| |
| |||||||
Log-Analyse und Auswertung: ScanTrack macht Probleme :/Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
11.06.2014, 17:58
| #1 |
| |  ScanTrack macht Probleme :/ Hallo, ich habe folgendes Problem, ich habe vor kurzem ausersehen scantrack heruntergeladen und anscheinend installiert nun macht es aber diverse Probleme wie mir übertrieben viele Ads zu öffnen was das surfen fast unmöglich macht . ich habe eure schritte soweit es geht befolgt und mir die programme "defogger" "frst" und "gmer" heruntergeladen. hier die logs frst: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-06-2014 01
Ran by lenovo (administrator) on LENOVO-PC on 11-06-2014 18:20:36
Running from C:\Users\lenovo\Desktop
Platform: Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Fuyu LIMITED) C:\ProgramData\WindowsProtectManger\wprotectmanager.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\ScanTack\updateScanTack.exe
() C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerofa.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe
() C:\Program Files (x86)\ScanTack\bin\ScanTack.PurBrowse64.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe
() C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2991856 2013-02-21] (Logitech, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35184 2008-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-05-05] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2009-12-22] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Diamondback] => C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe [226816 2009-10-09] ()
HKLM-x32\...\RunOnce: [upfst_de_37.exe] - C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe -runonce [3268600 2014-06-06] ()
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\.DEFAULT\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-21-1545926792-3371853682-890327128-1003\...\Run: [Browser Infrastructure Helper] => C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.exe [20760 2014-04-23] (Smartbar)
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\PROGRA~2\SupTab\SEARCH~2.DLL File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => "C:\PROGRA~2\SupTab\SEARCH~1.DLL" File Not Found
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpVFn36cGa_0q8n8QslwcAnngLpFpN0-aJ_ZXQ5j6BOHzEGt2QOsQvuN64uE6DfTy_m9tmQfJouBkHWzXS31BNtay0Gp9Lp8vvg,
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.qone8.com/?type=hp&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://start.qone8.com/?type=sc&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.qone8.com/web/?type=ds&ts=1402379129&from=tt4u&uid=HitachiXHTS545032B9A300_130530PBNL0417H5ZV3EX&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvoGn8gtqTfzRepcJ_g,&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvoGn8gtqTfzRepcJ_g,&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK02_ksL2_MLy1sX1iWGcO6-WQXsYLBdd-o1fzy-8Ty120u_iC5AzqemP4_awvNGcFbTO_uaFbDvncm7QAHknE2S9OSzf-JviROegWKWI-pfsIWOybpmOB5s1YDe8q3XWqpjO19soQLjgwK4ISOaFNq4W9D5H6SDtKoXfxOELq-XThQeB4xzxgTpLQR9QPi5quvmOhJOp3GkK4W3YlH8,&q={searchTerms}
BHO: Yahoo Community Smartbar (by Linkury)Engine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Yahoo Community Smartbar (by Linkury)Engine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
BHO-x32: ScanTack - {d332cff8-358e-4c9e-8af3-a08872ef22c1} - C:\Program Files (x86)\ScanTack\D12017C3-82E3-4D6D-B5D3-0C74A5F97D83.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-02-24]
FF HKLM-x32\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-03-12]
CHR Extension: (Logitech SetPoint) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd [2014-02-24]
CHR Extension: (Google Wallet) - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-20]
CHR HKLM-x32\...\Chrome\Extension: [edaibbiobngpbmeonadpbfafbkimjbdd] - C:\ProgramData\Logitech\LogiSmoothChromeExt.crx [2014-02-24]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-06-10]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG)
S2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
S3 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-15] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [575304 2009-11-17] (Lenovo Group Limited)
S2 LPTSystemUpdater; C:\Program Files (x86)\LPT\srpts.exe [33048 2014-04-23] ()
S3 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29263712 2008-11-25] (Microsoft Corporation)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-15] (Lenovo Group Limited)
