| |
| |||||||
Log-Analyse und Auswertung: Emailaccount sendet Spam an Adressen aus der KontaktlisteWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
02.06.2014, 23:21
| #1 |
| |  Emailaccount sendet Spam an Adressen aus der Kontaktliste Hallo, seit 2 Tagen sendet einer meiner yahoo-emailaccounts Spammails an meine Kontaktliste. Ich hab bereits zweimal das Passwort geändert, aber zumindest nach dem ersten Mal sind neue Spammails aufgetaucht. Die Mails variieren. Einige sind (angeblich) direkt von meinem Account, einige haben als Betreff meinen Account und einige wiederum sind von einem gleichnamigen Account, aber mit ".com" als Endung statt ".de". Als Antivirenprogramm verwende ich Antivir, als Browser Firefox und mein Mailprogramm ist Mozilla Thunderbird. Ich bin grad echt verunsichert und es hagelt von allen Seiten Beschwerden wegen der Mails. Hier sind die Logfiles, um die ihr bittet. Ich hoffe, das sind alle. Vielen Dank schonmal für eure Hilfe! Sven FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014 Ran by Sven (administrator) on KLAGGES on 02-06-2014 23:45:17 Running from C:\Users\Sven\Desktop Platform: Windows 8.1 Pro (Update 1) (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Lenovo.) C:\Windows\System32\ibmpmsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe (Lenovo Group Limited) C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe (LENOVO INCORPORATED.) C:\Program Files\Lenovo\SystemAgent\SystemAgentService.exe (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe (Lenovo) C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe (Maxthon) C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (LENOVO INCORPORATED.) C:\Program Files\Lenovo\QuickSnipService\QuickSnipService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe (Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe (Lenovo) C:\Program Files\Lenovo\QuickSnipService\QuickSnipInput.exe (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe () C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tposd.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe () C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\extapsup.exe (Realtek Semiconductor Corp.) C:\Windows\RtsCM64.exe (Lenovo.) C:\Windows\System32\TpShocks.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe () C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe (Lenovo) C:\Program Files\Lenovo\Lenovo Peer Connect\NalService.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe () C:\Program Files (x86)\Lenovo\OneLink Dock\onelinkpromgn.exe (Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Microsoft Corporation) C:\Windows\System32\WWAHost.exe (Microsoft Corporation) C:\Windows\WinStore\WSHost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe (Lenovo Group Limited) C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [LenovoOptMouseUpdate] => C:\Program Files\Lenovo\HOTKEY\extapsup.exe [255480 2013-06-20] (Lenovo Group Limited) HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [147160 2013-07-10] (Realtek Semiconductor Corp.) HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [7830328 2013-05-21] (Motorola Solutions, Inc.) HKLM\...\Run: [TpShocks] => C:\WINDOWS\system32\TpShocks.exe [384296 2013-10-28] (Lenovo.) HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\LibStartStub.dll [74288 2014-03-04] (Lenovo Corporation) HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [909016 2013-10-21] (Conexant Systems, Inc.) HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] () HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.) HKLM\...\Run: [LenovoNal] => C:\Program Files\Lenovo\Lenovo Peer Connect\NalService.exe [19960 2013-10-18] (Lenovo) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2810608 2014-04-07] (Synaptics Incorporated) HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [750320 2014-01-28] (Lenovo) HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-25] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [182352 2014-05-05] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-1282787320-2724149473-996529921-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Sven\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) HKU\S-1-5-21-1282787320-2724149473-996529921-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Akamai NetSession Interface] => C:\Users\Sven\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ThinkPad OneLink Dock Management.lnk ShortcutTarget: ThinkPad OneLink Dock Management.lnk -> C:\Program Files (x86)\Lenovo\OneLink Dock\onelinkpromgn.exe () Startup: C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13-comm.msn.com/?pc=LNJB HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13-comm.msn.com/?pc=LNJB HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad SearchScopes: HKLM - DefaultScope {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB SearchScopes: HKLM-x32 - DefaultScope {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LNJB SearchScopes: HKCU - DefaultScope {5149ECF0-834C-4817-8EBA-A7187FDA1FB0} URL = BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default FF Homepage: www.tagesschau.de FF NetworkProxy: "ftp", "94.228.205.33" FF NetworkProxy: "ftp_port", 8080 FF NetworkProxy: "http", "94.228.205.33" FF NetworkProxy: "http_port", 8080 FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co" FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "socks", "94.228.205.33" FF NetworkProxy: "socks_port", 8080 FF NetworkProxy: "ssl", "94.228.205.33" FF NetworkProxy: "ssl_port", 8080 FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files (x86)\Tools\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files\Spiele\die sieder 7\Data\Base\_Dbg\Bin\Release\orbit\npuplaypc.dll (Ubisoft) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: WOT - C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-15] FF Extension: Stealthy - C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default\Extensions\stealthyextension@gmail.com.xpi [2014-03-15] FF Extension: NoScript - C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\gygmpp3g.