-93EB-E645-1CA8-B942FC71C504}\syshost.exe" /service, , [7f261043f48765d15edc2a62ea19827e] Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Ich hoffe, ich habe alles soweit richtig zusammengebaut - und würde mich sehr freuen, wenn mir Einer von Euch helfen könnte! Herzliche Grüße und hoffentlich bis bald, Heinz |
|
26.05.2014, 11:11
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Infektion mit TR/Rootkit.Gen und TR/Crypt.EPACK.4696 - Windows Update und Avira Echtzeitscan funktionieren nicht mehr Hallo und
__________________ Zitat:
 Lesestoff:Rootkit-Warnung Dein Computer wurde mit einem besonderen Schädling infiziert, der sich vor herkömmlichen Virenscannern und dem Betriebssystem selbst verstecken kann. Zusätzlich hat so ein Schädling meist auch Backdoor-Funktionalität, reißt also ganz bewußt Löcher durch alle Schutzmaßnahmen, damit er weiteren Schadcode nachladen oder die Daten, die er so sammelt, an die "bösen Jungs" weiterleiten kann. Was heißt das jetzt für dich?
__________________ |
|
26.05.2014, 11:19
| #3 |
| | Infektion mit TR/Rootkit.Gen und TR/Crypt.EPACK.4696 - Windows Update und Avira Echtzeitscan funktionieren nicht mehr Hallo cosinus,
__________________vielen Dank für die schnelle - wenn auch wenig beruhigende - Antwort. Vermutlich würde ich die Option "Neu aufsetzen" wählen, wie immer das dann auch genau funktioniert. Allerdings eine Frage vorab: Ich habe heute morgen - also nach der Infektion - alle wirklich relevanten Dateien mehr oder minder einzeln (also nicht ganze Ordner) auf einen USB Stick kopiert (nur .txt., .ppt., .pdf und ein paar Bilder). (Wie) kann ich sicher stellen, dass diese Dateien ungefährlich sind und auf dem neuen System weiter benutzt werden können? Vielen Dank für Dein Feedback! Beste Grüße, Heinz |
|
26.05.2014, 11:24
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Infektion mit TR/Rootkit.Gen und TR/Crypt.EPACK.4696 - Windows Update und Avira Echtzeitscan funktionieren nicht mehrZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
27.05.2014, 08:21
| #5 |
| | Infektion mit TR/Rootkit.Gen und TR/Crypt.EPACK.4696 - Windows Update und Avira Echtzeitscan funktionieren nicht mehr Ok. - werde mich mal intensiv mit dem Thema beschäftigen und mich dann wieder melden, könnte ein paar Stündchen dauern, fürchte ich ... Beste Grüße und vielen Dank, Heinz Hallo cosinus, Neuaufsetzen des Rechners hat funktioniert, jetzt schauen wir mal, wie es sich weiter entwickelt. Noch einmal vielen Dank für Deinen Einsatz und weiterhin gutes Gelingen! Beste Grüße, Heinz |
|
| Themen zu Infektion mit TR/Rootkit.Gen und TR/Crypt.EPACK.4696 - Windows Update und Avira Echtzeitscan funktionieren nicht mehr |
| antivir, antivirus, association, avg, avira, bingbar, computer, converter, defender, dxgkrnl, excel, fehler, flash player, google, home, problem, registry, rootkit, rundll, scan, security, software, stick, symantec, system, tunnel, updates, windows, windows updates |
Linear-Darstellung