R2 Update ScanTack; C:\Program Files (x86)\ScanTack\updateScanTack.exe [317728 2014-06-11] ()
R2 Util ScanTack; C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe [317728 2014-06-11] ()
R2 WindowsProtectManger; C:\ProgramData\WindowsProtectManger\wprotectmanager.exe [573344 2014-06-10] (Fuyu LIMITED)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 usbsmi; C:\Windows\System32\DRIVERS\SMIksdrv.sys [197376 2009-10-16] (SMI)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys [61112 2014-06-09] (StdLib)
R1 {9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64; C:\Windows\System32\drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys [61112 2014-06-09] (StdLib)
S3 ALSysIO; \??\C:\Users\lenovo\AppData\Local\Temp\ALSysIO64.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-11 18:20 - 2014-06-11 18:21 - 00019627 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:20 - 2014-06-11 18:20 - 00000000 ____D () C:\FRST
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-11 17:52 - 2014-06-11 17:52 - 00000000 ____D () C:\Program Files (x86)\LPT
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Smartbar
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\LPT
2014-06-11 17:42 - 2014-06-09 12:09 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
2014-06-11 03:26 - 2014-06-09 12:10 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 15:23 - 2014-06-10 15:23 - 00000368 _____ () C:\windows\PFRO.log
2014-06-10 07:46 - 2014-06-11 17:54 - 00000000 ____D () C:\Program Files (x86)\ScanTack
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\SupTab
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-10 07:45 - 2014-06-10 07:45 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\qone8
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:56 - 2014-06-10 01:05 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:41 - 2014-06-09 23:42 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2007-03-20 19:05 - 00073728 _____ (Razer Inc.) C:\windows\SysWOW64\Diamondback.cpl
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:54 - 2014-06-09 22:54 - 00000000 ____D () C:\Users\lenovo\AppData\Local\freeSOFTtoday
2014-06-09 22:22 - 2014-06-11 17:40 - 00000280 _____ () C:\windows\setupact.log
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 00:30 - 2014-06-11 17:50 - 00000000 ____D () C:\Users\lenovo\AppData\Local\fst_de_37
2014-06-09 00:30 - 2014-06-10 07:47 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-09 00:30 - 2014-06-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 21:35 - 2014-06-04 21:36 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:34 - 2014-06-04 21:39 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-05 07:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:50 - 2014-06-04 20:55 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:49 - 2014-06-04 22:31 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:19 - 2014-06-04 20:25 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:35 - 2014-06-04 21:36 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 18:33 - 2014-06-11 18:17 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-04 18:33 - 2014-06-10 20:22 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-04 18:33 - 2014-06-04 18:36 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 19:45 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:54 - 2014-05-27 15:57 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
==================== One Month Modified Files and Folders =======
2014-06-11 18:21 - 2014-06-11 18:20 - 00019627 _____ () C:\Users\lenovo\Desktop\FRST.txt
2014-06-11 18:21 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Temp
2014-06-11 18:20 - 2014-06-11 18:20 - 02081792 _____ (Farbar) C:\Users\lenovo\Desktop\FRST64.exe
2014-06-11 18:20 - 2014-06-11 18:20 - 00000000 ____D () C:\FRST
2014-06-11 18:19 - 2014-06-11 18:19 - 00050477 _____ () C:\Users\lenovo\Desktop\Defogger (1).exe
2014-06-11 18:19 - 2014-06-11 18:19 - 00000474 _____ () C:\Users\lenovo\Desktop\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000474 _____ () C:\Users\lenovo\Downloads\defogger_disable.log
2014-06-11 18:18 - 2014-06-11 18:18 - 00000000 _____ () C:\Users\lenovo\defogger_reenable
2014-06-11 18:18 - 2013-03-05 12:00 - 00000000 ____D () C:\Users\lenovo
2014-06-11 18:17 - 2014-06-11 18:17 - 00050477 _____ () C:\Users\lenovo\Downloads\Defogger.exe
2014-06-11 18:17 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Battle.net
2014-06-11 18:13 - 2009-07-14 04:34 - 00000715 _____ () C:\windows\win.ini