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-03-15] FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG) S3 AVControlCenter; C:\Program Files\Lenovo\Communications Utility\AVControlCenter32.exe [573488 2014-03-04] (Lenovo Corporation) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [124496 2014-05-05] (Avira Operations GmbH & Co. KG) S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.) R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.) R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [140016 2014-01-28] (Lenovo) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-16] (Intel Corporation) R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-08-29] (Intel Corporation) R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [198120 2013-08-01] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation) R2 Lenovo QuickSnip Service; C:\Program Files\lenovo\QuickSnipService\QuickSnipService.exe [219976 2013-12-02] (LENOVO INCORPORATED.) R2 Lenovo Settings Service; C:\Program Files\Lenovo\SettingsDependency\SettingsService.exe [2085184 2014-03-10] (Lenovo Group Limited) R2 Lenovo System Agent Service; C:\Program Files\lenovo\SystemAgent\SystemAgentService.exe [585032 2013-12-02] (LENOVO INCORPORATED.) S3 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [702512 2014-03-04] (Lenovo Corporation) R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-10] (Lenovo Group Limited) S3 LenovoEMCDiscovery; C:\Program Files\LenovoEMC\StorageConnector\LenovoEMCDiscovery.exe [1410888 2014-04-08] (LenovoEMC Products USA, LLC) R2 lnvDiscoveryWinSvc; C:\Program Files\Lenovo\Lenovo Peer Connect\LenovoDiscoverySvc.exe [21496 2013-10-18] (Lenovo) R2 LocationTaskManager; C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe [468288 2013-12-11] () S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1662424 2014-02-19] () R2 MaxthonUpdateSvc; C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [1844024 2013-12-18] (Maxthon) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2014-01-08] () R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software) S2 QuickControlMasterSvc; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [59440 2013-12-16] (Lenovo Group Limited) R3 QuickControlService; C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe [319024 2013-12-16] (Lenovo Group Limited) S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [24120 2014-02-21] () S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation) S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3674864 2014-01-08] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-25] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [131576 2014-02-25] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG) S3 AX88772; C:\Windows\system32\DRIVERS\ax88772.sys [113864 2013-07-18] (ASIX Electronics Corp.) S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider) R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [121616 2014-03-13] (BlueStack Systems) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) S3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-23] (Motorola Solutions, Inc.) R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1386296 2013-08-19] (Motorola Solutions, Inc.) R0 Fastboot; C:\Windows\System32\DRIVERS\fastboot.sys [65928 2014-01-28] (Windows (R) Win 7 DDK provider) S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation) S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation) S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [117192 2013-08-29] (Intel Corporation) R3 INETMON; C:\WINDOWS\System32\Drivers\INETMON.sys [29088 2013-08-01] () R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-11] (Microsoft Corporation) R3 ISCT; C:\Windows\System32\drivers\ISCTD64.sys [46568 2013-08-01] () S3 kbldfltr; C:\Windows\System32\drivers\kbldfltr.sys [22272 2013-10-07] (Microsoft Corporation) S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-02] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation) R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation) S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation) R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3610592 2014-01-28] (Intel Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation) S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924504 2014-02-22] (Microsoft Corporation) R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [418008 2013-06-24] (Realsil Semiconductor Corporation) R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8247512 2013-07-10] (Realtek Semiconductor Corp.) R3 SensorsHIDClassDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation) R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [230912 2013-08-22] (Microsoft Corporation) S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-26] (Microsoft Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-04-07] (Synaptics Incorporated) S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation) S3 SWIX64; C:\Program Files (x86)\Lenovo\System Update\tvsuhd64.sys [33856 2012-09-12] (Lenovo Group Limited) S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation) R0 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-03-13] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-02 23:45 - 2014-06-02 23:45 - 00000000 ____D () C:\Users\Sven\Desktop\FRST-OlderVersion 2014-06-02 23:43 - 2014-06-02 23:43 - 00050477 _____ () C:\Users\Sven\Desktop\Defogger.exe 2014-06-02 23:43 - 2014-06-02 23:43 - 00000470 _____ () C:\Users\Sven\Desktop\defogger_disable.log 2014-06-02 23:43 - 2014-06-02 23:43 - 00000000 _____ () C:\Users\Sven\defogger_reenable 2014-06-02 21:47 - 2014-06-02 21:47 - 00042192 _____ () C:\Users\Sven\Desktop\Addition.txt 2014-06-02 21:46 - 2014-06-02 23:45 - 00023244 _____ () C:\Users\Sven\Desktop\FRST.txt 2014-06-02 21:45 - 2014-06-02 23:45 - 00000000 ____D () C:\FRST 2014-06-02 19:24 - 2014-06-02 23:45 - 02068992 _____ (Farbar) C:\Users\Sven\Desktop\FRST64.exe 2014-06-02 19:12 - 2014-06-02 19:13 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-06-02 19:10 - 2014-06-02 19:10 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-02 19:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-06-02 19:10 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-06-02 19:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-06-02 19:09 - 2014-06-02 19:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sven\Desktop\mbam-setup-2.0.2.1012.exe 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf 2014-05-22 22:41 - 2014-05-22 22:43 - 69613920 _____ (CANON INC.) C:\Users\Sven\Desktop\dppw31415.exe 2014-05-22 22:29 - 2014-05-22 22:29 - 00000000 ____D () C:\Users\Public\Documents\Canon MyCameraFiles 2014-05-22 22:28 - 2014-05-22 22:28 - 00000000 ____D () C:\ProgramData\Canon_Inc_IC 2014-05-22 14:27 - 2014-05-22 14:27 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp 2014-05-22 12:02 - 2014-05-25 13:25 - 00005110 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for KLAGGES-Sven Klagges 2014-05-20 23:04 - 2014-05-20 23:04 - 00001350 _____ () C:\Users\Public\Desktop\PDF-Viewer.lnk 2014-05-20 23:04 - 2014-05-20 23:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer 2014-05-20 23:00 - 2014-05-20 23:01 - 16587248 _____ (Tracker Software Products Ltd ) C:\Users\Sven\Desktop\PDFX142Vwer.exe 2014-05-19 21:25 - 2014-05-19 21:26 - 53746227 _____ () C:\Users\Sven\Desktop\Marteria - Welt der Wunder [Offizielles Video].wmv 2014-05-16 15:09 - 2014-04-09 00:46 - 00086688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt_map.dll 2014-05-16 15:09 - 2014-04-09 00:46 - 00028320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mrt100.dll 2014-05-16 15:09 - 2014-04-08 20:54 - 00080032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt_map.dll 2014-05-16 15:09 - 2014-04-08 20:54 - 00026784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mrt100.dll 2014-05-16 15:09 - 2014-03-24 04:30 - 00257880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2014-05-16 15:09 - 2014-03-24 04:30 - 00123224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2014-05-16 15:09 - 2014-03-24 04:27 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2014-05-16 