2014-06-11 18:11 - 2014-04-20 11:41 - 00000284 _____ () C:\windows\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05}.job
2014-06-11 18:11 - 2010-05-05 18:26 - 00497091 _____ () C:\FaceProv.log
2014-06-11 17:54 - 2014-06-10 07:46 - 00000000 ____D () C:\Program Files (x86)\ScanTack
2014-06-11 17:52 - 2014-06-11 17:52 - 00000000 ____D () C:\Program Files (x86)\LPT
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Smartbar
2014-06-11 17:51 - 2014-06-11 17:51 - 00000000 ____D () C:\Users\lenovo\AppData\Local\LPT
2014-06-11 17:50 - 2014-06-09 00:30 - 00000000 ____D () C:\Users\lenovo\AppData\Local\fst_de_37
2014-06-11 17:50 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-11 17:49 - 2014-02-20 21:07 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-11 17:49 - 2014-02-20 21:07 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-11 17:48 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-11 17:48 - 2009-07-14 06:45 - 00013424 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-11 17:44 - 2010-05-05 17:23 - 00345524 _____ () C:\windows\WindowsUpdate.log
2014-06-11 17:41 - 2010-05-05 18:13 - 00000000 ____D () C:\ProgramData\VeriFace
2014-06-11 17:40 - 2014-06-09 22:22 - 00000280 _____ () C:\windows\setupact.log
2014-06-11 17:40 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-11 05:25 - 2014-04-20 11:43 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-10 20:22 - 2014-06-04 18:33 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2014-06-10 17:29 - 2014-06-10 17:29 - 00000000 ____D () C:\Program Files (x86)\TeamSpeak 3 Client
2014-06-10 17:26 - 2014-06-10 17:26 - 27601296 _____ (TeamSpeak Systems GmbH) C:\Users\lenovo\Downloads\TeamSpeak3-Client-win32-3.0.14.exe
2014-06-10 15:23 - 2014-06-10 15:23 - 00000368 _____ () C:\windows\PFRO.log
2014-06-10 07:47 - 2014-06-09 00:30 - 00000306 __RSH () C:\ProgramData\ntuser.pol
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\SupTab
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\WindowsProtectManger
2014-06-10 07:46 - 2014-06-10 07:46 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-06-10 07:45 - 2014-06-10 07:45 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\qone8
2014-06-10 01:05 - 2014-06-09 23:56 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft Public Test
2014-06-09 23:58 - 2014-06-09 23:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft Public Test
2014-06-09 23:49 - 2010-05-05 09:06 - 00690574 _____ () C:\windows\system32\perfh007.dat
2014-06-09 23:49 - 2010-05-05 09:06 - 00143916 _____ () C:\windows\system32\perfc007.dat
2014-06-09 23:49 - 2009-07-14 07:13 - 01603176 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-09 23:42 - 2014-06-09 23:41 - 00005632 _____ () C:\windows\DPINST.LOG
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2014-06-09 23:41 - 2014-06-09 23:41 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-06-09 23:41 - 2010-05-05 17:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-09 23:40 - 2014-06-09 23:40 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\InstallShield
2014-06-09 23:30 - 2014-06-09 23:30 - 00813308 _____ () C:\Users\lenovo\Downloads\HealBot.zip
2014-06-09 22:54 - 2014-06-09 22:54 - 00000000 ____D () C:\Users\lenovo\AppData\Local\freeSOFTtoday
2014-06-09 22:22 - 2014-06-09 22:22 - 480190111 _____ () C:\windows\MEMORY.DMP
2014-06-09 22:22 - 2014-06-09 22:22 - 00000000 _____ () C:\windows\setuperr.log
2014-06-09 22:22 - 2014-03-23 01:53 - 00000000 ____D () C:\windows\Minidump
2014-06-09 12:10 - 2014-06-11 03:26 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}Gw64.sys
2014-06-09 12:09 - 2014-06-11 17:42 - 00061112 _____ (StdLib) C:\windows\system32\Drivers\{9acd1534-e8f8-40cb-b5ac-4996fe01175b}w64.sys
2014-06-09 00:30 - 2014-06-09 00:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst
2014-06-09 00:30 - 2009-07-14 05:20 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-06-09 00:30 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-06-05 12:56 - 2014-06-05 12:56 - 00700981 _____ () C:\Users\lenovo\Downloads\Titan.zip
2014-06-05 12:55 - 2014-06-05 12:55 - 00381411 _____ () C:\Users\lenovo\Downloads\Recount.zip
2014-06-05 07:09 - 2014-06-04 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-06-05 07:09 - 2014-02-20 23:54 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Winamp
2014-06-05 07:09 - 2010-05-05 17:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