15:09 - 2014-03-13 09:42 - 00308224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wusa.exe 2014-05-16 15:09 - 2014-03-13 08:51 - 00305152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wusa.exe 2014-05-15 20:54 - 2014-05-15 20:57 - 139096929 _____ () C:\Users\Sven\Desktop\7_Tage_.wmv 2014-05-15 19:07 - 2014-05-15 19:20 - 75553860 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.avi 2014-05-15 19:07 - 2014-05-15 19:12 - 236166224 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.mp4 2014-05-15 17:56 - 2014-04-11 12:03 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll 2014-05-15 17:56 - 2014-04-11 12:03 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2014-05-15 17:56 - 2014-04-11 10:25 - 00419928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll 2014-05-15 17:56 - 2014-04-11 08:04 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll 2014-05-15 17:56 - 2014-04-11 07:53 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe 2014-05-15 17:56 - 2014-04-11 07:22 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll 2014-05-15 17:56 - 2014-04-11 05:54 - 00201728 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll 2014-05-15 17:56 - 2014-04-11 05:36 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2014-05-15 17:56 - 2014-04-11 05:24 - 13288960 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2014-05-15 17:56 - 2014-04-11 05:06 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe 2014-05-15 17:56 - 2014-04-11 05:05 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-05-15 17:56 - 2014-04-11 05:05 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll 2014-05-15 17:56 - 2014-04-11 05:02 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-05-15 17:56 - 2014-04-11 05:02 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe 2014-05-15 17:56 - 2014-04-11 05:01 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll 2014-05-15 17:56 - 2014-04-11 05:00 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2014-05-15 17:56 - 2014-04-11 04:59 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2014-05-15 17:56 - 2014-04-11 04:57 - 00190976 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll 2014-05-15 17:56 - 2014-04-11 04:56 - 00381440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll 2014-05-15 17:56 - 2014-04-11 04:55 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2014-05-15 17:56 - 2014-04-11 04:53 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2014-05-15 17:56 - 2014-04-11 04:52 - 03464192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2014-05-15 17:56 - 2014-04-11 04:46 - 01705472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll 2014-05-15 17:56 - 2014-04-11 04:36 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll 2014-05-15 17:56 - 2014-04-11 04:34 - 00754688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2014-05-15 17:56 - 2014-04-11 04:29 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll 2014-05-15 17:56 - 2014-04-11 04:25 - 00921088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2014-05-15 17:55 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-05-15 17:55 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-05-15 17:55 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2014-05-15 17:55 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2014-05-15 17:54 - 2014-03-27 11:12 - 21225584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2014-05-15 17:54 - 2014-03-27 09:48 - 18679728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Stoffkommode 2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Reli Examensarbeit Evolution und Schöpfung 2014-05-13 23:04 - 2014-05-15 21:04 - 00000000 ____D () C:\Users\Sven\Documents\Privates 2014-05-13 23:04 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Referendariat 2014-05-13 23:03 - 2014-05-13 23:04 - 00000000 ____D () C:\Users\Sven\Documents\Gemeinde & Co 2014-05-13 23:02 - 2014-05-13 23:03 - 00000000 ____D () C:\Users\Sven\Documents\E-Books 2014-05-13 23:01 - 2014-05-13 23:02 - 00000000 ____D () C:\Users\Sven\Documents\CD-DVD Images 2014-05-13 23:00 - 2014-05-13 23:01 - 00000000 ____D () C:\Users\Sven\Documents\Brennprojekte 2014-05-13 23:00 - 2014-05-13 23:00 - 00000000 ____D () C:\Users\Sven\Documents\Bewerbungen 2014-05-13 20:15 - 2014-05-13 20:27 - 377560045 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.wmv 2014-05-13 20:02 - 2014-05-13 20:14 - 370281562 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.avi 2014-05-13 18:30 - 2014-05-13 18:30 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-05-10 18:08 - 2014-05-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2014-06-02 23:45 - 2014-06-02 23:45 - 00000000 ____D () C:\Users\Sven\Desktop\FRST-OlderVersion 2014-06-02 23:45 - 2014-06-02 21:46 - 00023244 _____ () C:\Users\Sven\Desktop\FRST.txt 2014-06-02 23:45 - 2014-06-02 21:45 - 00000000 ____D () C:\FRST 2014-06-02 23:45 - 2014-06-02 19:24 - 02068992 _____ (Farbar) C:\Users\Sven\Desktop\FRST64.exe 2014-06-02 23:45 - 2014-03-15 20:19 - 00000000 ____D () C:\Users\Sven\AppData\Local\Temp 2014-06-02 23:43 - 2014-06-02 23:43 - 00050477 _____ () C:\Users\Sven\Desktop\Defogger.exe 2014-06-02 23:43 - 2014-06-02 23:43 - 00000470 _____ () C:\Users\Sven\Desktop\defogger_disable.log 2014-06-02 23:43 - 2014-06-02 23:43 - 00000000 _____ () C:\Users\Sven\defogger_reenable 2014-06-02 23:43 - 2014-03-15 20:18 - 00000000 ____D () C:\Users\Sven 2014-06-02 23:35 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-06-02 21:47 - 2014-06-02 21:47 - 00042192 _____ () C:\Users\Sven\Desktop\Addition.txt 2014-06-02 19:45 - 2014-01-28 06:07 - 02091567 _____ () C:\WINDOWS\WindowsUpdate.log 2014-06-02 19:31 - 2014-03-15 20:24 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1282787320-2724149473-996529921-1001 2014-06-02 19:13 - 2014-06-02 19:12 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-06-02 19:10 - 2014-06-02 19:10 - 00001125 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-02 19:10 - 2014-06-02 19:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-02 19:09 - 2014-06-02 19:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sven\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-02 17:48 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness 2014-06-02 16:50 - 2014-03-17 01:36 - 00000000 __RDO () C:\Users\Sven\SkyDrive 2014-06-02 16:50 - 2014-03-15 20:19 - 00000466 _____ () C:\Users\Sven\AppData\Local\RegisteredPackageInformation.xml 2014-06-02 08:01 - 2014-03-15 20:20 - 00152064 _____ () C:\WINDOWS\SysWOW64\Xui.trf 2014-06-02 08:01 - 2014-01-28 06:16 - 05795556 _____ () C:\Users\Public\CAFADEBUG.log 2014-06-02 07:54 - 2014-03-15 20:19 - 00000000 ____D () C:\Users\Sven\AppData\Roaming\Nitro PDF 2014-06-01 22:34 - 2013-08-22 16:46 - 00037621 _____ () C:\WINDOWS\setupact.log 2014-06-01 22:32 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-06-01 22:31 - 2013-10-07 20:23 - 02185102 _____ () C:\WINDOWS\PFRO.log 2014-05-31 14:05 - 2014-01-28 15:01 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat 2014-05-31 14:05 - 2014-01-28 15:01 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat 2014-05-31 14:05 - 2013-10-07 20:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-05-31 13:54 - 2014-03-27 21:38 - 00223232 ___SH () C:\Users\Sven\Desktop\Thumbs.db 2014-05-28 22:46 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-05-28 20:35 - 2014-03-18 15:46 - 00000000 ____D () C:\Users\Sven\AppData\Local\CrashDumps 2014-05-28 10:09 - 2014-03-15 20:19 - 00000000 ____D () C:\Users\Sven\AppData\Local\Packages 2014-05-27 23:58 - 2014-03-17 00:38 - 00000000 ____D () C:\Users\Sven\Documents\emails 2014-05-25 13:25 - 2014-05-22 12:02 - 00005110 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for KLAGGES-Sven Klagges 2014-05-25 11:15 - 2014-01-28 06:26 - 00000000 ____D () C:\WINDOWS\System32\Tasks\Lenovo 2014-05-22 22:52 - 2014-05-22 22:52 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf 2014-05-22 22:43 - 2014-05-22 22:41 - 69613920 _____ (CANON INC.) C:\Users\Sven\Desktop\dppw31415.exe 2014-05-22 22:29 - 2014-05-22 22:29 - 00000000 ____D () C:\Users\Public\Documents\Canon MyCameraFiles 2014-05-22 22:29 - 2014-04-12 23:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities 2014-05-22 22:29 - 2014-04-12 23:48 - 00000000 ____D () C:\Program Files (x86)\Canon 2014-05-22 22:28 - 2014-05-22 22:28 - 00000000 ____D () C:\ProgramData\Canon_Inc_IC 2014-05-22 22:28 - 2014-04-12 23:50 - 00000000 ____D () C:\Users\Sven\AppData\Roaming\Canon 2014-05-22 14:27 - 2014-05-22 14:27 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp 2014-05-22 06:54 - 2014-03-19 19:10 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-05-22 06:54 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\System 2014-05-22 06:54 - 2013-08-22 15:25 - 00000167 _____ () C:\WINDOWS\win.ini 2014-05-22 06:50 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared 2014-05-21 23:19 - 2014-03-22 19:26 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-05-21 23:18 - 2014-03-22 19:26 - 93223848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2014-05-21 22:50 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache 2014-05-21 06:09 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender 2014-05-21 00:05 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-05-20 23:04 - 2014-05-20 23:04 - 00001350 _____ () C:\Users\Public\Desktop\PDF-Viewer.lnk 2014-05-20 23:04 - 2014-05-20 23:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange PDF Viewer 2014-05-20 23:03 - 2014-03-16 22:00 - 00000000 ____D () C:\Program Files (x86)\Tools 2014-05-20 23:01 - 2014-05-20 23:00 - 16587248 _____ (Tracker Software Products Ltd ) C:\Users\Sven\Desktop\PDFX142Vwer.exe 2014-05-20 23:01 - 2014-03-23 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-05-19 21:26 - 2014-05-19 21:25 - 53746227 _____ () C:\Users\Sven\Desktop\Marteria - Welt der Wunder [Offizielles Video].wmv 2014-05-16 15:29 - 2013-08-22 17:20 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-05-16 15:01 - 2014-03-15 20:19 - 00000000 ___RD () C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-16 15:01 - 2014-03-15 20:19 - 00000000 ___RD () C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-16 14:57 - 2014-03-15 20:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-16 09:20 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-05-16 09:20 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore 2014-05-16 09:20 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\SecureBootUpdates 2014-05-15 21:04 - 2014-05-13 23:04 - 00000000 ____D () C:\Users\Sven\Documents\Privates 2014-05-15 20:57 - 2014-05-15 20:54 - 139096929 _____ () C:\Users\Sven\Desktop\7_Tage_.wmv 2014-05-15 19:20 - 2014-05-15 19:07 - 75553860 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.avi 2014-05-15 19:12 - 2014-05-15 19:07 - 236166224 _____ () C:\Users\Sven\Desktop\7 Tage ... unter Muslimen _ 7 Tage _ NDR.mp4 2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Stoffkommode 2014-05-13 23:06 - 2014-05-13 23:06 - 00000000 ____D () C:\Users\Sven\Documents\Reli Examensarbeit Evolution und Schöpfung 2014-05-13 23:06 - 2014-05-13 23:04 - 00000000 ____D () C:\Users\Sven\Documents\Referendariat 2014-05-13 23:04 - 2014-05-13 23:03 - 00000000 ____D () C:\Users\Sven\Documents\Gemeinde & Co 2014-05-13 23:03 - 2014-05-13 23:02 - 00000000 ____D () C:\Users\Sven\Documents\E-Books 2014-05-13 23:02 - 2014-05-13 23:01 - 00000000 ____D () C:\Users\Sven\Documents\CD-DVD Images 2014-05-13 23:01 - 2014-05-13 23:00 - 00000000 ____D () C:\Users\Sven\Documents\Brennprojekte 2014-05-13 23:00 - 2014-05-13 23:00 - 00000000 ____D () C:\Users\Sven\Documents\Bewerbungen 2014-05-13 20:27 - 2014-05-13 20:15 - 377560045 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.wmv 2014-05-13 20:14 - 2014-05-13 20:02 - 370281562 _____ () C:\Users\Sven\Desktop\7 Tage... unter Juden _ 7 Tage _ NDR.avi 2014-05-13 19:55 - 2014-01-28 06:15 - 00000000 ____D () C:\ProgramData\Package Cache 2014-05-13 18:30 - 2014-05-13 18:30 - 00001164 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-05-13 18:30 - 2014-04-16 21:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-05-13 18:30 - 2014-04-16 21:24 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-05-12 07:26 - 2014-06-02 19:10 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-06-02 19:10 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-06-02 19:10 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2014-05-10 18:08 - 2014-05-10 18:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-06 06:40 - 2014-05-15 17:55 - 23544320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-05-06 05:25 - 2014-05-15 17:55 - 17382912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-05-06 05:00 - 2014-05-15 17:55 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2014-05-06 04:10 - 2014-05-15 17:55 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll Some content of TEMP: ==================== C:\Users\Sven\AppData\Local\Temp\avgnt.exe C:\Users\Sven\AppData\Local\Temp\fp_pl_pfs_installer.exe C:\Users\Sven\AppData\Local\Temp\KUIU.EXE C:\Users\Sven\AppData\Local\Temp\ose00000.exe C:\Users\Sven\AppData\Local\Temp\ose00001.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-06-01 22:50 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-06-2014 01
Ran by Sven at 2014-06-02 21:47:01
Running from C:\Users\Sven\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Absolute Reminder (HKLM-x32\...\{40F4FF7A-B214-4453-B973-080B09CED019}) (Version: 2.3.0.1 - Absolute Software)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKCU\...\Akamai) (Version: - Akamai Technologies, Inc)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 8.25.00 - )
Avira (HKLM-x32\...\{70a79d1f-686d-4d5c-962b-07aa1294eae0}) (Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.12.20002 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{FE5ABB0E-EDEA-4023-B0FB-9DEA39A98D76}) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)
Canon MP Navigator EX 3.0 (HKLM-x32\...\MP Navigator EX 3.0) (Version: - )
Canon MP550 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP550_series) (Version: - Canon Inc.)
Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC) (Version: 8.8.0.17 - Canon Inc.)