2014-06-05 07:09 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-06-04 23:38 - 2014-06-04 23:38 - 00299562 _____ () C:\Users\lenovo\Downloads\Bartender4.zip
2014-06-04 23:29 - 2014-06-04 23:29 - 00142541 _____ () C:\Users\lenovo\Downloads\Bagnon.zip
2014-06-04 23:23 - 2010-05-05 17:39 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-06-04 22:31 - 2014-06-04 20:49 - 00000730 _____ () C:\SetupCD.txt
2014-06-04 21:39 - 2014-06-04 21:34 - 160489864 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-9-legacy_vista_win7_64_dd_ccc_whql.exe
2014-06-04 21:36 - 2014-06-04 21:35 - 26667268 _____ (Advanced Micro Devices, Inc.) C:\Users\lenovo\Downloads\13-1-legacy_vista_win7_win8_32-64_hydravision.exe
2014-06-04 21:36 - 2014-06-04 18:35 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-06-04 21:18 - 2014-06-04 21:18 - 00000000 ____D () C:\ProgramData\ATI
2014-06-04 20:55 - 2014-06-04 20:50 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-06-04 20:54 - 2014-06-04 20:54 - 00000000 ____D () C:\ProgramData\AMD
2014-06-04 20:51 - 2014-06-04 20:51 - 00000000 ____D () C:\ProgramData\Package Cache
2014-06-04 20:47 - 2014-06-04 20:47 - 00000000 ____D () C:\AMD
2014-06-04 20:25 - 2014-06-04 20:19 - 295347968 _____ (AMD Inc.) C:\Users\lenovo\Downloads\14-4-win7-win8-win8.1-64-dd-ccc-whql.exe
2014-06-04 19:45 - 2014-06-04 18:30 - 00000000 ____D () C:\ProgramData\Battle.net
2014-06-04 18:38 - 2014-06-04 18:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-06-04 18:38 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-06-04 18:36 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Roaming\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\Users\lenovo\AppData\Local\Blizzard Entertainment
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-06-04 18:33 - 2014-06-04 18:33 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-06-04 18:30 - 2014-06-04 18:30 - 02942368 _____ (Blizzard Entertainment) C:\Users\lenovo\Downloads\World-of-Warcraft-Setup-deDE.exe
2014-06-03 01:04 - 2014-04-24 17:26 - 00000000 ____D () C:\Users\lenovo\Tracing
2014-06-03 01:03 - 2009-07-29 09:00 - 00000000 ____D () C:\windows\Panther
2014-06-03 01:02 - 2014-06-03 01:02 - 00002774 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-06-03 01:02 - 2014-06-03 01:02 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-27 15:57 - 2014-05-27 15:54 - 72024288 _____ () C:\Users\lenovo\Downloads\Skrillex - Bangarang (EP 2011).zip
2014-05-22 21:55 - 2014-05-22 21:55 - 00114201 _____ () C:\Users\lenovo\Downloads\Bagnon_2.13.3.zip
Some content of TEMP:
====================
C:\Users\lenovo\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 01:58
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-06-2014 01
Ran by lenovo at 2014-06-11 18:21:45
Running from C:\Users\lenovo\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: - )
AMD Catalyst Install Manager (HKLM\...\{FAF03106-1653-15E1-3C0C-E7AE4FAE6EBF}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
ccc-utility64 (Version: 2010.0302.2233.40412 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.111.0.62 - Conexant)
Lenovo EasyCamera (HKLM\...\Lenovo EasyCamera) (Version: 5.8.0.12 - Silicon Motion)
Lenovo OneKey Recovery (Version: 7.0.1230 - CyberLink Corp.) Hidden
Logitech SetPoint 6.52 (HKLM\...\sp6) (Version: 6.52.74 - Logitech)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft SQL Server Native Client (HKLM\...\{79BF7CB8-1E09-489F-9547-DB3EE8EA3F16}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{86177DAE-38B1-49DD-912E-35CB703AB779}) (Version: 9.00.4035.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (10/19/2009 5.4.0.1) (HKLM\...\0A4175B489A1B4A6E07E11B063A6263480C51D71) (Version: 10/19/2009 5.4.0.1 - Lenovo)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Restore Points =========================
06-06-2014 22:00:00 Geplanter Prüfpunkt
09-06-2014 21:40:55 Installed Razer Diamondback
09-06-2014 21:42:08 Gerätetreiber-Paketinstallation: Razer Eingabegeräte (Human Interface Devices)
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {42936927-C026-4AF0-ADCA-FDFCBE85599D} - System32\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05} => C:\Program Files\V-bates\PrefHelper.exe
Task: {62E0D1B6-E032-477B-9911-28B974D68262} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {668D5013-3AD0-484A-A197-FE30C8A2F58E} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-20] (Adobe Systems Incorporated)
Task: {716EDE60-7769-4D29-BC22-1EC1EF3C36D7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-20] (Google Inc.)