Clonk Rage (HKLM-x32\...\Clonk Rage) (Version: - RedWolf Design GmbH)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.9.0 - Conexant)
Definition Update for Microsoft Office 2013 (KB2760587) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{5A06C25A-366E-46CC-880E-3F904B634E9E}) (Version: - Microsoft)
Die Siedler 7 (HKLM-x32\...\{63860309-DA8A-4BAE-9EAE-CE1D6D79340C}) (Version: 1.12.1396 - Ubisoft)
Dolby Digital Plus Home Theater (HKLM\...\{7E3D8FA1-6092-469A-955B-68FC4A2C67CA}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Integrated Camera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10239 - Realtek Semiconductor Corp.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) PRO/Wireless Driver (Version: 16.10.0000.1228 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1335.5) (HKLM\...\{302600C1-6BDF-4FD1-1307-148929CC1385}) (Version: 3.1.1307.0362 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{B1AC3709-3E98-4F2C-A84E-4BCA2A452E64}) (Version: 4.2.40.2418 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{86b86e21-7c9b-4baa-b284-69ce4a918661}) (Version: 16.10.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.10.0.0307 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.31.8.1 - Intel Corporation) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 2.10 - )
Lenovo Dependency Package (HKLM-x32\...\Lenovo Dependency Package_is1) (Version: 1.6.18.0 - Lenovo Group Limited)
Lenovo Experience Improvement (HKLM\...\LenovoExperienceImprovement) (Version: 1.0.5.0 - Lenovo)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Peer Connect SDK (HKLM\...\{75C87855-9CBB-4892-B1A9-74C73A19CACA}_is1) (Version: 1.0.0.1 - Lenovo)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.04 - )
Lenovo QuickControl (HKLM-x32\...\{4855C42F-5197-4AAD-A50D-5066D2CC4647}) (Version: 2.00 - Lenovo Group Limited)
Lenovo Settings - Camera Audio (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 4.2.2.0 - Lenovo Corporation)
Lenovo Settings - Location Awareness (HKLM-x32\...\{C79D4402-E622-4922-9C02-89F9080BF081}_is1) (Version: 1.3.0.10 - Lenovo Group Limited)
Lenovo Settings Dependency Package (HKLM\...\{3694BA2E-BE31-4B7E-886B-A0B559E69D4D}_is1) (Version: 2.0.0.16 - Lenovo Group Limited)
Lenovo Settings UMDF driver (HKLM\...\{2BDC7413-65EA-4B99-8C4B-02F11075BE6D}_is1) (Version: 1.1.0.5 - Lenovo Group Limited)
Lenovo Solution Center (HKLM\...\{C51863E5-EB09-43A5-9D43-26A32587EEAC}) (Version: 2.4.002.00 - Lenovo Group Limited)
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
Lenovo Transition (HKLM\...\{660FFFA1-BC46-4B79-A3B5-E51D8964FF1F}) (Version: 1.0.002.00 - Lenovo Group Limited)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0012.00 - Lenovo Group Limited)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0011.00 - Lenovo)
LenovoEMC Storage Connector (HKLM\...\LenovoEMC) (Version: 1.1.2.26394 - LenovoEMC)
Locomotion (HKLM-x32\...\{77F45E76-E897-42CA-A9FE-5F56817D875C}) (Version: 1.00.000 - )
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Maxthon Cloud Browser (HKLM-x32\...\Maxthon3) (Version: 4.1.3.5000 - Maxthon International Limited)
Microsoft Access MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft DCF MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Excel MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Groove MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Lync MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office 32-bit Components 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared 32-bit MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Word MUI (German) 2013 (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
Nitro Pro 8 (HKLM\...\{84DAF9F1-513C-49F8-89D2-63CB3F4A7E39}) (Version: 8.5.7.1 - Nitro)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd)
RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 2.1.1.0 - Lenovo)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.21234 - Realtek Semiconductor Corp.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version: - Microsoft) Hidden
ThinkPad OneLink Dock (HKLM-x32\...\{8E1CACF5-2493-4950-9AD5-189903FE57E7}) (Version: 1.08.25 - Lenovo)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.7.40 - Synaptics Incorporated)
Thinkpad USB 3.0 Ethernet Adapter Driver (HKLM-x32\...\{D8102684-7BA1-4948-88B9-535F84E6E588}) (Version: 8.8.911.2013 - Lenovo)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.78.0.10 - Lenovo)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version: - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version: - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version: - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-001B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version: - Microsoft)
Update for Microsoft Excel 2013 (KB2880475) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{4BC9BBF4-A2FB-4DBA-ABEA-5526E62E3B4D}) (Version: - Microsoft)
Update for Microsoft Lync 2013 (KB2817678) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{237834D6-FA98-44E1-8739-ABD56DDADC59}) (Version: - Microsoft)
Update for Microsoft Lync 2013 (KB2880980) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E5ADC5AD-C469-4A96-A3F7-0D4644CF54FC}) (Version: - Microsoft)
Update for Microsoft Lync 2013 (KB2880980) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E5ADC5AD-C469-4A96-A3F7-0D4644CF54FC}) (Version: - Microsoft)
Update for Microsoft Lync 2013 (KB2880980) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{E5ADC5AD-C469-4A96-A3F7-0D4644CF54FC}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760344) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{EF77B4A6-DFEC-4010-A87D-9B6BF87FABEC}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2760544) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{62857CDD-2985-4939-91BA-19ED0B0031A5}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2768012) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{0814662C-FD28-4DE0-ACE5-EE50D1D6C8FB}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2817302) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{E79EFFDB-192A-4D9E-A2DB-C0F774E6EC32}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2826040) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{C4AEA56A-0759-4D08-9FAB-31A92137D0B8}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2837644) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D692E9FF-84BF-4F44-A0EA-D58ECE0D538E}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2863825) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{327EABFD-EDD3-44E7-AB47-7592DF33B719}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2863843) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{290D80DE-03AB-47EC-9402-108AF4CE4F66}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2863844) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{50F31E04-D56A-4159-BF36-CF3CE27DB30C}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880462) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{24584DD4-C680-4FEB-A464-D760C7A5B041}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880464) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{88B29AA5-71EE-4692-91E2-E89407F0B783}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880476) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D3FC5B59-0F86-4B9A-94DF-FC213DF4FA63}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880476) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D3FC5B59-0F86-4B9A-94DF-FC213DF4FA63}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880478) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{8116ED50-F1E7-49E1-9D8D-421497D34B0F}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880482) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{FB1E57CA-A425-48F5-B882-CFC0793823AE}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880482) 64-Bit Edition (HKLM\...\{90150000-0016-0407-1000-0000000FF1CE}_Office15.PROPLUS_{FB1E57CA-A425-48F5-B882-CFC0793823AE}) (Version: - Microsoft)
Update for Microsoft Office 2013 (KB2880482) 64-Bit Edition (HKLM\...\{90150000-0090-0407-1000-0000000FF1CE}_Office15.PROPLUS_{FB1E57CA-A425-48F5-B882-CFC0793823AE}) (Version: - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version: - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-00BA-0407-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version: - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version: - Microsoft)
Update for Microsoft OneDrive for Business (KB2880480) 64-Bit Edition (HKLM\...\{90150000-00C1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{663B7CD7-32AE-4AB5-8E20-12C0FA6963D4}) (Version: - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version: - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-00A1-0407-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version: - Microsoft)
Update for Microsoft OneNote 2013 (KB2817628) 64-Bit Edition (HKLM\...\{90150000-00C1-0000-1000-0000000FF1CE}_Office15.PROPLUS_{9367C385-2EF9-4BE3-8351-7D2AB0798A57}) (Version: - Microsoft)
Update for Microsoft Outlook 2013 (KB2880470) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{34A169EC-990A-4DAE-AC65-9F981158B7DB}) (Version: - Microsoft)
Update for Microsoft Outlook 2013 (KB2880470) 64-Bit Edition (HKLM\...\{90150000-001A-0407-1000-0000000FF1CE}_Office15.PROPLUS_{34A169EC-990A-4DAE-AC65-9F981158B7DB}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2878315) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{95F0CF54-BC3E-4C6F-B11D-89D6D8C6452E}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2013 (KB2878315) 64-Bit Edition (HKLM\...\{90150000-0018-0407-1000-0000000FF1CE}_Office15.PROPLUS_{95F0CF54-BC3E-4C6F-B11D-89D6D8C6452E}) (Version: - Microsoft)
Update for Microsoft Publisher 2013 (KB2726952) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{03B2C707-503D-4979-8322-CA92C45AD6B4}) (Version: - Microsoft)
Update for Microsoft Publisher 2013 (KB2726952) 64-Bit Edition (HKLM\...\{90150000-0019-0407-1000-0000000FF1CE}_Office15.PROPLUS_{03B2C707-503D-4979-8322-CA92C45AD6B4}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2013 (KB2817301) 64-Bit Edition (HKLM\...\{90150000-006E-0407-1000-0000000FF1CE}_Office15.PROPLUS_{8E5CD68A-CDF8-4930-88DF-B7778B1871A9}) (Version: - Microsoft)
Update for Microsoft Word 2013 (KB2878319) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{BC51FE30-3A56-4802-8D9E-E9BC05B56B49}) (Version: - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version: - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-001A-0407-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version: - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-001B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version: - Microsoft)
Update for Microsoft Word 2013 (KB2880455) 64-Bit Edition (HKLM\...\{90150000-012B-0407-1000-0000000FF1CE}_Office15.PROPLUS_{302A5BF1-9DB4-4204-988C-53073C15EF67}) (Version: - Microsoft)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows-Treiberpaket - Intel Corporation (iaStorA) HDC (08/01/2013 12.8.0.1016) (HKLM\...\C8A921233C0C441A4E4EAABC2AB08C872FD77A6E) (Version: 08/01/2013 12.8.0.1016 - Intel Corporation)
Windows-Treiberpaket - Intel hdc (07/25/2013 9.4.0.1023) (HKLM\...\87403FF3ADDFA1770936C9436A187AC3B9FBC8DE) (Version: 07/25/2013 9.4.0.1023 - Intel)
Windows-Treiberpaket - Intel System (07/25/2013 9.4.0.1023) (HKLM\...\BDBD400472735932E15286ACD00A1DA1856D2B6D) (Version: 07/25/2013 9.4.0.1023 - Intel)
Windows-Treiberpaket - Intel System (08/21/2013 9.4.0.1027) (HKLM\...\FC58A12A405BF6933FC97269FF68C969D128F381) (Version: 08/21/2013 9.4.0.1027 - Intel)
Windows-Treiberpaket - Intel USB (07/31/2013 9.4.0.1025) (HKLM\...\A6995A77D26D0B0292A9C3B4878836D232899FE0) (Version: 07/31/2013 9.4.0.1025 - Intel)
Windows-Treiberpaket - Lenovo 1.67.04.04 (11/07/2013 1.67.04.04) (HKLM\...\70FB73D983446AEE2932B0ED51A770D1BD1348DA) (Version: 11/07/2013 1.67.04.04 - Lenovo)
Windows-Treiberpaket - Synaptics (SmbDrv) System (10/23/2013 17.0.12.52) (HKLM\...\546FF7E8ABB3021DB74C663BFEAB0780589F2990) (Version: 10/23/2013 17.0.12.52 - Synaptics)
Windows-Treiberpaket - Synaptics (SynTP) Mouse (10/23/2013 17.0.12.52) (HKLM\...\D4AF752691BC44E5CA6E33BDDD57F0845B4AEBFE) (Version: 10/23/2013 17.0.12.52 - Synaptics)
==================== Restore Points =========================
01-06-2014 21:00:14 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {05334FF9-1CDA-4490-AD94-B0755297FB44} - System32\Tasks\Lenovo\LenovoDependencyVersionTask => C:\Program Files\lenovo\SystemAgent\DependencyVersion.exe [2013-12-02] ()
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {25739816-833E-4491-9EEC-CEAEA6D43B04} - System32\Tasks\Lenovo\LSC\LSCTaskService => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCTaskService.exe [2014-02-19] ()
Task: {258A02C5-BFD1-4B8A-BFCF-A9E49A48747D} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {542B2977-85AE-4FE2-A45D-C0B410AE9E04} - System32\Tasks\Lenovo\Lenovo Settings Power => Rundll32.exe "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.dll",PwrMgrBkGndMonitor
Task: {5A94C214-BD26-466C-AEB8-1D340589E949} - System32\Tasks\Microsoft\Windows\PLA\LSC Memory => Rundll32.exe C:\WINDOWS\system32\pla.dll,PlaHost "LSC Memory" "$(Arg0)"
Task: {69BB9B34-37B2-45E8-BA8F-77E6A74FE490} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6D06CDF9-F205-4A14-9195-0892C1366F63} - System32\Tasks\Lenovo\Experience Improvement => C:\Program Files\Lenovo\ExperienceImprovement\LenovoExperienceImprovement.exe [2013-09-06] (Lenovo)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {75FA41DE-05EF-4EBC-8074-DEA88CDA1242} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {8323D2F6-1585-4F3C-A86E-FED3DBD35B94} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {83D9DC2E-BFCB-490F-B1BC-3964C36C3775} - System32\Tasks\Lenovo\Dependency Package Auto Update => C:\Program Files\Lenovo\SystemAgent\AutoUpdate.exe [2013-12-02] ()
Task: {8409FF72-643C-481F-B604-911418A5B423} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {85D82A54-4049-45AF-86C7-5B0C5ED7EE1D} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {91A46576-4A74-46E7-A77A-95A7015ABAB5} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-19] (Lenovo)
Task: {9886A1D3-EF2A-464B-ADFF-2D34B7B03B6D} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\mxup.exe [2013-10-14] (Maxthon International ltd.)