Task: {876CE199-EBAC-4220-BD74-488EEE73FDCC} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {B7697EE0-7C0B-4890-B04C-25CEFB45DF8E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-05-20] (Piriform Ltd)
Task: {E4FA0B9D-58EC-42AC-BFA3-50E227FD05D0} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {EE16750A-A44A-4EA6-8082-741E1A5FB7FC} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\FF Watcher {C1A5E173-6377-4BC0-863F-36D4526ACA05}.job => C:\Program Files\V-bates\PrefHelper.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-05-05 18:13 - 2010-05-05 18:13 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll
2010-05-05 18:13 - 2010-05-05 18:13 - 00622592 _____ () C:\windows\system32\SimpleExt.dll
2014-06-10 07:03 - 2014-06-11 03:29 - 00317728 _____ () C:\Program Files (x86)\ScanTack\updateScanTack.exe
2014-06-10 15:24 - 2014-06-11 03:24 - 00317728 _____ () C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe
2014-06-09 00:30 - 2014-06-06 11:18 - 03268600 _____ () C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2010-05-05 18:29 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2014-06-09 23:41 - 2009-10-09 20:11 - 00226816 _____ () C:\Program Files (x86)\Razer\Diamondback\Razer\Diamondback\razerhid.exe
2014-06-11 03:26 - 2014-06-09 12:09 - 00287008 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTack.PurBrowse64.exe
2010-05-05 17:42 - 2010-05-05 17:42 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00012568 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe
2014-06-11 03:26 - 2014-06-11 01:16 - 00096544 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe
2010-05-05 18:13 - 2010-05-05 18:13 - 00492896 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 26065408 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libcef.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 00739840 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libglesv2.dll
2014-06-10 20:21 - 2014-06-10 20:21 - 00130048 _____ () C:\Program Files (x86)\Battle.net\Battle.net.4710\libegl.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00022296 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\lrcnt.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00059672 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\sppsm.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00016664 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2014-04-23 12:55 - 2014-04-23 12:55 - 00051480 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\srut.dll
2014-04-23 12:54 - 2014-04-23 12:54 - 00165656 _____ () C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2014-06-11 17:55 - 2014-06-11 01:16 - 00183584 _____ () C:\Program Files (x86)\ScanTack\bin\ScanTackBAApp.dll
2010-05-05 17:50 - 2009-06-05 18:37 - 00260096 _____ () C:\windows\system32\370prop.ax
2014-05-21 03:11 - 2014-05-14 01:40 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libglesv2.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libegl.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll
2014-05-21 03:11 - 2014-05-14 01:40 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/11/2014 05:40:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PluginService.exe, Version: 13.27.0.301, Zeitstempel: 0x536b5640
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009b7e6
ID des fehlerhaften Prozesses: 0x524
Startzeit der fehlerhaften Anwendung: 0xPluginService.exe0
Pfad der fehlerhaften Anwendung: PluginService.exe1
Pfad des fehlerhaften Moduls: PluginService.exe2
Berichtskennung: PluginService.exe3
Error: (06/10/2014 06:53:12 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.