Task: {9ACE9655-F1F9-424C-AFA6-129FE040094B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-05-21] (Microsoft Corporation)
Task: {9FD54121-2FFE-47F9-B550-2B8A5200D69E} - System32\Tasks\Microsoft Office 15 Sync Maintenance for KLAGGES-Sven Klagges => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2014-04-08] (Microsoft Corporation)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {B43EF720-147B-45C8-B9BD-42C6EFC68297} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {B4BB04DF-BA25-4264-BB38-D67B60C9EC7D} - System32\Tasks\Lenovo\Lenovo Transition Launcher => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [2013-09-05] ()
Task: {CB6E00AD-B0EF-46DA-9D59-6F9522B058B2} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D1C6A86A-7B1B-426D-9CA6-DDF1496A2444} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {D41EB82C-9148-4A31-9DA7-9BCF03F0D10A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DEC0A285-D8EB-48D5-B5BA-FCFCB072A52E} - System32\Tasks\Lenovo\LSC\LSCHardwareScanPostpone => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-02-19] ()
Task: {E529073A-7EB0-47FA-9A88-C176DEB5246E} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2014-02-19] ()
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EC5F0637-1B34-4BC3-8B03-7B12B1AA5AD0} - System32\Tasks\StartLenovoEMCDiscovery => C:\Program Files\LenovoEMC\StorageConnector\StartLenovoEMCDiscovery.cmd [2014-04-08] ()
Task: {F1DBCFC6-B7AA-4E3C-AF41-32FE8323F0A8} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
Task: {F1F512EF-E969-48CE-8322-F478E44F5BEE} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2014-02-19] (Lenovo)
==================== Loaded Modules (whitelisted) =============
2013-08-01 18:31 - 2013-08-01 18:31 - 00198120 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2013-08-01 18:31 - 2013-08-01 18:31 - 00054760 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2013-08-01 18:31 - 2013-08-01 18:31 - 00034792 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll
2014-03-17 01:57 - 2013-11-21 08:44 - 00117248 _____ () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.dll
2014-01-28 06:43 - 2013-12-11 15:36 - 00468288 _____ () C:\Program Files (x86)\Lenovo\LocationAware\loctaskmgr.exe
2014-01-28 06:44 - 2013-12-11 15:36 - 00013120 _____ () C:\Program Files (x86)\Lenovo\LocationAware\lpdagent.exe
2014-03-17 01:57 - 2013-11-21 08:44 - 00117248 _____ () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2013-09-05 18:28 - 2013-09-05 18:28 - 00292200 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
2014-04-05 11:49 - 2010-10-26 11:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2013-09-05 18:28 - 2013-09-05 18:28 - 00106856 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
2014-01-28 06:13 - 2013-10-28 17:48 - 00915968 _____ () C:\Program Files (x86)\Lenovo\OneLink Dock\onelinkpromgn.exe
2014-04-16 21:27 - 2014-02-25 11:41 - 00394808 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-01-28 06:40 - 2014-01-28 06:40 - 00033520 _____ () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll
2014-04-26 18:15 - 2014-04-26 18:15 - 00797696 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\66db718389f1cd2503053c09b3de857f\Windows.Networking.ni.dll
2014-04-26 18:15 - 2014-04-26 18:15 - 01282048 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Devices\bf5509cf3a0d2e3afbd0c33e9153ecbd\Windows.Devices.ni.dll
2014-04-26 18:15 - 2014-04-26 18:15 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\cf021988965369c551bb0987fe019862\Windows.Foundation.ni.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00138320 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-05-05 10:37 - 2014-05-05 10:37 - 00065616 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-01-28 06:11 - 2013-09-16 21:19 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2013-09-05 18:28 - 2013-09-05 18:28 - 00097128 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Config\1366\TransitionLib.dll
2013-09-05 18:28 - 2013-09-05 18:28 - 00101224 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\LUpdatePackage.dll
2014-04-16 21:28 - 2014-05-05 10:37 - 00049744 _____ () C:\Users\Sven\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-04-30 19:04 - 2014-04-30 19:04 - 03019888 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-04-30 19:04 - 2014-04-30 19:04 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-04-30 19:04 - 2014-04-30 19:04 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-05-10 18:08 - 2014-05-10 18:08 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\Users\Sven\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/02/2014 09:43:21 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 06:38:13 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 05:48:57 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 04:50:22 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 07:49:14 AM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/01/2014 10:34:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 16.10.0.0, Zeitstempel: 0x52cda7eb
Name des fehlerhaften Moduls: MurocApi.dll, Version: 16.10.0.0, Zeitstempel: 0x52cda6c5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002bcd8
ID des fehlerhaften Prozesses: 0xc90
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3
Vollständiger Name des fehlerhaften Pakets: ZeroConfigService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: ZeroConfigService.exe5
Error: (06/01/2014 10:33:03 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/01/2014 09:27:18 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/01/2014 06:00:19 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/01/2014 05:27:50 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
System errors:
=============
Error: (06/02/2014 05:49:15 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.26
registriert werden. Der Computer mit IP-Adresse 192.168.178.25 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (06/02/2014 05:49:05 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Canon - Printers - Canon MP550 series Printer
Error: (06/02/2014 05:00:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "pcicsa.sys" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/01/2014 10:42:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "pcicsa.sys" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/01/2014 10:35:16 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/01/2014 10:33:23 PM) (Source: DCOM) (EventID: 10016) (User: KLAGGES)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}KlaggesSvenS-1-5-21-1282787320-2724149473-996529921-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (06/01/2014 10:33:21 PM) (Source: DCOM) (EventID: 10016) (User: KLAGGES)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}KlaggesSvenS-1-5-21-1282787320-2724149473-996529921-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (06/01/2014 10:33:03 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/01/2014 10:32:12 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 01.06.2014 um 21:33:20 unerwartet heruntergefahren.
Error: (06/01/2014 03:23:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "pcicsa.sys" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (06/02/2014 09:43:21 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 06:38:13 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 05:48:57 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 04:50:22 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/02/2014 07:49:14 AM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/01/2014 10:34:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe16.10.0.052cda7ebMurocApi.dll16.10.0.052cda6c5c0000005000000000002bcd8c9001cf7dd8ac628f8fC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dll119168cd-e9cc-11e3-8278-f17b3b496181
Error: (06/01/2014 10:33:03 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/01/2014 09:27:18 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/01/2014 06:00:19 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
Error: (06/01/2014 05:27:50 PM) (Source: ISCTAgent) (EventID: 1000) (User: )
Description: ISCT - CAgentState::DisableHidMonitoring Unable to connect to the keyboard filter driver, error=0
==================== Memory info ===========================
Percentage of memory in use: 29%
Total physical RAM: 8108.03 MB
Available physical RAM: 5682.27 MB
Total Pagefile: 9388.03 MB
Available Pagefile: 6291.18 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (Windows8_OS) (Fixed) (Total:453.71 GB) (Free:314.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 658E0480)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 15 GB) (Disk ID: EE4C3036)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:43 on 02/06/2014 (Sven)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-03 00:03:57
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000031 WDC_WD5000LPVX-08V0TT5 rev.05.01A05 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Sven\AppData\Local\Temp\kwrdqpod.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff960000c8c00 15 bytes [00, 8E, 0B, 02, 80, 32, 6E, ...]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff960000c8c10 11 bytes [00, 41, FC, FF, C0, 7D, F9, ...]
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\WLANExt.exe[1172] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\System32\spoolsv.exe[1272] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ffd48461f6a 4 bytes [46, 48, FD, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1800] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ffd48461f82 4 bytes [46, 48, FD, 7F]
.text C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe[2584] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1484] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[6100] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[4344] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5696] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffd543f169a 4 bytes [3F, 54, FD, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffd543f16a2 4 bytes [3F, 54, FD, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffd543f181a 4 bytes [3F, 54, FD, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4216] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffd543f1832 4 bytes [3F, 54, FD, 7F]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [5512:2640] fffff9600088cb90
Thread C:\Windows\System32\SettingSyncHost.exe [7360:4500] 00007ffd48724b30
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
03.06.2014, 06:54
| #2 | |
| /// the machine /// TB-Ausbilder    | Emailaccount sendet Spam an Adressen aus der Kontaktliste hi,
__________________Zitat:
__________________ |
|
03.06.2014, 16:57
| #3 |
| | Emailaccount sendet Spam an Adressen aus der Kontaktliste Wie lange sollte ich denn dann warten? Also wie lange dauert es, bis auch Rückläufer etc. raus/ausgeschlossen sind?
__________________Und muss ich dann, um das einzuschätzen, nur Mails ernstnehmen, die direkt von meinem Account aus kommen? Ich meine, dass jemand jetzt die ganzen Kontakte hat und einfach einen Account verwendet, der meinem ähnelt, dagegen kann ich vermutlich nichts machen, oder? |
|
04.06.2014, 12:29
| #4 |
| /// the machine /// TB-Ausbilder | Emailaccount sendet Spam an Adressen aus der Kontaktliste Nein dagegen kannst Du nix machen, is aber selten. Ne Woche oder 2 sollten Rückläufer ausschliessen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.06.2014, 17:18
| #5 |
| | Emailaccount sendet Spam an Adressen aus der Kontaktliste Danke schonmal für die Hinweise so weit. Aber heute wollte ich auf eine Mail eines Freundes antworten und es kam eine Fehlermeldung und die Bitte eine Sicherheitsausnahmeregelung hinzuzufügen. Ein Bild davon habe ich angehängt, da ich es nicht geschafft habe es hier in den Text einzufügen. Hat mich stutzig gemacht. Ist das ein Zufall, oder kann es da einen Zusammenhang geben. Ich habe schon bei Yahoo geguckt, welche Angaben die machen. Das steht unter Einstellungen: "Ausgehend: SMTP smtp.mail.yahoo.com 465 SSL/TLS Normales Passwort" Scheint also eigentlich zu stimmen. Ich hab jetzt aber erstmal auf das Versenden verzichtet, war mir zu unsicher mit dieser Ausnahmeregelung. |
|
05.06.2014, 17:51
| #6 |
| /// the machine /// TB-Ausbilder | Emailaccount sendet Spam an Adressen aus der Kontaktliste Das kann die am besten der Support von Yahoo beantworten, kenne ich jetzt so auch nicht.
__________________ --> Emailaccount sendet Spam an Adressen aus der Kontaktliste |
|
06.06.2014, 14:57
| #7 |
| | Emailaccount sendet Spam an Adressen aus der Kontaktliste Die äußern sich nicht, aber inzwischen geht's wieder ohne die Fehlermeldung. Meldungen wegen Spamnachrichten sind auch weniger geworden und offenbar nach Montag Morgen keine mehr dazu gekommen, denn die letzten gemeldeten sind alle Sonntag oder Montag morgens versandt worden. Ich bin 4 Tage weg. Ich melde mich dann auf jeden Fall Dienstag einmal, ob in den 4 Tagen was passiert ist und hoffe, dass es das dann gewesen ist. Vielen Dank schonmal für die Hilfe, es hilft ja auch schon, wenn jemand mit Ahnung einem sagt, dass es offenbar halb so schlimm ist! |
|
07.06.2014, 06:07
| #8 |
| /// the machine /// TB-Ausbilder | Emailaccount sendet Spam an Adressen aus der Kontaktliste ok 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.06.2014, 20:11
| #9 |
| | Emailaccount sendet Spam an Adressen aus der Kontaktliste Moin, die letzten Tage ist es zum Glück ruhig geblieben. Ich wurde lediglich über eine Mail von Samstag informiert, die aber als Absender "meineAdresse"@yahoo.com hatte. Hast du ja schon gesagt, dass ich darauf keinen Einfluss nehmen kann. Ich hoffe, dass damit dann alles gut ist. Vielen Dank für die freundliche Betreuung! Muss ich jetzt noch etwas auf meinem Rechner wieder entfernen oder rückgängig machen? Grüße Sven |
|
11.06.2014, 19:59
| #10 |
| /// the machine /// TB-Ausbilder | Emailaccount sendet Spam an Adressen aus der Kontaktliste Dann räumen wir mal auf: Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.06.2014, 13:07
| #11 |
| | Emailaccount sendet Spam an Adressen aus der Kontaktliste Super, vielen Dank auch für die Tipps, ich werde euch weiterempfehlen! |
|
16.06.2014, 07:34
| #12 |
| /// the machine /// TB-Ausbilder | Emailaccount sendet Spam an Adressen aus der Kontaktliste Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Emailaccount sendet Spam an Adressen aus der Kontaktliste |
| .com, akamai, antivirus, association, avira, bildschirm, bluestacks, browser, excel, feedback, festplatte, firefox, flash player, homepage, mozilla, object, onedrive, outlook 2013, programm, pwmtr64v.dll, realtek, registry, rundll, scan, security, software, svchost.exe, system, taskmanager, tracker, usb, windows |
Linear-Darstellung