Error: (06/10/2014 06:51:44 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
Error: (06/10/2014 03:24:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PluginService.exe, Version: 13.27.0.301, Zeitstempel: 0x536b5640
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009b48e
ID des fehlerhaften Prozesses: 0x524
Startzeit der fehlerhaften Anwendung: 0xPluginService.exe0
Pfad der fehlerhaften Anwendung: PluginService.exe1
Pfad des fehlerhaften Moduls: PluginService.exe2
Berichtskennung: PluginService.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x1118
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x15a8
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: DpInterface32.dll, Version: 3.0.2.3482, Zeitstempel: 0x535f638f
Ausnahmecode: 0x80000001
Fehleroffset: 0x0009b699
ID des fehlerhaften Prozesses: 0x1d64
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:47:51 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Name des fehlerhaften Moduls: RSHP.exe, Version: 2.0.3.263, Zeitstempel: 0x535f59f7
Ausnahmecode: 0x40000015
Fehleroffset: 0x00017b20
ID des fehlerhaften Prozesses: 0x145c
Startzeit der fehlerhaften Anwendung: 0xRSHP.exe0
Pfad der fehlerhaften Anwendung: RSHP.exe1
Pfad des fehlerhaften Moduls: RSHP.exe2
Berichtskennung: RSHP.exe3
Error: (06/10/2014 07:46:58 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm majfst.tmp, Version 51.52.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1ca0
Startzeit: 01cf846ea2c65991
Endzeit: 31
Anwendungspfad: C:\Users\lenovo\AppData\Local\Temp\is-0VV1A.tmp\majfst.tmp
Berichts-ID:
Error: (06/10/2014 07:46:44 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm package_scantack_installer_multilang.tmp, Version 51.52.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1208
Startzeit: 01cf846f38917f6a
Endzeit: 32
Anwendungspfad: C:\Users\lenovo\AppData\Local\Temp\is-NKJSG.tmp\package_scantack_installer_multilang.tmp
Berichts-ID:
System errors:
=============
Error: (06/11/2014 05:41:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/11/2014 05:40:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/11/2014 05:40:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:24:51 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "IePlugin Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/10/2014 03:24:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:24:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 03:23:58 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 10.06.2014 um 07:57:09 unerwartet heruntergefahren.
Error: (06/10/2014 07:46:19 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Search Protect Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/10/2014 07:37:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (06/10/2014 07:37:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 3836.2 MB
Available physical RAM: 2237.24 MB
Total Pagefile: 7670.55 MB
Available Pagefile: 5621.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:254.14 GB) (Free:30.09 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:0.95 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: F63AC172)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=254 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-11 18:48:34
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545032B9A300 rev.PBEOC64G 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\lenovo\AppData\Local\Temp\pxdirpog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe suspicious modification
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\utilScanTack.exe[2428] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe[3332] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe[3676] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Battle.net\Battle.net.4710\Battle.net.exe[5032] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe[3744] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\KERNEL32.dll
.text C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe[3392] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075d91401 2 bytes JMP 758deb26 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075d91419 2 bytes JMP 758eb513 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075d91431 2 bytes JMP 75968609 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075d9144a 2 bytes CALL 758c1dfa C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075d914dd 2 bytes JMP 75967efe C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075d914f5 2 bytes JMP 759680d8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075d9150d 2 bytes JMP 75967df4 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075d91525 2 bytes JMP 759681c2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075d9153d 2 bytes JMP 758df088 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075d91555 2 bytes JMP 758eb885 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075d9156d 2 bytes JMP 759686c1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075d91585 2 bytes JMP 75968222 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075d9159d 2 bytes JMP 75967db8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075d915b5 2 bytes JMP 758df121 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075d915cd 2 bytes JMP 758eb29f C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075d916b2 2 bytes JMP 75968584 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\ScanTack\bin\ScanTack.BrowserAdapter.exe[1452] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075d916bd 2 bytes JMP 75967d4d C:\windows\syswow64\kernel32.dll
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe suspicious modification
INITKDBG C:\windows\system32\ntoskrnl.exe suspicious modification
---- Processes - GMER 2.1 ----
Process C:\ProgramData\WindowsProtectManger\wprotectmanager.exe (*** suspicious ***) @ C:\ProgramData\WindowsProtectManger\wprotectmanager.exe [1604] (WindowsProtectManger Service/Fuyu LIMITED)(2014-06-10 05:46:17) 0000000000840000
Process C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\fst_de_37\upfst_de_37.exe [3332](2014-06-08 22:30:40) 0000000000b00000
Process C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe (*** suspicious ***) @ C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe [3744] (Battle.net Update Agent/Blizzard Entertainment)(2014-06-04 16:30:49) 00000000011b0000
Process C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:54:14) 0000000000e20000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\lrcnt.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:54:14) 0000000072eb0000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\MouseKeyboardActivityMonitor.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392] (MouseKeyboardActivityMonitor/Mouse and Keyboard Hooks .NET)(2014-04-23 10:54:20) 0000000072ec0000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\sppsm.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:55:18) 0000000063510000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:55:02) 0000000062790000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\srut.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:55:34) 0000000062940000
Library C:\Users\lenovo\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll (*** suspicious ***) @ C:\Users\lenovo\AppData\Local\Smartbar\Application\Lrcnta.exe [3392](2014-04-23 10:54:58) 0000000063800000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)
---- EOF - GMER 2.1 ----
 MfG shadowface aka kevin |
Baum-Darstellung